IEEE Consumer Electronics Magazine - October 2015 - 64

BANDITS STILL THRIVE
Bandits are all around us, busily creating open Wi-Fi access
points named "public library," "Starbucks," "AT&T," or some
other random naming convention that you most likely have
accessed in the past and will automatically connect to if you
are in range and you never turn off the Wi-Fi on your mobile
device. The bandit has even gone so far as to create fake base
stations for you to connect to and in parallel is attempting to
push data to your device via Bluetooth.
What have you done to secure your personal and financial
data? You set a four-digit numeric passcode-the figurative
equivalent of securing your vault with scotch tape and saliva.
The bandit rode up with masks and guns and you weren't
even on the train, but your bags of money were there, positioned neatly with a note attached saying, "Sorry I couldn't
be here, but I was elsewhere preparing for an entirely different, less likely crime. Enjoy the cash!"

▼

HARDENING YOUR SMARTPHONE =
LOCKING YOUR SAFE
So, now that you are aware of the threat, it's time to address
the problem. I use the safe analogy because the reliability of
your precautions always depend on the skill level of the guy
cracking your safe. In other words, as technology evolves, so
do attackers. The most common problem is that consumers
will place an emphasis on security for a short period of time
and over time will ignore important activities such as software updates, turning off Bluetooth, near-field communication (NFC), and Wi-Fi.
The following tips can help to get you on the right track,
but situational awareness is always the best defense.
▼ Encrypt your data: The first thing I would recommend to
anyone using an electronic device to store sensitive data is
to encrypt the device. Some smartphones come with
encryption options, but others require an app. The stronger
the algorithm, the better the encryption. Most mobile
encryption solutions don't provide end-to-end encryption
for data being transferred wirelessly from one place to
another. They do, however, provide security for the data
being stored on the device's hard drive. This protects
your information from being accessed by anyone that
doesn't have your password, which makes the next rule
even more important.
▼ Create a complex password: You've probably heard this
one before, but it's a classic. Passwords should have letters, numbers, and special characters in them, and the longer they are the better. Each character exponentially
increases the number of possible combinations used to create a password, therefore increasing the difficulty in cracking that password. There's no such thing as a password
that is impossible to crack, so changing your password
regularly can help keep your data safe.
▼ Install an antivirus program: Antivirus programs aren't the
end all, be all to mobile security, but they help. Many of
them do a pretty good job at scanning apps for known
threats, however, new threats always pop up. They also
64 IEEE ConsumEr ElECtronICs magazInE

october 2015

▼

have the ability to locate a lost device, back up photos,
lock apps, and wipe the device if it falls into the wrong
hands. A few good programs are Avast!, Lookout, or AVG,
which all have free versions. The bottom line here is that
the best offense is a good defense, so lock down your
device as best you can.
Update your operating system and your apps: I know what
you're thinking, "What? I can't do that, Facebook will
access my camera to sell my picture to the government and
Illuminati to take over all the oil in Mexico if I update my
apps." First, calm down; second, they already have the oil;
third, and most important, these updates often include security updates. Remember when I said that attackers stay busy
creating new threats? Well app developers are busy patching
the vulnerabilities stop those threats from doing you harm.
Help them help you by keeping your apps up to date.
Disable unneeded wireless capabilities: As previously
mentioned, an attacker can set up a wireless hotspot with a
common name like "public library" or "Starbucks." If
you've connected to an open access point like the public
library before, you already have that value saved in your
Wi-Fi settings. If your phone has an "auto connect" feature,
it will automatically want to connect to that access point
when in range. The best bet for preventing this is to turn off
any services that you aren't currently using. A recommendation would be any and everything such as NFC, Wi-Fi,
Bluetooth, and the global positioning system. This will also
save your battery life.
Change your default e-mail signature: Most mobile
phones have e-mail platforms already installed. By default
they say something like "Sent from my Android," or "Sent
from my iPhone." When you use this default message it
tells everyone, including attackers, what operating system
you are using. This isn't a big deal to your uncle Henry
(who goes by "Hank" because he hates being compared to
your grandfather), but to an attacker this is a huge piece to
a puzzle that leads to your device being hacked. A simple
fix is to change that message to something generic like
"Sent from my mobile device."
Don't be stupid: This goes without saying, but the biggest
threat to anything of value is usually the carelessness of the
user. We keep a lot of important data on our phones. This
data can lead to identity theft for you and your loved ones,
loss of funds, and for some, work-related info that can get
you fired if found in the wrong hands. Treat your mobile
device like you would your purse or wallet. After an incident is the worst time to start thinking about security. The
bandits are out there, and it's high time for you to start acting like the sheriff.

ABOUT THE AUTHOR
Brett Mabrie (bmabrie@cryptotrust.net) is a cybersecurity professional who has consulted on information assurance and network
security issues for the past ten years. He earned a B.S. degree in
cybersecurity and holds both CISSP and Security+ certifications.

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - October 2015