JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD

Course Objectives

This course provides a thorough understanding of mobile platforms, including

attack surfaces, risk landscape & more.

Course Outcomes:

• 1. Understand common mobile application security vulnerabilities
• 2. Define the security controls of multiple mobile operating systems
• 3. Understand and analyze Bluetooth technology
• 4. understand and analyze overview of SMS security and Enterprise security

UNIT - I

Top Mobile Issues and Development Strategies: Top Issues Facing Mobile Devices, Physical Security, Secure Data Storage (on Disk), Strong Authentication with Poor Keyboards , Multiple-User Support with Security, Safe Browsing Environment , Secure Operating Systems, Application Isolation, Information Disclosure, Virus, Worms, Trojans, Spyware, and Malware , Difficult Patching/Update Process, Strict Use and Enforcement of SSL, Phishing , Cross-Site Request Forgery (CSRF), Location Privacy/Security, Insecure Device Drivers, Multi Factor Authentication, Tips for Secure Mobile Application Development .

UNIT - II

WAP and Mobile HTML Security WAP and Mobile HTML Basics, Authentication on WAP/Mobile HTML Sites, Encryption, Application Attacks on Mobile HTML Sites, Cross-Site Scripting, SQL Injection, Cross-Site Request Forgery, HTTP Redirects, Phishing, Session Fixation, Non-SSL Login, WAP and Mobile Browser Weaknesses, Lack of HTTPOnly Flag Support, Lack of SECURE Flag Support, Handling Browser Cache, WAP Limitations.

UNIT - III

Bluetooth Security Overview of the Technology , History and Standards , Common Uses , Alternatives , Future, Bluetooth Technical Architecture , Radio Operation and Frequency, Bluetooth Network Topology , Device Identification , Modes of Operation , Bluetooth Stack ,Bluetooth Profiles, Bluetooth Security Features , Pairing , Traditional Security Services in Bluetooth, Security “Non-Features” , Threats to Bluetooth Devices and Networks, Bluetooth Vulnerabilities, Bluetooth Versions Prior to v1.2, Bluetooth Versions Prior to v2.1. Security for 1g Wi-Fi Applications, Security for 2g Wi-Fi Applications, Recent Security Schemes for Wi-Fi Applications

UNIT - IV

SMS Security Overview of Short Message Service, Overview of Multimedia Messaging Service, Wireless Application Protocol (WAP), Protocol Attacks, Abusing Legitimate Functionality, Attacking Protocol Implementations, Application Attacks, iPhone Safari, Windows Mobile MMS, Motorola RAZR JPG Overflow, Walkthroughs, Sending PDUs, Converting XML to WBXML.

UNIT - V

Enterprise Security on the Mobile OS Device Security Options, PIN, Remote, Secure Local Storage, Apple iPhone and Keychain, Security Policy Enforcement, Encryption, Full Disk Encryption, E-mail Encryption, File Encryption, Application Sandboxing, Signing, and Permissions, Application Sandboxing, Application Signing, Permissions, Buffer Overflow Protection, Windows Mobile, iPhone, Android, BlackBerry, Security Feature Summary.

TEXT BOOK:

• 1. Mobile Application Security, Himanshu Dwivedi, Chris Clark, David Thiel, TATA McGraw-Hill.

REFERENCES:

• 1. Mobile and Wireless Network Security and Privacy, Kami S. Makki,et al, Springer.
• 2. Android Security Attacks Defenses, Abhishek Dubey, CRC Press.