A Comprehensive Analysis of Android Security and Proposed Solutions

The human element is often found to be the weakest link in the information security chain. The Personal Information Security Assistant project aims to address this by improving the privacy and security awareness of end-users and by aligning the user's personal IT environment to the user's security requirements. It does this by elicitation of a user's privacy and security requirements (risk appetite) as well as a user's risk perception. The PISA then takes action by aligning the user's requirements and perceptions, thereby improving user awareness regarding privacy and security. This article outlines the research questions, methodology and current results associated with the PISA project.

Abstract. SIM Swap is a form of cybercrime where the victim’s phone number is taken over by a third party through the recycling and reselling of phone numbers that still retain previous customers' data before being recycled. The practice of phone number recycling poses serious risks to the privacy and security of users’ personal data, especially when personal identification numbers (NIK) and family card numbers (KK) stored on the SIM card are not erased before the number is recycled by telecommunication operators. Cases of SIM Swap involving recycled phone numbers highlight weaknesses in the implementation of related regulations, such as Law No. 27/2022 on Personal Data Protection and Ministerial Regulation No. 5/2021. This study aims to analyze regulatory weaknesses, legal implications, and consumer protection against personal data breaches due to SIM Swap. This research employs a normative juridical method with a doctrinal approach through the analysis of legislation and legal documents. The data collection technique involves a library study using secondary data, while the data analysis method is qualitative. The results show that the practice of phone number recycling leads to data misuse and consumer harm due to regulatory gaps in personal data and consumer protection. Legal protection must be strengthened through preventive and repressive measures. Preventive legal protection involves proactive efforts by the state to prevent legal violations, whereas repressive legal protection addresses disputes that have occurred, including resolving trademark disputes through litigation and non-litigation channels. Abstrak. SIM Swap adalah bentuk kejahatan siber di mana nomor telepon korban diambil alih oleh pihak ketiga melalui daur ulang nomor telepon dan penjualan ulang nomor telepon yang masih menyimpan data pelanggan sebelum nomor tersebut didaur ulang. Praktik daur ulang nomor telepon menimbulkan risiko serius terhadap privasi dan keamanan data pribadi pengguna, terutama jika data nomor induk kependudukan (NIK) dan nomor kartu keluarga (KK) pada kartu SIM tidak dihapus sebelum nomor telepon didaur ulang oleh operator telekomunikasi. Kasus SIM Swap pada nomor telepon daur ulang oleh operator telekomunikasi menunjukkan kelemahan dalam implementasi regulasi terkait, seperti UU No. 27/2022 tentang Perlindungan Data Pribadi dan Permenkominfo No. 5/2021. Penelitian ini bertujuan untuk menganalisis kelemahan regulasi, implikasi hukum, dan perlindungan konsumen terhadap kebocoran data pribadi akibat SIM Swap. Penelitian ini menggunakan metode yuridis normatif dengan pendekatan doktrinal melalui analisis peraturan perundang-undangan dan dokumen hukum terkait. Teknik pengumpulan data penulisan ini menggunakan metode studi kepustakaan dengan data sekunder dan analisis data yang digunakan adalah metode analisis kualitatif. Hasil dari penelitian menunjukkan bahwa praktik daur ulang nomor telepon menyebabkan penyalahgunaan data, dan merugikan konsumen karena memiliki celah kekosongan hukum dalam perlindungan data pribadi dan perlindungan konsumen yang perlu dilindungi oleh melalui perlindungan hukum preventif dan represif. Perlindungan hukum preventif dalam hal ini yaitu upaya proaktif yang dilakukan oleh negara untuk mencegah terjadinya pelanggaran hukum. Sedangkan perlindungan hukum represif, yaitu upaya untuk menyelesaikan sengketa merek yang telah terjadi, seperti penyelesaian sengketa merek melalui jalur litigasi dan non-litigasi.

The various services using smart mobile devices including smartphones have increased and personal smart mobile devices have utilized for the business use in many cases. There are the technologies for using smart mobile devices safely by separating the personal area and the business area such as TEE. This paper describes a MSS(Mobile Security Solution) system which is designed based on the TEE system architecture of Global Platform. The Secure Domain of the MSS System allows the secure preservation of sensitive data and the secure execution of sensitive functions. In this paper, we describe the architecture of the MSS System and the procedure for providing a secure message service by using the Secure Domain of the MSS system.

