Feeds

OMTP publishes standard, but what is it really securing?

At least the Home Secretary is pleased

Seven Steps to Software Security

The Open Mobile Terminal Platform group has finally published the security documents it outlined last year, and got the UK home secretary to say what a good thing that is.

The OMTP is just an operator talking shop really, no-one is under any obligation to implement the standards they propose, but the operators will look favorably on handsets that conform to the freely-available standards the OMTP publishes.

The security proposals are much as outlined back in October, but with more detail and a focus on ensuring the integrity of the operating system rather than securing applications, which will be left to the platform.

The basic concept is to have the OS image verified before loading, then providing the capability to confirm that integrity while running, so hacks can't be applied even after the OS is up and running. Obviously that's going to require a secure store in the hardware, with the ability to verify digital signatures and override the OS if necessary.

What this means is that the OS can't be interfered with in any way, so it will be impossible to write an application that intercepts keys being pressed (to collect passwords, for example) or one that grabs the screen display to collect confidential information.

All very laudable, and endorsed by Jacqui Smith: "I am pleased that the mobile industry continues to show its commitment to enhance the security of mobile phones," she said.

The problem is that one man's hack is another's utility. Being able to grab screens, from any application, is a very useful tool, particularly for journalists, and intercepting key presses can be used for everything from instant access to applications to redirecting callers to websites. It will be up to manufacturers to decide which parts of their OS are sacrosanct and which are open to developers, but they'll have to be very careful not to cast the net too wide.

These days operators and even manufacturers are increasingly involved in content distribution, and it's clear that this "Advanced Trusted Environment: OMTP TR1" will also prevent applications that intercept content that's been decoded for playback - making effective DRM much more feasible.

It will be interesting to see if mobile phones remain the relatively safe platforms they are, or descend into the constant war that personal computers are required to wage against the tide of malware and infection. The Advanced Trusted Environment is a vote for the former, but users might accept the latter as the price of flexibility in their phones. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Apple orders huge MOUNTAIN of 80 MILLION 'Air' iPhone 6s
Bigger, harder trouser bulges foretold for fanbois
GoTenna: How does this 'magic' work?
An ideal product if you believe the Earth is flat
Telstra to KILL 2G network by end of 2016
GSM now stands for Grave-Seeking-Mobile network
Seeking LTE expert to insert small cells into BT customers' places
Is this the first step to a FON-a-like 4G network?
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
BlackBerry: Toss the server, mate... BES is in the CLOUD now
BlackBerry Enterprise Services takes aim at SMEs - but there's a catch
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.