Hacked smartphones pose military threat

Malicious software that commandeers phone functions could give wartime enemies valuable information about troop locations and movements

Hacked smartphones could endanger troops by sending location data to the enemy using mechanisms similar to those employed by recently discovered Android malware, experts say.

Malicious software that commandeers phone functions could give wartime enemies valuable information about troop locations and movements, according to Hugh Thompson, a software security professor at Columbia University and conference chairman for the RSA Confernece, and Markus Jakobsson, who works on the PayPal online security and malware strategy team.

"Even normal apps can send a lot of information back home," Thompson says, and individual users are generally ill equipped to determine whether these apps represent security risks.

Jacobsson says he has discussed the problem with the Defense Advanced Research Projects Agency (DARPA). In fact, DARPA brought it up. "I would say the military are aware of it but not very comfortable with it," he says.

Top 5 DARPA technology projects of 2010

Misuse of legitimate phone features can be dangerous, he says. For example, troops who send photos they've taken on their cell phones may not realize the phones embed GPS data giving out the longitude and latitude of where it was taken. Such photos intercepted by enemies or sent to them covertly by malware on the phone could reveal troop locations, he says.

In the case of the Android malware discovered in Russia, it sends SMS messages to a destination that charges the phone account $5, but that type of unauthorized activity could be sending critical information about troop locations, Jakobsson says. (Also see: Smartphone security thwarted by fingerprint smudges.)  

For instance, malware that sent out geolocation data every half hour could potentially reveal troop movements, he says. Even timestamps on photos could be somewhat revealing. Time of day combined with lighting in outdoor conditions could reveal something about where in the world the camera was when it took the photo, he says.

These leaks could be enhanced by malware infecting phones, and such software could be deposited there via applications users buy and approve of. Whenever someone buys a smartphone app, the processes it requires access to are listed and the buyer has to OK the list. But that's not a question most users are qualified to answer. "It's difficult enough to use computers," Jakobsson says. "It's not a good question to ask them and we shouldn't ask them to answer it."

Instead, he proposes safety applications that monitor what processes are in use and that trigger pop-ups that warn users when something suspicious is going on. Such software could have a soldier setting that would block phone activity that poses potential threats in a military zone, he says.

Via his company FatSkunk, he proposes software for handsets that periodically detects active malware. If deployed on troops' phones it could trigger warnings and infected phones could be brought to facilities for cleaning.

Adrian Perrig, a professor at Carnegie Mellon University, is working on a similar product that works slightly differently, but the goal is the same. He is exploring use of software that creates a trusted isolated environment into which authorized phone software can be launched and patched to protect it from malware. This safe zone is called a Dynamic Root of Trust, he says.

Perrig is also looking at hardware-based checks of whether a phone's authorized configuration has been tampered with. This could be done with a separate trusted device, but chips with hardware security built in are available from ARM that would allow this check to be done by the phone itself.

"All phones offer a lot of opportunity for observing what the operator is doing -- e-mail, GPS, finding restaurants," Perrig says. Malware can turn phone microphones on or snap photos surreptitiously, he says.

As personal devices are used more and more outside personal settings, this issue will become more important, and not just in war zones, Thompson says. "It's a business and military issue," he says.

Read more about wide area network in Network World's Wide Area Network section.

Tags consumer electronicsHacked smartphonessecurityNetworkingwirelessPhonessmartphonespaypalanti-malware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?