McAfee Shows Security Flaws of Smartphones (Especially Android Devices) | News | ChannelWorld.in

PARTNER HOTLINES

McAfee Shows Security Flaws of Smartphones (Especially Android Devices)

Added on Oct 29, 2012 by By Rob Enderle CIO.com

McAfee Shows Security Flaws of Smartphones, Android DevicesThis week at McAfee Focus the security vendor pounded home one point that it really didn't think attendees understood: Virtually every smartphone can compromise enterprise security. However, I walked away with a vastly bigger concern: enterprise security practices, short of confiscating smartphones entirely, may actually be making us more vulnerable.

One of the jobs I held at IBM was in the internal audit department, and one of the skills I seemed to be best at was finding ways to successfully breach security that others thought was bulletproof. My last audit-and this is likely why it was my last audit-took me into the secure safe of a top IBM executive and gave me access to files that only two or three people in the world had ever seen. After that, security was my specialty, and ever since I've been a security analyst or had security analysts report to me.

I've always had a knack for being able to look at a security practice and figure out how it could be successfully breached. That's why I was so interested in what McAfee had to say this week about operating system and smartphone security.

Scary Landscape: Boot Files All Too Easy to Access

McAfee CTO Mike Fey demonstrated a proof of concept attack tool the company has developed to showcase just how easy it is to compromise current platforms. Most companies have been penetrated already, he says, with data analytics tools secretly installed so attackers can get a general sense of which user has the most systems authority or, in the case of banking, who moves the most cash. That's who attackers target.

Typically, the attackers' goals are to do a lot of damage, get access to confidential information or transfer cash. As an example, McAFee showcased a man-in-the-middle attack in which the browser session is hijacked and the user's ID, password and challenge question answers are captured. From there, a cash transfer is executed, and the user is pointed to a false account screen that doesn't show the transfer. This way, the user can't stop the order until the cash is beyond retrieval.

A scarier demonstration followed. Starting with a Windows 7 PC, McAfee accessed the boot files and successfully reformatted the drive while the unsuspecting user was online. This, of course, would result in a recovery event-and if you can reformat the system, then there is little else you can't do with it, even if you're not in Admin mode.

The demo then moved to a Mac. This time, McAfee corrupted the firmware, which would not only destroy the data but require the machine be sent back to Apple for repair, since Apple doesn't let IT departments or users flash firmware themselves. The scariest scenario of, though, involved Android. While the Windows and Mac attacks seemed complex, the Android attack was comparatively easy, and McAfee got the hacked product to overheat and cook itself, destroying the hardware.

McAfee also argued that attacks such as this are often associated with root kits. That makes it hard for security software that doesn't have a fixed hardware component to address this successfully. While this was clearly a pitch for Deep Defender, which McAFee co-developed with parent company Intel and which is only made available to Windows machines at large business, it is interesting to note that the attack would not have worked on Windows 8. That showcased (intentionally or otherwise) one of the more endearing aspects of the new operating system: secure boot partition.

Smartphone Security Leaves a Lot to Be Desired

However, there is no Deep Defender for smartphones, though McAfee has released mobile security software for Android devices. All you need is to install a vulnerability in a compelling free app. Get a target to install the app, then attack the vulnerability to access whatever's on the device (passwords, IDs, addresses, bank account numbers and so on) and/or activate camera and microphone functionality to essentially turn the device into a spy. 
This is when I had my "A-ha!" moment. While you can protect, to some extent, a business phone, how many employees have personal phones on the corporate network that you don't know about? Let's say I wanted to bug a politician, executive, security officer, teacher, competitor, ex-spouse, rival…you get the point. I just need to get them to use a compromised phone; if they carry two, I can go after their personal phone. I could make the compromised app look like some sort of promotion and, once it's installed, turn that phone into a bug that's constantly taking pictures or recording every meeting and conversation, even if the phone isn't used for that particular call. I could try for a drive-by download, too.

While curated app stores like the Apple and Microsoft stores actively look for malware, they don't aggressively check for bugs and wouldn't know where to look for a creative exploit. If I build an app that is never widely sold or used, the chance of the exploit being found is low. If I root the phone, too, I can likely destroy the forensic data that would let an investigator figure out how this happened.