This chapter surveys security of mobile computing devices with focus on multimedia applications. Mobile computing devices are handheld devices such as PDAs (personal digital assistants) and smartphones with smaller size, processing, storage, and memory capacity compared to PCs (personal computers). The portability and various wireless network connection interfaces of the handheld devices greatly increase the risks of loss and theft of the device, exposure of confidential data, as well as the opportunities for unauthorized device, network, and network service access. The initial part of the chapter concentrates on discussing these basic security issues. Security requirements for wired and mobile multimedia network applications are outlined and network protocols (SIP, SRTP) for secure multimedia streaming services are presented. Mobile device security can be based on IPSec VPN technology and secure mobility is especially important in videoconferencing. Current research on roaming security and testbeds for mobile multimedia are also presented. In an appendix, commercially available mobile security solutions, mostly for basic mobile security requirements, are listed.

The more recent advances in network communication and cloud computing technologies have the potential of significantly improving traveling experience by providing value‐added services, such as multimedia on demand (MoD), in vehicular ad hoc networks, where the involved vehicles are provided with enough communication, storage, and computing capabilities. In this scenario, despite many consolidated mobile cloud solutions and pay‐per‐view systems have been developed and widely deployed in public transportation, the security and privacy of mobile users, mainly concerning the association between users' identities and requested multimedia contents, still presents several open challenges. Mainly, providing pay‐per‐view services in vehicular clouds while protecting the passenger's anonymity and simultaneously ensuring the robustness of the payment system has become an important issue.Accordingly, we present a novel smart card‐based MoD payment solution, to be used in mobile cloud‐empowered public transportation systems, that not only guarantees the passenger's anonymity but also uses a personal trusted device to protect the passenger's sensitive information so that he can enjoy the multimedia contents during the long hours of travel. In the future, such scheme can become common practice on MoD‐related equipment in vehicular ad hoc networks, thereby enhancing the competitiveness of public transport companies. Copyright © 2016 John Wiley & Sons, Ltd.

Recently, application scenario of crowdsourcing IoT has covered to e-healthcare service, smart home, smart city, internet of vehicles due to the proliferation of smart devices such as smart mobile devices, smart wearable device, smart medical devices and smart furniture, etc. Patient's data collected by the smart devices send to the various remote medical servers. A group of medical professionals remote access patient data stored at the medical server database. Smart home users want to remote real-time access information of smart devices at home. All these operations need via wireless remote communication, which is suffering from various kinds of threat and attacks. Hence, there are a large number of multi-factor remote authentication and key agreement schemes designed for the application of crowdsourcing IoT. However, in most existing related multi-factor schemes, all factors for identity authentication only act as a parameter for encrypting the local secret key. In this paper, we propose a new secure remote multi-factor authentication scheme that includes three factors: 1) user identity; 2) password; and 3) user biometrics, which are authenticated by the remote server, act as a part of the secret key and participate in the key agreement process. We choose the chaotic map since it has a smaller key size and lower computational overhead, and then achieve remote multi-factor authentication and key agreement by artfully employ it to zero-knowledge technology and the fuzzy extractor technology. Our scheme is more secure and robust since the user revealing nothing sensitive information, and the adversary cannot impersonate any user even if he gets the server's master key. We have done security proof for our proposed scheme using the Random-Or-Real(ROR) model, Burrows-Abadi-Needham (BAN) logic, and ProVerif 2.00 to show that the presented scheme is secure. Also, we give an additional security analysis for other various attacks. Finally, according to the test and simulation result, the proposed scheme is very suitable for the power-constrained smart devices, and in the next generation 5G communication environment, its applicability and usability will be greatly enhanced.

Many organizations want to support Bring Your Own Device initiatives to allow end-users to use personally owned devices at work. Organizations face significant challenges as users increasingly provide their own devices for work. So, interests of many people have grown how to prevent the leakage of security data of their enterprises. There are the technologies for using smart mobile devices safely by separating the personal area and the business area. This paper describes the Secure Domain of the Mobile Security Solution which is designed based on the Trusted Execution Environment system architecture of the Global Platform, and it describes the architecture and the operating procedure of the Secure Urgent Situation Propagation System. The Secure Urgent Situation Propagation System uses the Mobile Security Solution having the Secure Domain isolated from the normal domain, and it provides safe storages, data cryptographic functions through Secure Functions of the Secure Domain, and so on.

