Lightweight Java security app aims to pep up m-commerce
Good things come in small applets
Customer Success Testimonial: Recovery is Everything
UK mobile application developer Masabi has launched a lightweight Java security package for mobile phones in a bid to make m-commerce applications more user-friendly and secure.
Masabi's EncryptME Java mobile security component is the only such application to use officially validated implementations of RSA and AES encryption, according to BT, which tested the technology. The application provides RSA with PKCS Padding for keys up to 4,096 bits, AES with keys up to 256 bits, and an approved secure random number generator. Ed Howson, co-Founder of Masabi, told El Reg the technology provided web commerce-level security on the vast majority of existing handsets.
The technology, which has been validated by BT, occupies a footprint of only 3K, meaning it can run on any mobile phone that can run Java. Its small footprint leaves room for developers to squeeze in rich graphics and a friendly interface to new or existing mobile payment or messaging applications.
Using a single SMS message, or a few bytes of GPRS data, EncryptME can set up a secure session and sign up a new user, a new credit card, and make a transaction. The software is available in multiple currencies and languages and targeted towards applications including mobile banking and transport.
Masabi plans to run a pilot of the technology later this summer with train ticketing technology specialist YourRail, enabling transport tickets to be securely bought using mobile phone handsets. YourRail already provides a mobile ticketing system for Chiltern Railways that allows ticket purchases to be made on a PC.
By extending their system with EncryptME, new customers can sign up and purchase a ticket straight away from their mobile without the need for pre-registration or use of a PC. ®
COMMENTS
re: will it help fix this
Hi Alan,
I think you were referring to http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102934-1
This is a specific issue for certain SUN JRE's for PC's, and does not affect J2ME.
You are right that any mono-culture is vulnerable to one exploit sweeping through it, but MIDP/J2ME virtual machines on mobile phones are not a mono-culture as they are made by different vendors, running on different OS's and Processors (contrary to popular belief all JRE's are not made by SUN).
Windows is a far worse situation, found in very similar guises on only two major CPU families with similar op codes (the binary codes required to make things happen on the processor when a virus has overflowed data into instruction space).
I have posted more detail about mobile security, with an invitation for people to ask more questions on blog.masabi.com if you have other concerns.
Ben (Masabi)
p.s. I think C-Commerce was a typo, we've never heard of it either, and wondered if it was a US translation to "Cellular-Commerce" or something....
Will it help fix this
Java runtime vulnerability see details at http://isc.sans.org I predict
a lot more of this sort of thing for JAVA as vulnerabilities go anything
that can infect every platform on any OS is kind of a biggie.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
