1. Smartphone Security How safe are you?

2. Main Points 1. Malware/Spyware 2. Other Mischief 3. How a phone might get infected 4. Staying Safe a. Malware b. Loss c. WiFi/Bluetooth

3. I. Malware/Spyware on My Phone - What Can Go Wrong? QUERY1: If a hacker got into your phone, what would you NOT want him/her to see &/or copy…?

4. Hackers can see and in some cases even alter:  calendars, address books, contact lists  photos  iTunes music files  text messages, old and new (even deleted ones)  details about every phone call  the location of the phone at all times  Web browsing details and history  Plus, all your subsequent phone calls could be recorded and forwarded to a third party

5. Hackers can make calls from your phone without your knowledge QUERY 2: What websites or numbers would you NOT want a hacker to call from your phone…? Malware/Spyware on My Phone - What Can Go Wrong?

6.  Porn sites … $$$  Overseas numbers … $$$  The hacker herself. This turns the phone into a bugging device because he/she can hear everything you say and (maybe) do  Your contacts in the middle of the night

7. QUERY 3: Is it safe to conduct financial transactions over my cell phone…? Malware/Spyware on My Phone - What Can Go Wrong?

8.  In January, 2010, a single developer created fake 99-cent Android apps for over 50 banks. The app prompted users for their banking username and passwords [Notes]  In 2011 a hacker built a botnet that could steal data such as online banking credentials off “jailbroken” iPhones [Notes]

9. 2. Other Mischief  Have you ever heard of a DDOS (distributed denial of service) attack? What is it?  Can cell phones be directed by a “slavemaster” to slam their carrier with so much traffic it can’t handle it?  Yes, they can

10. 3. How Does a Phone Get Infected?  Does a hacker need physical access to your phone?  NO  So how does the malicious code get there…?

11. Malicious software can be:  downloaded by a click on a website link  opened in an email/text attachment  introduced by an infected app  introduced simply by clicking on Quick Response codes (those black-and-white squares starting to show up in ads)

12. Via Bluetooth?!  Simply leaving your Bluetooth enabled while in a public place allows an intruder access  Hacker simply downloads software onto a laptop (available free on the web)and adds a Bluetooth antenna  Next slide gives examples of Bluetooth hacker activities

13.  “Bluesnarfing” - downloading any and all information from a hacked device (for example, address book information, photos, calendars, SIM card details)  Hacker could send a “corruption code” and completely shut down the phone and make it unusable  “Bluebugging” - hacker makes the compromised phone call another device (the one the hacker is using, or long-distance calls to worldwide locations)  The hacker could make “micro-purchases” with the hacked phone which show up on the subscriber’s bills http://tech.blorge.com/Structure:%20/2009/02/22/how-to-hack-bluetooth-cell- phones-and-how-to-protect-yourself/

14.  GOALS  1. keep malware off your cell phone  2. protect the information stored on your phone if it is lost  3. protect from intrusion/theft during Wi-Fi or Bluetooth transmission  Each of these three will be discussed next… 4. Staying Safe

15. 4a. Keep Malware off Your Phone  Do not jailbreak your phone  Do not click on website links from unknown sources ( 1/3 of smartphone users have been negatively affected by a link they clicked)  Only download applications from trusted sources, such as reputable application markets ( Remember to look at the developer name, reviews, and star ratings)

16.  Do not click on multimedia attachments in texts/emails from unknown sources  Always check the permissions an app requests  Using an official banking application is safer than banking through your mobile’s online browser

17.  Download a trusted mobile security anti-virus app for your phone  Learn how to update your operating system (http://www.tescotechsupport.com/2012/01/11/update-your-smartphone- software/).http://www.tescotechsupport.com/2012/01/11/update-your-smartphone- software/  Beware of Porn sites ( Nearly one-quarter of malware on phones and tablets comes from visits to porn sites)

18. How are we doing (malware) ? Student responses n=106 total n=85 with smartphone I have or definitely would I haven’t but I might I haven’t and would not Don’t know Do you open multimedia attachments received in texts or emails from unknown sources? 45%16%33%6% Do you download apps that request access to your contacts or other personal information? 38% 10% 45% 7% Have you installed anti- virus software on your smartphone? Yes 24% N/A No 63% Don’t know 13%

19. Why might people click on website links or open multimedia attachments from unknown sources?

20. 4b. To minimize damage if phone is lost or stolen  Password/passcode protect your phone  Log off mobile apps (Logging in every time prevents someone from having access if you lose your phone)  Backup and secure your data at least monthly (Contacts, documents, and photos, e.g.)  Install security apps that enable remote location and wiping  Wipe data on your old phone before you donate, resell or recycle it  Report a stolen smartphone

21. How are we doing (if lost)? YesNo Don't Know To wake up after idle, is a password or passcode required on your smartphone? 54% N/A 45% 1% Always Some- timesNever Don’t know Do you disconnect off applications such as Facebook and Gmail when you are done using them? 19%30%45%6%

22. Why might people not password protect their phone?

23. 4c. Wi-Fi/Bluetooth transmission  When transmitting information via wireless networks, use encryption  Disable Bluetooth when you are not using it

24. How’re we doing (WiFi/Bluetooth) ? Always or Most of the Time Some- times Never Don’t use this feature Do you disable Blue Tooth when it's not in use? 55% 7% 13% 25%

25. Why might someone keep Bluetooth enabled when not using it?

26. Last question – have you or anyone you know had any type of smartphone security breach? Very Serious A bit of a problem Some- what annoying Harm- less No one I know has I or someone I know personally has experienced a security threat with their smart phone that was… 3% 9% 22% 4% 62%

27.  Describe…