This makes me wonder how many people on the Mitt Romney and Barack Obama campaign teams have phones that are broadcasting confidential information. How many police departments have been compromised? How many IT departments, bankers and private citizens don't know they are broadcasting?

This goes beyond putting a security software and a security policy in place. This is making sure a device can't be rooted-or, failing that, this is preventing it from even going into any insecure area.

As another McAFee Focus attendees pointed out, it's probably wise to avoid banking on your smartphone and talking about anything sensitive in range of your phone. If someone sends you a free phone, check and double-check the authenticity of the source before you use it. It's something to keep in mind as holiday shopping season starts.

Rob Enderle is president and principal analyst of the Enderle Group. Previously, he was the Senior Research Fellow for Forrester Research and the Giga Information Group. Prior to that he worked for IBM and held positions in Internal Audit, Competitive Analysis, Marketing, Finance and Security. Currently, Enderle writes on emerging technology, security and Linux for a variety of publications and appears on national news TV shows that include CNBC, FOX, Bloomberg and NPR.

Follow everything from CIO.com on Twitter @CIOonline, on Facebook, and on Google +.

Read more about smartphones in CIO's Smartphones Drilldown.

TECHNOLOGY DIRECTIONS 2015

Enhancing Digital User-Experience in 2015: Karthik Ananth,Zinnov

How digital transformation is impacting the way companies engage with their customers.

Collaborating To Outcome Based World: Priyadarshi Mohapatra, Avaya

Priyadarshi Mohapatra, Managing Director, India and SAARC, Avaya, on how IT is transitioning from a keep-the-lights-on role to one that enables customers to deliver results.

Journey to the Third Platform in 2015: Rajesh Janey,EMC

Rajesh Janey, President, EMC, India and SAARC, says that flash storage will accelerate the growth of the third platform.

Fostering New Relationships in 2015: Partha Iyengar, Gartner

In order to adopt a digital business strategy, channel partners need to establish relationships with LoBs.

Combating a New Breed of Cyber Attacks in 2015: FireEye

Ramsunder Papineni, Regional Director, India and SAARC, FireEye, on the paradigm shift in today’s threat landscape and how organizations can combat new threats.

The Dawn of the Digital Age: Akhilesh Tuteja, KPMG

The development of digital infrastructure will be a key growth driver for technology and solution providers. 

Paradigm Shift from End-Users to User-First : Parag Arora,Citrix

Parag Arora, Area Vice President and India Head, India Sub-continent, Citrix, says new technologies will force organizations to take a user-first approach in 2015.

HP's Blueprint for 2015 - SDN and Cloud Computing : Neelam Dhawan

Neelam Dhawan, VP and General Manager, Enterprise Group and Country MD, HP India,  on why a combination of cloud computing and SDN will dominate 2015.

SAP Banks on HANA for 2015 : Ravi Chauhan

Ravi Chauhan, Managing Director, India and Sub- continent, SAP, on becoming a cloud company powered by HANA.

Mobile and Cloud Are Gamechangers of the Future: Karan Bajwa,Microsoft

Karan Bajwa, Managing Director, Microsoft India, says, in  2015, organizations will adopt a mobile-first and cloud-first strategy to get ahead of competition.  
 

Ready to Fight 2015's Threats : Jagdish Mahapatra,McAfee

Jagdish Mahapatra, Managing Director, McAfee, India and SAARC, part of Intel Security, says the company is armed with new solutions to beat sophisticated threats.

A Network for the Internet of Everything : Dinesh Malkani,Cisco

Dinesh Malkani, President, India and SAARC, Cisco, talks about IoT and the significant technology transitions in the networking world.
 

Moving to the Third Platform: Jaideep Mehta, IDC

Cloud and mobility are the two technologies that will fuel the rapid adoption of the third platform in India.

Envisaging a Holistic Security Strategy For 2015: Sanjay Rohatgi,Symantec

Sanjay Rohatgi, President–Sales, Symantec India, says the company has a set of holistic solutions in place to secure organizations from security threats. 

Intel's 2015 Plan: Taking the Digital India Story Forward

Debjani Ghosh, VP-Sales and Marketing Group and MD, South Asia, Intel, is banking on innovative technology to make the Digital India dream a reality.

Embracing SDN in 2015: Ashish Dhawan,Juniper Networks

Ashish Dhawan, Managing Director, India and SAARC, Juniper Networks, talks about the company’s well-etched roadmap to ride the SDN wave.

