Feeds

OMTP publishes standard, but what is it really securing?

At least the Home Secretary is pleased

Boost IT visibility and business value

The Open Mobile Terminal Platform group has finally published the security documents it outlined last year, and got the UK home secretary to say what a good thing that is.

The OMTP is just an operator talking shop really, no-one is under any obligation to implement the standards they propose, but the operators will look favorably on handsets that conform to the freely-available standards the OMTP publishes.

The security proposals are much as outlined back in October, but with more detail and a focus on ensuring the integrity of the operating system rather than securing applications, which will be left to the platform.

The basic concept is to have the OS image verified before loading, then providing the capability to confirm that integrity while running, so hacks can't be applied even after the OS is up and running. Obviously that's going to require a secure store in the hardware, with the ability to verify digital signatures and override the OS if necessary.

What this means is that the OS can't be interfered with in any way, so it will be impossible to write an application that intercepts keys being pressed (to collect passwords, for example) or one that grabs the screen display to collect confidential information.

All very laudable, and endorsed by Jacqui Smith: "I am pleased that the mobile industry continues to show its commitment to enhance the security of mobile phones," she said.

The problem is that one man's hack is another's utility. Being able to grab screens, from any application, is a very useful tool, particularly for journalists, and intercepting key presses can be used for everything from instant access to applications to redirecting callers to websites. It will be up to manufacturers to decide which parts of their OS are sacrosanct and which are open to developers, but they'll have to be very careful not to cast the net too wide.

These days operators and even manufacturers are increasingly involved in content distribution, and it's clear that this "Advanced Trusted Environment: OMTP TR1" will also prevent applications that intercept content that's been decoded for playback - making effective DRM much more feasible.

It will be interesting to see if mobile phones remain the relatively safe platforms they are, or descend into the constant war that personal computers are required to wage against the tide of malware and infection. The Advanced Trusted Environment is a vote for the former, but users might accept the latter as the price of flexibility in their phones. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Déjà vu: Virgin Media jacks up broadband prices
Screw copper phone lines, we're UNIQUE, bleats telco
UK fuzz want PINCODES on ALL mobile phones
Met Police calls for mandatory passwords on all new mobes
Netflix swallows yet another bitter pill, inks peering deal with TWC
Net neutrality crusader once again pays up for priority access
Fifteen zero days found in hacker router comp romp
Four routers rooted in SOHOpelessly Broken challenge
New Sprint CEO says he will lower axe on staff – but prices come first
'Very disruptive' new rates to be revealed next week
US TV stations bowl sueball directly at FCC's spectrum mega-sale
Broadcasters upset about coverage and cost as they shift up and down the dials
UK mobile coverage is BETTER than EVER, networks tell Ofcom
Regulator swallows this line and parrots it back out at us. What are they playing at?
What's the nature of your emergency, Vodafone?
Oh, you've dialled the wrong number for ad fibs, rules ASA
EE network whacked by 'PDP authentication failure' blunder
Carrier is 'aware' of cockup, working on a fix NOW
ROAD TRIP! An FCC road trip – Leahy demands net neutrality debate across US
You crashed watchdog's site, now time to crash its ears
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.