Mobile Applications & Security Vulnerabilities

Mobile Applications and Security Vulnerabilities

Mobile Applications & Security Vulnerabilities

There are over 2 billion smartphone users in the world today. The enormous rise in the use of smartphones globally has also led to a surge in the usage of mobile applications. There are over 2.2 million Android based applications in Google PlayStore and over 2 million iOS applications in Apple’s AppStore.
Applications, in general, are becoming a dominant form of digital interaction and hence applications are not just limited to smartphones. Applications are developed and used for wearable devices, for devices connected in Internet Of Things, Smart Cities and Smart homes, etc. These devices communicate with each other via applications which makes security in applications all the more important. Security is critical in applications and therefore applications need to be without any security vulnerabilities, but that is not the case. Application do have security vulnerabilities.

Some of the common security vulnerabilities in mobile applications are explained below.

Weak Server-side Components:

Mobile applications communicate to the servers using APIs. The communication requests from APIs need to be properly verified and authenticated before allowing an access to back-end services. Absence of proper security verification and authentication would lead to security vulnerabilities.

Weak server-side security vulnerabilities include Cross-site scripting and forgery, weak authentication system, injection attacks, etc.

Data Leakage and bad storage practices:

Mobile applications collect a lot of data. Some of the data collected by applications is required for them to function, but there is also unnecessary data collected which is a cause of concern. It is critical that the collection of data by apps doesn’t compromise a user’s privacy. An unsecured app could leak the user’s private data. There have been various researches and studies which show how mobile apps have been collecting user’s personal information and then leaking the same data to agencies or third-parties.

Here are some common ways mobile applications expose user data:

Using a misconfigured or insecure ad and/or analytics framework. A framework which is not properly configured or doesn’t proper security measures could be a potential security vulnerability to collect and expose user’s personal and sensitive information.

Unencrypted data transmission from between the app and the back-end server.

Unnecessary logging by the applications becomes a vulnerable point to expose data to unauthorized third-parties.
Android applications have an option of storing the data on external storage which is a point of vulnerability because the applications cannot trust that files have not been modified.

When users sync their data to a cloud platform which is not secure increases vulnerabilities of exposing the data to unauthorized access.

Weak Encryption & Security Protocols:

Mobile applications become prone to external attacks in absence of strong encryption algorithms and security protocols. Attackers use information stored in the cookies and environment variables to bypass the security and access the data on the mobile device. Mobile applications needs to built with latest and strong encryption algorithms which meet the modern security requirements.

Below are some facts as per HPE 2016 Cyber Security Report:

52.1% of applications accessed geolocation data
70% of education applications on iOS accessed geolocation data
11.5% of applications accessed contacts
40.9% of social networking applications accessed contacts
19.8% of finance applications accessed contacts
16.3% of applications accessed calendar data
41.9% of iOS game applications accessed calendar data
52% of iOS weather applications accessed calendar data
61.7% of applications used ad or analytics frameworks to expose data
64.8% of health applications used ad or analytics libraries to expose data
53.2% of medical applications used ad or analytics libraries to expose data
43.8% of finance applications used ad or analytics libraries to expose data
94.8% of applications include logging methods
70.6% of applications can access external storage

(Link to the detailed report: https://saas.hpe.com/sites/default/files/resources/files/Mobile%20Report%20ver%2010.2.pdf)

-Captain Krypto 🙂

Kryptotel is an IT Security Services and Product Development Company specializing in Cyber Security and Secure Communications. Kryptotel develops secure communication applications with strong encryption and security features. Feel free to consult Kryptotel for your cyber-security challenges. www.kryptotel.net.

Wearable Technology & Security Concerns

The use of wearable technology has been on a rise in last few years, and so are the security concerns that come along.

What is Wearable Technology?

The terms ‘wearable technology‘, ‘wearable devices‘, ‘wearable gadgets‘, or simply ‘wearables‘ are referred to the class of electronic technology devices that can be worn on the body. Wearables are created by integrating technology or computers into clothing and accessories which can be easily worn around the body.