Beating the Bad Guys: Sivarama Krishnan, PwC

Organizations will need to turn inwards to establish robust information security strategies.

Hybrid Cloud is 2015's Biggest Gainer: Sunil Gupta,Netmagic

Sunil Gupta, Executive Director and President, Netmagic, an NTT Communications company, expects the hybrid cloud to be the biggest gainer in 2015.

2015 is the Year of SDDC: Arun Parameswaran,VMware

Arun Parameswaran, Managing Director, VMware India, says 2015 will be the year of software-defined datacenter.

Enterprises Surging Ahead with Hybrid Cloud in 2015 : Anil Valluri,NetApp

Anil Valluri, President, NetApp, India and SAARC, says, in 2015, enterprise platforms will start encompassing hybrid cloud architectures.
 

Armed for 2015's Security Threats: Anil Bhasin,Palo Alto Networks

Anil Bhasin, Managing Director, Palo Alto Networks India, says new threats weaken an organization’s network but advanced security tools can change that.

Building Capabilities for a Digital Tomorrow: Alok Ohrie,Dell

Alok Ohrie, President and Managing Director, Dell India, on the company’s investments to build end-to-end solutions and delivery capabilities for a digital world.

Going Truly Mobile in 2015: Vikram Sehgal, Forrester Research

India is embracing mobile faster than mature economies. Here’s what it needs to watch out for to do it well.

VIDEOS | FORECAST 2015

SAP Cloud Strategy Powered by HANA: Ravi Chauhan

CIOs will rapidly adopt SMAC in 2015, and SAP has innovative solutions to provide business advantage and competitive edge to India Inc., says Ravi Chauhan, MD, SAP India.

Dell to Dominate Converged Infrastructure Market in India: Alok Ohrie

From a PC manufacturer to an end-to-end solutions provider, we are gaining India market share through a strong partner ecosystem: Alok Ohrie, MD & President, Dell India.

Citrix Will Catalyze Shift From End-user to User-First: Parag Arora

Parag Arora, Area VP and India head, India Sub-continent, Citrix, talks about the company’s vision to drive a paradigm shift in enterprise IT: From an end-user approach to a user-first approach powered by mobile and cloud computing and enabled by competent channel partners.

Mobility to Boost Collaboration and Conferencing in 2015: Priyadarshi Mohapatra, Avaya

Avaya delivers great value as an end-to-end communications solutions provider across data, audio and video, says Priyadarshi Mohapatra, MD India and SAARC, Avaya

Securing Organizations Against Modern Day Threats: Sanjay Rohatgi, Symantec

We have proven that we can manage and secure an organization’s data from within and outside a network, which is a vital requirement by CISOs today, says Sanjay Rohatgi, President-Sales, India, Symantec.

We are the Apple of Network Security World: Anil Bhasin, Palo Alto Networks

Anil Bhasin, Managing Director, Palo Alto Networks India, says new threats weaken an organization’s network but advanced security tools can change that.

Software Defined Networking to Rule in 2015: Ashish Dhawan, Juniper Networks

Networking is definitely moving towards a software-defined paradigm and we continue to dominate the India market with an extensive portfolio, and well-entrenched channels, says Ashish Dhawan, MD, India and SAARC, Juniper Networks.

EMC to Dominate 3rd Platform Across India Inc.: Rajesh Janey

In the last year, EMC has refreshed its entire product line to enable customers take advantage of the 3rd platform, says Rajesh Janey, president, India and SAARC, EMC.

IoT Vital for Digital India Initiative: Debjani Ghosh, Intel

The tons of data that will be generated in the coming years will open opportunities in storage, and analytics, says Debjani Ghosh, VP, sales and marketing group, and MD-South Asia, Intel.

VDI, Flash and Hybrid Cloud to Propel Storage Market: Anil Valluri, NetApp

We are witnessing a movement from traditional data storage systems to a hybrid cloud environment says Anil Valluri, president, India and SAARC, NetApp.

SDDC is the Big Shift for 2015: Arun Parameswaran, VMware

Arun Parameswaran, MD, VMware, says that in India, unlike other countries, there is still a huge untapped opportunity to virtualize existing infrastructure in 2015.

