Section 5: Mobile Device Security Flashcards
What is the highest level of wireless security?
WPA2 - Wireless Protected Access
What Encryption does WPA2 rely on?
AES - Advanced Encryption Standard
What does Bluetooth pairing create?
A shared link key for encrypting the connection
Which connection is almost always more secure?
Wired or Wireless?
Wired
How can you protect yourself from Mobile Malware?
- Antivirus
- Patched and Updated
- Official Apps only
What are some Unique Attacks to Mobile Devices?
- Social Engineering
- Pre-texting scams
- Texts which include links
Should you JailBreak/Root your mobile device?
No
Should you use custom firmware or custom ROM on your mobile device?
No
Where should you get your Apps for your mobile device?
Official App Store
What should you do with your phone’s operating system?
Keep it up to date
What is a SIM card?
Integrated circuit that securely stores the international mobile subscriber identity (IMSI) number and its related keys
- Subscriber Identity Module
- communicates with cell towers and tells them which device is which number
What does SIM stand for?
Subscriber Identity Module
What is SIM cloning?
When 2 phones are utilising the same card. This allow’s an attacker to gain access to the phone’s data.
- both phones get the same message/text
Which version is harder to clone between SIM V1 and V2?
V2 are much harder
What can attackers achieve with Social Engineering regarding phone attacks?
They can call your phone provider and give them information that is OSINT and found online on social media. Once they get access to your number they can:
- Bypass 2FA
- Get 2FA code in their phones and login to your email accounts
If an attacker has your phone number, what can they do?
- ID theft
- Account takeover
How can Theft ID & Account takeover be prevented?
Do not post your phone numbers online
What is a Google Voice Number?
A number that sits on top of your real number. This hides your actual phone number which you can then use your real number to authenticated 2FA.
What is BlueJacking?
When an attacker sends unsolicited messages to Bluetooth enabled devices
What is BlueSnarfing?
Unauthorised access of information from a wireless device over a Bluetooth connection
What is the difference between BlueJacking and BlueSnarfing?
BlueJacking - Sending information
BlueSnarfing - Taking information
What should you ensure you always have with your device’s data?
Device Backup
How can you secure your mobile device?
- Encrypt your device
- Full disk encryption
- track your device
How can you find where your phone is?
Apple - Find my iphone
Android - Find my phone
What can you also do on the find my phone websites?
- Remote Lock
- Remote Wipe
When browsing, what should you make sure websites have?
HTTPS - TLS (Secure tunnel)
What is TLS?
Transport Layer Security - encrypts data in transit
What is a Mobile Device Management (MDM) solution?
Centralised software that allows system admins to create and enforce policies across mobile devices
What can MDM do?
- Block Websites
- Block Apps
- Enforce policies
What does Allow Location Access for apps is a concern of?
Privacy concern - Apps always know your location
What is Geotagging?
Embedded geolocation (GPS) coordinates into a piece of data (i.e. photos)
What is BYOD?
Bring Your Own Device
Why could BYOD be a security issue?
When the device is connected to your work network, every vulnerability the device has, is introduced to the network
- malware at home, is then brought to the work network
What is Storage Segmentation?
Creating a clear separation between personal and company data on a single device
What are some ways to enforce Storage Segmentation?
- Virtual environment app on your mobile device
- 2 different email apps for work / personal
Is it possible to have MDM on your BYOD?
Yes, but who would want that on their personal device?
What is CYOD?
Alternative to BYOD. Choose Your Own Device
- employees get a choice of phone
- can install MDM
- technical policies etc
What can MDM provide?
- block app installation
- DLP
- turn features on/off such as WiFi connectivity so you are forced to only use cellular data (policy)
What are 10 ways of hardening your mobile device?
- Update
- Antivirus
- User training
- Only use official app store
- no root/jailbreak
6.only use V2 SIM - turn off unnecessary features
- encryption for voice & data
- strong password or biometrics
- no BYOD