[blockquote author=”” link=”” target=”_blank”]Wearable technology is most often advocated as one of the greatest application of Internet Of Things considering the fact that wearables have the potential to completely transform the way we live, today and in future.[/blockquote]

Although these wearable gadgets can perform same computing tasks as mobile devices and laptop computers, but wearables are primarily designed to track health and fitness related information. The sophisticated modern wearable tracking devices are made up of smart sensors and scanning features which help track physiological functions of the body. Therefore, helping consumers achieve their health and fitness goals.

Examples of Wearable Gadgets?

Below are some of the wearable gadgets available in the market that are most commonly used.

Fitness Trackers: Fitness Trackers help in monitoring exercises and physical activities by tracking biofeedback from the body. They are based on sensors and are worn around the wrist, connected wirelessly to the smartphone via bluetooth displaying health and fitness related information on the smartphone application.
Smart-watches: The modern smart-watches are not designed just to display the time, but is door to your digital world. Smart-watches are worn around the wrist and connected to your smartphone, and generally displays notifications from phone calls, messages, emails and social media.

Some other types of wearables are sports watches, smart jewellery, implantables, etc.

What are the security concerns of Wearable Technology?

No doubt that the use of wearable technology is on a rise, and there has been an increase in the popularity of wearable devices. But along with the popularity growth of wearables there has been in an increase in the concern over security with such devices.

While wearables such as fitness trackers, smart-watches, sports watches, smart clothing provide great benefits to the consumers, at the same time consumers need to be cautious about the possible security concerns of wearable devices. Most of these wearable gadgets are Bluetooth enabled and connect to the Internet, they are vulnerable in absence of proper security measures like encryption and authentication.

Wearable devices such as fitness trackers monitor and track activities and health related information of consumers all around the clock, therefore huge amount of private and sensitive data is collected and stored by these devices.

[blockquote author=”” link=”” target=”_blank”]This makes wearables an attractive target for hackers to get unauthorized access to this private information and monetize it.[/blockquote]

In absence of strong security measures, hackers could manage to get access to these health records and make money by selling these records.

Some of the known security vulnerabilities in wearables are: SQL Injection, Phishing, Buffer Overflow Attacks, etc.
Consumers also need to be cautious about allowing manufacturers of such wearable devices permission to share their information with third-parties. Reputed and well-known brands usually implement appropriate security and privacy measures. Consumers should avoid low-cost and poorly designed wearable devices that may possibly create security threats.

-Captain Krypto 🙂

Kryptotel is an IT Security Services and Product Development Company specializing in Cyber Security and Secure Communications. Kryptotel develops secure communication applications with strong encryption and security features. Feel free to consult Kryptotel for your cyber-security challenges. www.kryptotel.net.

Blockchain Technology and Cyber Security

Blockchain technology was first introduced in digital currencies or crypto-currencies (Bitcoins) in the year 2009.

What is Blockchain?

Blockchain technology was first introduced in digital currencies or crypto-currencies (Bitcoins) in the year 2009.

Crypto-currencies, like bitcoin, are currencies that exist only in the digital world. These are not physical tangible currencies that move from one hand to another. People make transactions in the digital world and transactions are verified and based on a consensus mechanism in the massive peer-to-peer network.

The crypto-currency bitcoin is based on blockchain technology. The transactions in bitcoin happen by changing the ownership creating a record in the blockchain. The blockchain in the crypto-currency system are managed by distributed nodes, all holding a digital ledger of the entire blockchain. Blockchain is a decentralized distributed database system secured using cryptographic technology. Since the blocks are distributed across the world and there is no centralization of the data and the fact that blockchain system uses cryptography to keep transactions secure, makes blockchain system one of the most talked about and revolutionary concepts in the current age.

[blockquote author=”” link=”” target=”_blank”]Blockchain technology is the backbone technology behind Bitcoin![/blockquote]

Blockchain technology goes far beyond the crypto-currencies, it is going to revolutionize the digital interactions in coming years. Blockchain technology will revolutionize the cyber security and has the potential to disrupt many industries.

Blockchain definition: A blockchain is a type of distributed ledger, comprised of unchangable, digitally recorded data in packages called blocks. These blocks are stored in a linear chain and each block in the chain contains data which is cryptographically hashed. The blocks of hashed data draw upon the block just before in the chain, ensuring all data in the overall blockchain is not tampered with and remains unchangeable.

