Investigating the security of android security applications

Encryption is commonly used to provide confidentiality of sensitive or personal information when held on smartphones. While many Android devices feature inbuilt full-disk encryption as a precaution against theft of a device, this is not available on all devices, and doesn't provide security against a device which is turned on and in use. For this reason, a wide variety of applications are available within the Google Play Store, offering to encrypt user data. Modern, strong encryption offers strong assurances of confidentiality when used correctly, although the fundamental cryptographic primitives are complex, with many opportunities for mistakes to be made. The security of a number of implementations of Android-based encryption applications is investigated. Highly popular applications, including those by Google-endorsed "Top Developers", are considered. A number of major weaknesses in the implementation of encryption within these applications is presented. This highlights the importance of both well-audited open-source cryptographic implementations, as well as the underlying cryptographic algorithms themselves, given the vulnerabilities identified in these applications. In many cases, there was no encryption in use by the application, and file headers were undergoing trivial static obfuscation, such that files would appear corrupted. In other cases, encryption algorithms were used, but with significant implementational errors. In these cases, plaintext recovery was still possible, due to the use of static keys for every installation of the app, and the re-use of cipher initialisation vectors

Take control of your PC with UEFI secure boot

UEFI secure boot is often regarded as a nuisance for Linux users, but you can use it to protect your system by taking control of it. Learn how to do this, sign your own bootloader, and protect your whole system with full disk encryption (including the kernel)

Practical attacks on security and privacy through a low-cost Android device

As adoption of smartphones and tablets increases, and budget device offerings become increasingly affordable, the vision of bringing universal connectivity to the developing world is becoming more and more viable. Nonetheless, it is important to consider the diverse use-cases for smartphones and tablets today, particularly where a user may only have access to a single connected device. In many regions, banking and other important services can be accessed from mobile connected devices, expanding the reach of these services. This paper highlights the practical risks of one such lowcost computing device, highlighting the ease with which a very recent (manufacturered September 2015) Android-based internet tablet, designed for the developing world, can be completely compromised by an attacker. The weaknesses identified allow an attacker to gain full root access and persistent malicious code execution capabilities. We consider the implications of these attacks, and the ease with which these attacks may be carried out, and highlight the difficulty in effectively mitigating these weaknesses as a user, even on a recently manufactured device

Google's Android setup process security

Despite considerable research having been carried out into the security of the open-source Android operating system, the vast majority of Android devices run software significantly deviating from the open source core. While many of these changes are introduced by the original equipment manufacturer (OEM), almost every Android device available for sale also features a suite of Google-provided applications and services, which are not part of the Android Open Source Project (AOSP) code. These applications are installed with system-level privileges, and are effectively an extension of the operating system itself. We monitored the process of setting up an Android device, and have identified a number of design weaknesses in the implementation of a number of Google services features which come pre-installed on virtually every Android device on sale today, which could permit skilled and capable attackers to carry out persistent attacks against Android users

Automating identification of potentially problematic privacy policies

Almost every website, mobile application or cloud service requires users to agree to a privacy policy, or similar terms of service, detailing how the developer or service provider will handle user data, and the purposes for which it will be used. Many past works have criticised these documents on account of their length, excessively complex wording, or the simple fact that users typically do not read or understand them, and that potentially invasive or wide-reaching terms are included in these policies. In this paper, we present our automated approach and tool to gather and analyse these policies, and highlight some interesting considerations for these documents, specifically those surrounding past legal rulings over the enforceability of some specific and widely-used contract terms --- the ability for terms to be changed without directly notifying users (and presumed continued use indicates acceptance), and the protections in place in the event of a sale or acquisition of a company. We highlight the concerns these pose to user privacy and choice, and the extent to which these terms are found in policies and documents from many popular websites. We use our tool to highlight the extent to which these terms are found, and the extent of this potential problem, and explore potential solutions to the challenge of regulating user privacy via such contracts in an era where mobile devices contain significant quantities of highly sensitive personal data, which is highly desirable to service operators, as a core valuation asset of their company

IEDs on the Road to Fingerprint Authentication : Biometrics have vulnerabilities that PINs and passwords don't

Almost every 2016 flagship mobile phone, whether Android or iOS-based, is set to come with an integrated fingerprint reader. The convenience benefits of fingerprint readers are clear to users, but is the underlying technology really ready for widespread adoption? This article explores some of the background of the challenge of secure user authentication on mobile devices, as well as recent weaknesses identified in the handling of fingerprints on many consumer devices. It also considers legislatory and social implications of the widespread adoption of fingerprint authentication. Finally, it attempts to look forward to some resulting problems we may encounter in the future

Automating identification of potentially problematic privacy policies

Almost every website, mobile application or cloud service requires users to agree to a privacy policy, or similar terms of service, detailing how the developer or service provider will handle user data, and the purposes for which it will be used. Many past works have criticised these documents on account of their length, excessively complex wording, or the simple fact that users typically do not read or understand them, and that potentially invasive or wide-reaching terms are included in these policies. In this paper, an automated approach and tool to gather and analyse these policies is presented, and some important considerations for these documents are highlighted, specifically those surrounding past legal rulings over the enforceability of some specific and widely-used contract terms - the ability for terms to be changed without directly notifying users (and presumed continued use indicates acceptance), and the protections in place in the event of a sale or acquisition of a company. The concerns these pose to user privacy and choice are highlighted, as well as the extent to which these terms are found in policies and documents from many popular websites. This tool was used to highlight how commonly these terms are found, and the extent of this potential problem, and explore potential solutions to the challenge of regulating user privacy via such contracts in an era where mobile devices contain significant quantities of highly sensitive personal data, which is highly desirable to service operators, as a core valuation asset of their company

Reframing Resolution - Managing Conflict and Resolving Individual Employment Disputes in the Contemporary Workplace

The resolution of individual workplace conflict has assumed an increasingly important place in policy debates over contemporary work and employment. This is in part due to the decline in collective industrial action and the parallel rise in the volume of employment tribunal applications. It reflects a growing concern over the implications of individual employment disputes for those involved but has perhaps been driven by concerns over the cost of litigation and the perceived burden that this places on employers. Against this backdrop, an ESRC-funded seminar series, entitled ‘Reframing Resolution – Managing Conflict and Resolving Individual Employment Disputes in the Contemporary Workplace’, was held between October 2012 and September 2013. This comprised six seminars held at: University of Strathclyde; University of Central Lancashire; Swansea University; Queen’s University Belfast; IRRU, University of Warwick and University of Westminster. The series brought leading academic researchers, practitioners and policy-makers together to explore new empirical and conceptual developments, examine innovative practice and provide insights into key questions of public policy