Go Cloud for Business Advantage: Sunny Sharma, Foetron

Sunny Sharma, CEO and Founder, Foetron, speaks about the company's focused roadmap to ride the public cloud wave.

FireEye to Combat APTs Across Multiple Vectors in 2015: Ramsunder Papineni

Going into 2015, organizations need to think of security more holistically, including ways to defend end points, e-mail, Web, file, and mobile security, says Ramsunder Papineni, regional director, India and SAARC, FireEye.

The 2015 Challenge: Retaining IT Talent: Shirish Anjaria, Dynacons

Shirish Anjaria, CMD, Dynacons Systems & Solutions, speaks about how partner companies can enhance the talent pool of skilled IT staff.

New Style of IT to Gather Traction in 2015: Neelam Dhawan, HP

SDS, SDN and software defined infrastructure will play a key role across Indian organizations in 2015, says Neelam Dhawan, VP and GM, enterprise group, country MD India, HP.

Building Strong Vendor-Partner Relationships: Pawan Khurana, QuantM

Pawan Khurana, CEO, QuantM, on what he expects from technology vendor companies in 2015.

IoE to be Biggest Market Disruptor in 2015: Dinesh Malkani, Cisco

We continue developing innovative solutions in IoT and cloud computing and help our partner ecosystem capitalize on market opportunities, says Dinesh Malkani, president, Cisco India and SAARC.

New Technologies For New Growth: Murtuza Sutarwala, Swan Solutions & Services

Deep selling and upselling emerging technologies to customers enhances our value proposition as a competent solution provider, says Murtuza Sutarwala, Swan Solutions & Services.

Analytics is a Goldmine for Channels in 2015: Anoop Pai Dhungat, Galaxy Office Automation

Analytics, mobility, and security are the technology megatrends for us in 2015, says Anoop Pai Dhungat, CMD, Galaxy Office Automation.

Smartphone Proliferation to Impact Mobile Strategies in 2015: Vikram Sehgal, Forrester

Enhancing customer experience through mobility will be key priority for organizations in 2015, says Vikram Sehgal, VP and Research Director, Forrester.

3rd Platform to Take Off in India: Jaideep Mehta, IDC

Jaideep Mehta, MD, India and South Asia, IDC, say cloud computing and mobility will be the fastest growing 3rd platform technologies in India.

Opex Model the Way Forward for Partners in 2015: Ajay Sawant, Orient Technologies

Ajay Sawant, Orient Technologies, talks about the massive shift as traditional system integrators move towards an Opex-led business model.

Digital India is Colossal Opportunity for Channels: Akhilesh Tuteja, KPMG

Channel partners should devise a vertical strategy with the right alliances and innovative solutions, says Akhilesh Tuteja, Partner-IT Advisory, KPMG India.

Going Digital the Way Ahead for India Inc: Karthik Ananth, Zinnov

Since India is a mobile -first market, Indian organizations that are turning digital should ensure that they deliver a uniform experience for their customers, says Karthik Ananth, Director, Zinnov.

EDITOR'S PICK

Forecast 2015: IT Spending On An Upswing

As purse strings loosen up, CIOs blend innovation into 2015 IT budgets, but security and cost containment remain top priorities.

‘Security Compliance is Not a Proactive Phenomenon in India’

Pavan Duggal, Cyber Law Expert at the Supreme Court of India, explains why channel partners need to look beyond the IT Act 2000 as the security standards, given today’s fast-changing threat landscape, rapidly evolve.

IT is Indispensable for Business Optimization: David Aires, Intel

David L. Aires, VP, Information Technology Group, and GM, Information Technology Operations, believes security to be the biggest challenge in the current IT environment.

Is the CIO Role Nearing Extinction?

New technologies are shifting power to the hands of the user, endangering the CIO role. But do Indian CIOs consider that a threat or an opportunity? 

The Authentication Market is Big Play for Channels: Gaurav Chawla, Gemalto

We are building a partner network to address the increased demand for authentication solutions across India, says Gaurav Chawla, Director, IAM, Gemalto India.

Versatile Infosecurity: Riding the Security Wave

It takes vision and persistence to stay on top of the security curve. Versatile Infosecurity has mastered that art.

How Futurenet Technologies Helped Sterlite Copper Adopt Next-gen Client Computing

Sterlite Copper was able to successfully adopt next-gen client computing facilities with hand-in-hand assistance from Chennai-based Futurenet Technologies.