Cyber Security and Blockchain Technology

Cyber Security has been a growing concern for individuals, business organizations and governments in recent times. As state-sponsored surveillances, hacking, security bugs, online frauds and malicious codes have become increasingly common these days, the demand for a more robust and a reliable security system has become critically important.

With Internet of Things, Smart Houses and Smart Cities concepts coming to reality today and our increased dependency on computer-driven systems, a strong and robust cyber security has become a need of the hour. According to a study by Gartner the number of things connected to Internet was 4.9 billion in 2015, and forecast the number would reach 25 billion by the year 2020. Each of these things connected to the internet is a vulnerability and provides a potential threat to the whole system. Therefore it becomes critical strengthen and make cyber security more efficient.

Online breaches and security attacks into traditional banking systems have resulted into a lot of people losing their hard-earned money. In the past number of e-commerce systems have also been affected due to cyber attacks. Personal information and private communication of a lot users has been accessed unauthorizedly either by illegal hackers or due to government surveillances. All these online breaches, hacks or cyber attacks were possible because of weak and inefficient cyber security system in place. Also, because of the fact that the system or platform was centralized in nature and hence easier for the hacker to take control over.

[blockquote author=”” link=”” target=”_blank”]This is where Blockchain comes in and provides a viable alternative. Blockchain technology alleviates a lot of cyber security concerns because of its decentralized and distributed system.[/blockquote]

A way forward to secure these computer-driven systems is decentralization and distribution of data. Since blockchain based systems are distributed in nature, they could effectively play a greater role in creating robust cyber security systems. In a typical blockchain system, data is kept on various systems and servers across the world, thus removing a central point of control. Blockchains could also be used in secure communication systems by distributing workloads and creating consensus mechanism in the control systems. Acquiring consensus of all of the network is impossible for a hacker to achieve, hence saving the system from being taken over by unauthorized parties.

Cyber Security of the future is going to be revolutionized by Blockchain technology. Decentralization, distribution of data systems, and consensus mechanism in blockchain make it a very popular weapon for cyber security specialists.

Blockchain technology is still in its nascent stage but it surely is a technology with a potential to watch out for in the future!

– Captain Krypto 🙂

Feel free to get in touch with Kryptotel for any further information about encrypted smartphones. You might as well be interested in KryptoPhone – the customized encrypted smartphone by Kryptotel. To know more about KryptoPhone, please visit us at: www.kryptotel.net.

What are different VPN Protocols?

VPN solutions are based on different VPN security protocols. Each of these VPN protocols offer different features and levels of security. Some of the VPN protocols commonly used are explained below:

Internet Protocol Security or IPSec:

Internet Protocol Security or IPSec is used to secure Internet communication across an IP network. IPSec secures Internet Protocol communication by authenticating the session and encrypts each data packet during the connection.
IPSec operates in two modes, Transport mode and Tunneling mode, to protect data transfer between two different networks. The transport mode encrypts the message in the data packet and the tunneling mode encrypts the entire data packet. IPSec can also be used with other security protocols to enhance the security system.

Layer 2 Tunneling Protocol (L2TP):

L2TP or Layer 2 Tunneling Protocol is a tunneling protocol that is usually combined with another VPN security protocol like IPSec to create a highly secure VPN connection. L2TP creates a tunnel between two L2TP connection points and IPSec protocol encrypts the data and handles secure communication between the tunnel.

Point – to – Point Tunneling Protocol (PPTP):

PPTP or Point-to-Point Tunneling Protocol creates a tunnel and encapsulates the data packet. It uses a Point-to-Point Protocol (PPP) to encrypt the data between the connection. PPTP is one of the most widely used VPN protocol and has been in use since the time of Windows 95. Apart from Windows, PPTP is also supported on Mac and Linux.

Secure Sockets Layer (SSL) and Transport Layer Security (TLS):

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) create a VPN connection where the web browser acts as the client and user access is restricted to specific applications instead of entire network. SSL and TLS protocol is most commonly used by online shopping websites and service providers. Web browsers switch to SSL with ease and with almost no action required from the user, since web browsers come integrated with SSL and TLS. SSL connections have https in the beginning of the URL instead of http.

