Feeds

OMTP publishes standard, but what is it really securing?

At least the Home Secretary is pleased

The Power of One Infographic

The Open Mobile Terminal Platform group has finally published the security documents it outlined last year, and got the UK home secretary to say what a good thing that is.

The OMTP is just an operator talking shop really, no-one is under any obligation to implement the standards they propose, but the operators will look favorably on handsets that conform to the freely-available standards the OMTP publishes.

The security proposals are much as outlined back in October, but with more detail and a focus on ensuring the integrity of the operating system rather than securing applications, which will be left to the platform.

The basic concept is to have the OS image verified before loading, then providing the capability to confirm that integrity while running, so hacks can't be applied even after the OS is up and running. Obviously that's going to require a secure store in the hardware, with the ability to verify digital signatures and override the OS if necessary.

What this means is that the OS can't be interfered with in any way, so it will be impossible to write an application that intercepts keys being pressed (to collect passwords, for example) or one that grabs the screen display to collect confidential information.

All very laudable, and endorsed by Jacqui Smith: "I am pleased that the mobile industry continues to show its commitment to enhance the security of mobile phones," she said.

The problem is that one man's hack is another's utility. Being able to grab screens, from any application, is a very useful tool, particularly for journalists, and intercepting key presses can be used for everything from instant access to applications to redirecting callers to websites. It will be up to manufacturers to decide which parts of their OS are sacrosanct and which are open to developers, but they'll have to be very careful not to cast the net too wide.

These days operators and even manufacturers are increasingly involved in content distribution, and it's clear that this "Advanced Trusted Environment: OMTP TR1" will also prevent applications that intercept content that's been decoded for playback - making effective DRM much more feasible.

It will be interesting to see if mobile phones remain the relatively safe platforms they are, or descend into the constant war that personal computers are required to wage against the tide of malware and infection. The Advanced Trusted Environment is a vote for the former, but users might accept the latter as the price of flexibility in their phones. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
Google Nest, ARM, Samsung pull out Thread to strangle ZigBee
But there's a flaw in Google's IP-based IoT system
Orange spent weekend spamming customers with TXTs
Zero, not infinity, is the Magic Number customers want
Want to beat Verizon's slow Netflix? Get a VPN
Exec finds stream speed climbs when smuggled out
US freemium mobile network eyes up Europe
FreedomPop touts 'free' calls, texts and data
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
GoTenna: How does this 'magic' work?
An ideal product if you believe the Earth is flat
NBN Co execs: No FTTN product until 2015
Faster? Not yet. Cheaper? No data
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.