DigitalTrack Solutions: Right on the Security Track

DigitalTrack is keeping pace with the changes in the IT security space through DDoS and WAF solutions and is pushing security audits as part of its next move.

SLIDESHOWS

6 Leaders Who Headed for an Abrupt Exit

The abrupt exit of top leaders of Indian and global tech companies this year, with many of them citing ambiguous reasons, surprised the technology world.

Gartner Executive Summary Survey 2014

Gartner's Annual CIO Survey highlights the trends that will drive organizational IT spend in 2014.

10 Overhyped Tech Products That Crashed and Burned

The demos blew everyone away. Then reality hit.

Gartner Executive Summary Survey 2014

Gartner's Annual CIO Survey highlights the trends that will drive organizational IT spend in 2014.

ChannelWorld Survey: State of the Market 2014

Partners poll their sentiments, expectations, pain points, and challenges for the coming year.

FAST TRACK

TIM Infratech

Delivering ‘best of breed’ technologies to enterprises is key to success, says Monish Chhabria, MD, TIM Infratech

Mudra Electronics

A vendor-agnostic strategy helped us sustain business, says Bharat Shetty, CMD, Mudra Electronics.

Systematix Technologies

Our USP is a customer-friendly approach backed by services, says Akhilesh Khandelwal, Director, Systematix Technologies.

CorporateServe Solutions

Our ability to turnaround complex ERP projects in record time is what gets us customer referral, says Vinay Vohra, Founder & CEO, CorporateServe Solutions.

KernelSphere Technologies

We are emerging as an end-to-end systems integrator, says Vinod Kumar, MD, KernelSphere Technologies.

Uniware Systems

We constantly validate emerging technologies for first-mover advantage, says Vergis K.R., CEO, Uniware Systems.

Astek Networking & Solutions

An innovative approach helps us stay successful, says Ashish Agarwal, CEO, Astek Networking & Solutions.

CSM Technologies

Our approach is backed by innovation and simplicity, says Priyadarshi Nanu Pany, CEO, CSM Technologies.

EMC PARTNER SHOWCASE

Partnering for Profitability

Atul H. Gosar, Director, Network Techlab, shares how the company’s association with EMC has provided it with a competitive edge and a wide customer base, leading to increased profitability.

Sponsored Content

Promising Pipeline

Venkat Murthy, Prime Mover, 22by7 Solutions, shares how EMC brings in competitive edge by enabling technology, GTM and lead generation, helping 22by7 acquire new customers and retain old ones.

Sponsored Content

Powerful Performance

Deepak Jadhav, Director, VDA Infosolutions, says initiatives by EMC around training and certification have helped the company’s staff improve its performance and enhance customer experience.

Sponsored Content

Performance Booster

Rajiv Kumar, CEO, Proactive Data Systems, says that the solution provider’s association with EMC has helped expand its customer base and added value to existing offerings.

Sponsored Content

Pursuit of Profitability

Santosh Agrawal, CEO, Esconet Technologies, shares insights on how the systems integrator’s association with EMC has spelled sustained success over the years.

Sponsored Content

Non-Performance is Not an Option

Nitin Aggarwal, Director, Trifin Technologies, shares insights on how the association with EMC has helped the system integrator stand out and empowered its personnel to deliver consistent performance.

Sponsored Content

STRATEGIC DIRECTIONS 2014

Driving IT to Make an Impact: IDC

IT is being increasingly viewed as something which would help drive revenue rather than just another cost line-item.

Software-Defined Infrastructure: Forrester

Firms must invest in transforming infrastructure to eradicate complex infrastructure to keep pace with business needs.

Better Safe Than Sorry: PwC

Organizations should create a culture of security that starts with commitment of top executives and cascades to all employees and third parties.

New Skills for a New Era: Gartner

A new talent strategy is required—one that is a key part of the evolving IT strategy and one that focuses on a blend of business and modern IT skills.

The Rise and Growth of Big Data: Ernst & Young

Leading organizations are reaping rich rewards on their investment in big data even as competition struggles to keep pace.

SOCIAL MEDIA @ CW India
SIGNUP FOR OUR NEWSLETTER

Signup for our newsletter and get regular updates.