OpenVPN:

OpenVPN is an open source VPN that is useful for creating Point-to-Point and Site-to-Site connections. It uses a custom security protocol based on SSL and TLS protocol.

Secure Shell (SSH):

Secure Shell or SSH creates the VPN tunnel through which the data transfer happens and also ensures that the tunnel is encrypted. SSH connections are created by a SSH client and data is transferred from a local port on to the remote server through the encrypted tunnel.

How Secure is WhatsApp’s Encryption?

WhatsApp, one of the most popular messaging app service, in April this year, announced that the service would now use end-to-end encryption to secure user communication. The service would benefit 1 billion+ users of the messaging across all devices.

End-to-end encryption (E2EE) is a secure way of communication where only the actual users involved in the communication can access the messages in the chat. Eavesdroppers, cyber-criminals and hackers, telecom companies, Internet Service Providers or government agencies cannot read the messages. Even the company that has built the application will not read the messages.

WhatsApp on its website says, “WhatsApp’s end-to-end encryption is available when you and the people you message use the latest versions of our app. Many messaging apps only encrypt messages between you and them, but WhatsApp’s end-to-end encryption ensures only you and the person you’re communicating with can read what is sent, and nobody in between, not even WhatsApp. This is because your messages are secured with a lock, and only the recipient and you have the special key needed to unlock and read them. For added protection, every message you send has its own unique lock and key. All of this happens automatically: no need to turn on settings or set up special secret chats to secure your messages.”

This means WhatsApp will now have end-to-end encryption by default. WhatsApp’s end-to-end encryption (E2EE) will ensure that all communication between two users will secure and cannot be read by anyone else. Text messages, Audio/Voice notes, videos, pictures, everything will now be encrypted and cannot be read by anyone except the sender and the receiver. Not even the WhatsApp.

[blockquote author=”” link=”” target=”_blank”]Although it is a welcome that step that WhatsApp is finally an encrypted messaging service, but the question that now arises is “how secure is WhatsApp’s end-to-end encryption?”. We will break down encryption in WhatsApp and how secure it actually is.[/blockquote]

WhatsApp had partnered with Open Whisper Systems to design its new end-to-end encryption feature which is based on Signal Protocol.

According to the whitepaper issued by WhatsApp, once the session has been established, clients need not rebuild new sessions with each other until the session is ended by the users.

The whitepaper further explains how encryption takes place in WhatsApp. It reads, “clients exchange messages that are protected with a Message Key using AES256 in CBC mode for encryption and HMAC-SHA256 for authentication. The Message Key changes for each message transmitted, and is ephemeral, such that the Message Key used to encrypt a message cannot be reconstructed from the session.”

[blockquote author=”” link=”” target=”_blank”]All this sounds good so far. Whether the security and privacy that WhatsApp talks about is enough for the user or not, is for the user to decide. Not for us. But here are our two cents on WhatsApp encryption.[/blockquote]

WhatsApp might still collect your metadata.

While the end-to-end encryption might ensure that the contents of the message are not accessed by unauthorized users or even by the WhatsApp, but WhatsApp itself might store metadata. This means the phone numbers involved in the conversation as well as the timestamp on the messages are stored on the servers of the company. Collecting metadata could give out information like who the user communicated with, the time of the communication, how often the two users communicate with each other, the location of the two users at the time of communication, etc.

WhatsApp is owned by Facebook

WhatsApp was acquired by Facebook in the year 2014. Facebook is considered one of the least privacy minded company in the market. There also have been some reports doing rounds on the Internet that Facebook supplies government with reports and information. So if that’s the case then it makes little sense that a messaging app owned by a least privacy minded company would not share information of the users to the government agencies.

Messaging Apps with higher grade of encryption available in the market.

Now that the popular messaging app WhatsApp has decided to go with end-to-end encryption, it is not the best encrypted messaging app available in the market. There are many other messaging apps in the market today which offer higher grade of encryption. Some apps even provide military grade of encryption and multiple levels of security.
So if a user is concerned about privacy and security then WhatsApp might not be the best option for that user. The market is wide open when it comes to encrypted messaging apps.

Providing encryption to a billion users free of cost?

