Mobile Device Security Tips

When using a mobile device, keep in mind these guidelines:

1. Always set a password on the device so that if lost, it will at least take a bit of effort to get to the data.

2. Encrypt information stored on the device.

3. Consider encrypted communications when using wireless network technology.

4. Do not store data only on the mobile device; if using the mobile device for data collection, upload it as soon as practical.

Fun (or Trouble) with PocketPC ActiveSync

ActiveSync is the protocol used to synchronize the contents of a PocketPC based PDA with a desktop PC. Pocket PC synchronization can take place via direct serial connections or via network connections. It turns out that both types of connections are vulnerable to security issues that can compromise data on PocketPC devices or cause DoS situations.

ActiveSync serial connection authentication is controlled by a simple 4-digit PIN. If a hostile PC furnishes the correct PIN to the PDA, it can sync that PDA, possibly installing Trojan horses or viruses, and uploading data stored on the PDA. (Brute forcing a 4-digit PIN doesn’t take much time. Note that banks are aware of that, and an ATM would probably eat your ATM card after 5 or 10 incorrect tries to prevent compromise due to PIN-guessing.)

ActiveSync over TCP/IP uses port 5679. Anyone with access to port 5679 on a PC running ActiveSync (this includes internal users as well as Internet users) can stage a DoS attack on that ActiveSync server in several different ways.

We don’t intend here to single out Microsoft – it’s just that this is a handy illustration of the issues inherent in mobile devices, which people are only now beginning to think about. Mobile devices such as PocketPC’s (and the Windows CE OS on which they are based) have only recently begun to be widely deployed in real world scenarios. As a result, the real world security implications of such devices are still being discovered.