Feeds

OMTP publishes standard, but what is it really securing?

At least the Home Secretary is pleased

Top three mobile application threats

The Open Mobile Terminal Platform group has finally published the security documents it outlined last year, and got the UK home secretary to say what a good thing that is.

The OMTP is just an operator talking shop really, no-one is under any obligation to implement the standards they propose, but the operators will look favorably on handsets that conform to the freely-available standards the OMTP publishes.

The security proposals are much as outlined back in October, but with more detail and a focus on ensuring the integrity of the operating system rather than securing applications, which will be left to the platform.

The basic concept is to have the OS image verified before loading, then providing the capability to confirm that integrity while running, so hacks can't be applied even after the OS is up and running. Obviously that's going to require a secure store in the hardware, with the ability to verify digital signatures and override the OS if necessary.

What this means is that the OS can't be interfered with in any way, so it will be impossible to write an application that intercepts keys being pressed (to collect passwords, for example) or one that grabs the screen display to collect confidential information.

All very laudable, and endorsed by Jacqui Smith: "I am pleased that the mobile industry continues to show its commitment to enhance the security of mobile phones," she said.

The problem is that one man's hack is another's utility. Being able to grab screens, from any application, is a very useful tool, particularly for journalists, and intercepting key presses can be used for everything from instant access to applications to redirecting callers to websites. It will be up to manufacturers to decide which parts of their OS are sacrosanct and which are open to developers, but they'll have to be very careful not to cast the net too wide.

These days operators and even manufacturers are increasingly involved in content distribution, and it's clear that this "Advanced Trusted Environment: OMTP TR1" will also prevent applications that intercept content that's been decoded for playback - making effective DRM much more feasible.

It will be interesting to see if mobile phones remain the relatively safe platforms they are, or descend into the constant war that personal computers are required to wage against the tide of malware and infection. The Advanced Trusted Environment is a vote for the former, but users might accept the latter as the price of flexibility in their phones. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Virgin Media so, so SORRY for turning spam fire-hose on its punters
Hundreds of emails flood inboxes thanks to gaffe
A black box for your SUITCASE: Now your lost luggage can phone home – quite literally
Breakfast in London, lunch in NYC, and your clothes in Peru
AT&T dangles gigabit broadband plans over 100 US cities
So soon after a mulled Google Fiber expansion, fancy that
AT&T threatens to pull out of FCC wireless auctions over purchase limits
Company wants ability to buy more spectrum space in auction
Google looks to LTE and Wi-Fi to help it lube YouTube tubes
Bandwidth hogger needs tube embiggenment if it's to succeed
Turnbull gave NBN Co NO RULES to plan blackspot upgrades
NBN Co faces huge future Telstra bills and reduces fibre footprint
NBN Co plans fibre-to-the-basement blitz to beat cherry-pickers
Heading off at the pass operation given same priority as blackspot fixing
NBN Co in 'broadband kit we tested worked' STUNNER
Announcement of VDSL trial is not proof of concept for fibre-to-the-node
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.