WhatsApp has a billion users and providing end-to-end encryption to a billion users is a stupendous task and the efforts must be appreciated. But the question that arises in people’s minds is why is WhatsApp offering encryption at no cost at all? Why is it free of charge? Where does WhatsApp make money from?!

Please feel free to add in your thoughts in the comments section below. We would appreciate your valuable contribution.

– Captain Krypto 🙂

For users interested in messaging apps with higher grade of encryption, please visit: Military Grade Encryption VoIP Apps

Feel free to get in touch with Kryptotel for any further information about encrypted smartphones. You might as well be interested in KryptoPhone – the customized encrypted smartphone by Kryptotel. To know more about KryptoPhone, please visit us at: www.kryptotel.net.

How to encrypt calls and chat?

In the digital era that we live in today, securing privacy of your data and communication on any medium is next to impossible and a never ending struggle.

In the digital era that we live in today, securing privacy of your data and communication on any medium is next to impossible and a never ending struggle. Your communication could easily be accessed by your telephone operator, Internet Service Provider, and even some agencies.

With the omnipresent methods of modern surveillance on almost all modes of communication, there are still ways to protect your communication and data from prying eyes. In this blog, we discuss about how we can protect our calls and chats from being snooped upon.

[blockquote author=”” link=”” target=”_blank”]Having your calls encrypted is a fool-proof way of securing your communication. There are a number of encrypted VoIP apps available in the market today who offer secure communication by making use of various encryption protocols.[/blockquote]

Kryptotel Secure VoIP is one of the superior VoIP apps in the market who’s core feature is encryption of the communication. Using Kryptotel Secure VoIP, a user can make encrypted audio and video calls, and encrypted instant messaging as well.

For government officials and business professionals who are concerned about their call conversations being private and secure, especially when telephone companies keep record of telephone call data in their archives for years.

Call tapping for private investigation purposes and for commercial competition/illegal industrial espionage leads to 5% of the world’s population being listened to during their private conversations.

Kryptotel secure VoIP app has been designed keeping in mind the government and business professionals who want to secure their communication to safeguard their organization’s communication and activities. Spying on competitor companies to industry secrets common for contract hackers.

Kryptotel Secure VoIP app doesn’t transit through the operators public telephone switches but uses Internet connection encrypting the content safely without leaving any trace or the possibility of recording any of the data (the caller or the called). Even with the “Black Out calls” the caller ID is changed for every call. Kryptotel app is one of the best solution a person concerned about his/her privacy can find today.

[blockquote author=”” link=”” target=”_blank”]The Kryptotel app uses military grade encryption and other secure features to secure a user’s communication through the app. Kryptotel app uses Asymmetric, Symmetric and SHA-512 algorithms in order to maximize the level of security.[/blockquote]

Asymmetric Encryption based on RSA certificates and private key of 8192 bits, which is a military grade requirement in encryption.

Symmetric encryption based on AES 256 bits is used by Kryptotel app. This app also uses SHA-512 algorithm for digital signature.

This is a stronger level of encryption used in the app. In the commercial world, usually an encryption level of RSA 20148 bit and AES 128-bit is used. For securing online banking, RSA 2048 and AES 128 bit is usually used.

All the communication, between two devices with Kryptotel app, is encrypted. Be it instant messages, audio or video calls, audio conferencing – all of it is encrypted and secured with a military grade encryption.

Using a Kryptotel app, you can share images, audio and video clips, and also PDF, XLS, Doc file types.
Upon installing Kryptotel secure VoIP app on your device, you are provided with a unique number (just like a phone number). When you want to make an encrypted call to other person with Kryptotel app, you need to dial his/her Kryptotel number.

In case the other person is not available to pick the call, it will be redirected to his/her voice mail. The voice mail will be stored in an encrypted container and only the actual recipient will be able to listen to it. The voice mail can be listened only through a Kryptotel app which uses account authentication method and decrypts the recorded message. To access your voice mail you need to dial toll free number 444 and keep digit 1 pressed for few seconds, the easy to use IVS will guide you to read, store and cancel your voice mail.

Download Kryptotel Secure VoIP app:

You can either download Kryptotel app from your phone’s app store or from its website: https://securevoip.kryptotel.net/download/
More details about securing communication with Kryptotel app are available at: securevoip.kryptotel.net.

Internet of Things – Security Challenges

Internet of Things or IOT is a network of physical objects or things connected to the Internet. The objective of Internet of Things is to enable these objects or things to communicate and exchange data with each other.

These objects could be anything like mobile phones, TV, watches, car, headphones, lights, house-holding items like refrigerator, washing machine, microwave oven, etc. These objects and entities, known as things are provided unique identifiers and the ability to transfer data automatically over a network.

The communication in Internet of Things (IOT) comes from computing devices and embedded sensor systems used in industrial machine-to-machine communication, smart energy grids, smart homes and building automation, vehicle to vehicle communication and wearable computing devices.

However, since the idea of communication between physical objects and the internet is relatively new, the security could at times become vulnerable. Increased automation and digitization creates new security challenges. Security of multiple points in the network is challenging and the risks are huge.

[blockquote author=”” link=”” target=”_blank”]Cyber Security is of utmost importance in Internet of Things, and security is not given the highest priority, the whole business model based on IOT will be undermined.[/blockquote]

Some of the security challenges identified in Internet of Things are:

Increase in vulnerability points:
As there are millions and billions devices connected in the Internet of Things. Each of these devices create a potential security risk as they represent a potential doorway to your IT infrastructure and data.
A study by Fortify, a part of HP, showed that 70 percent of the devices connected in the IOT are vulnerable to the security issues.
Privacy Concerns:
Most of the devices connected in the Internet of Things in one way or the other collected at least some personal information of the user from the device or from the application. Some of the devices even transmit this information via the network without any encryption. This makes the data vulnerable to theft and misuse if accessed by an unauthorized person.
Authentication and Authorization:
Weak and easy to break passwords add to the vulnerability. A lot of users configure their devices and accounts with weak passwords. Some of the users don’t even change the default passwords given by vendors for the devices.
Not all devices connected are encrypted:
In Internet of Things the devices connected communicate with each other by transferring data from one device to another device via the network. Most of these devices fail to encrypt the data and hence an addition to the security issues. Encryption in IOT should be of the highest priority seeing the amount of data and information that transferred between the devices, the cloud and the mobile applications.

It is crucial to take care of the above security challenges and make Internet of Things more secure and trustworthy for users. Security of Internet of Things is a multi-layered approach, and security needs to be taken care of at two levels – the device level and the network level.
This will be ensured by increasing the security level around the following.

Secure Booting:
Secure booting will ensure that the device only allows an authorized access and keeps the hackers away. This could be done by using a digital signature, or a cryptographically signed code.
Secure Code Updates:
Secure code on the device should be updated for any bug fixes or security patches ensuring that any malicious code does not enter into the system.
Access Control:
Access Control methods should be installed into the device to allow it to only access the necessary resources required to perform any action.
Device Authentication and Data Security:
It is important to prevent unauthorized access to the device, data storage or communication. Data Storage and communication needs to encrypted. All communications with the device should be authenticated, the device needs to be authenticated prior the device communicating over the network.
Secure Communication:
Incoming and outgoing communication from the device needs to secured and encrypted. Strong encryption protocols should be used to encrypt the communication.
Prevent Cyber Attacks:
It is important to prevent any sort of cyber attacks. This can be achieved by embedding firewalls which would provide a layers against such attacks by inspecting the traffic at the device and stop the malicious attempts and block the hackers before launching an attack.

Taking care of the above points will ensure that security and privacy in Internet of Things is fully protected and not compromised.

– Captain Krypto 🙂

References:

http://www.cmswire.com/cms/internet-of-things/top-5-internet-of-things-security-concerns-026043.php
http://www.vyzvoice.com/the-internet-of-things-security-challenges/#_ftn1
http://internetofthingsagenda.techtarget.com/definition/IoT-security-Internet-of-Things-security
https://securityintelligence.com/how-the-internet-of-things-iot-is-changing-the-cybersecurity-landscape/

Feel free to get in touch with Kryptotel for any further information about encrypted smartphones. You might as well be interested in KryptoPhone – the customized encrypted smartphone by Kryptotel. To know more about KryptoPhone, please visit us at: www.kryptotel.net.