PurposeAs the number of devices that connect to the Internet of Things (IoT) has grown, privacy and security issues have come up. Because IoT devices collect so much sensitive information, like user names, locations, phone numbers and even how they usually use energy, it is very important to protect users' privacy and security. IoT technology will be hard to use on the client side because IoT-enabled devices do not have clear privacy and security controls.Design/methodology/approachIoT technology would be harder to use on the client side if the IoT did not offer enough well-defined ways to protect users’ privacy and security. The goal of this research is to protect people's privacy in the IoT by using the oppositional artificial flora optimization (EGPKC-OAFA) algorithm to generate the best keys for the ElGamal public key cryptosystem (EGPKC). The EGPKC-OAFA approach puts the most weight on the IEEE 802.15.4 standard for MAC, which is the most important part of the standard. The security field is part of the MAC header of this standard. In addition, the MAC header includes EGPKC, which makes it possible to make authentication keys as quickly as possible.FindingsWith the proliferation of IoT devices, privacy and security have become major concerns in the academic world. Security and privacy are of the utmost importance due to the large amount of personally identifiable information acquired by IoT devices, such as name, location, phone numbers and energy use. Client-side deployment of IoT technologies will be hampered by the absence of well-defined privacy and security solutions afforded by the IoT. The purpose of this research is to present the EGPKC with optimum key generation using the EGPKC-OAFA algorithm for the purpose of protecting individual privacy within the context of the IoT. The EGPKC-OAFA approach is concerned with the MAC standard defined by the IEEE 802.15.4 standard, which includes the security field in its MAC header. Also, the MAC header incorporates EGPKC, which enables the fastest possible authentication key generation. In addition, the best methodology award goes to the OAFA strategy, which successfully implements the optimum EGPKC selection strategy by combining opposition-based (OBL) and standard AFA ideas. The EGPKC-OAFA method has been proved to effectively analyze performance in a number of simulations, with the results of various functions being identified.Originality/valueIn light of the growing prevalence of the IoT, an increasing number of people are becoming anxious about the protection and confidentiality of the personal data that they save online. This is especially true in light of the fact that more and more things are becoming connected to the internet. The IoT is capable of gathering personally identifiable information such as names, addresses and phone numbers, as well as the quantity of energy that is used. It will be challenging for customers to adopt IoT technology because of worries about the security and privacy of the data generated by users. In this work, the EGPKC is paired with adversarial artificial flora, which leads in an increase to the privacy security provided by EGPKC for the IoT (EGPKC-OAFA). The MAC security field that is part of the IEEE 802.15.4 standard is one of the areas that the EGPKC-OAFA protocol places a high focus on. The Authentication Key Generation Protocol Key Agreement, also known as EGPKCA, is used in MAC headers. The abbreviation for this protocol is EGPKCA. The OAFA technique, also known as the combination of OBL and AFA, is the most successful method for selecting EGPKCs. This method is recognized by its acronym, OAFA. It has been shown via a variety of simulations that the EGPKC-OAFA technique is a very useful instrument for carrying out performance analysis.

This paper introduces personal mobile Web services, a new user-centric architecture that enables service-oriented interactions among mobile devices that are controlled via user-specified authorization policies. Personal mobile Web services exploit the user's contact list (ranging from phonebook to social lists) in order to publish and discover Web services while placing users in full control of their own personal data and privacy. We present a proof-of-concept implementation of an example personal mobile Web service to demonstrate the usefulness and feasibility of the concept.

Runtime monitoring for next generation Java ME platform

In most online social networks, with the increasing number of users and content, the problem of contact filtering becomes more and more present. The recent introduction of such features in online social networks -- for instance, Circles in Google+ or Facebook Smart lists -- shows that it is a problem they are confronted to. In this paper, we explore this question through multidisciplinary aspects. First, we discuss about this issue of groups management in the context of social networks. Then, we present several techniques from the state of the art to automatically find meaningful groups of contacts in a user's contact list. Finally, we asked Facebook users to evaluate these solutions on their own Facebook network, both to compare the solutions among themselves and to assess how pertinent the best ones are according to them. The conclusions of this study is that a network analysis approach can strongly improve the efficiency of an automated detection of groups on networks, which could be used, combined with profile data extraction, to design intelligent management of groups of contacts.

Internet of Things (IoT) is increasingly used through smart devices with internet-based networks. Communication and data sharing between these devices have also grown in several ways. It is presenting a new dimension to the whole digital right management (DRM) industry. The main focus of IoT based DRM technology is to facilitate the authorised user for using multimedia content through smart devices. However, threats of information breach between communication channels also rapidly increasing, which is making content distribution a challenging task. Moreover, the computation and communication efficiency along with user privacy also requires an ideal DRM system. To address concerns of security, efficiency and privacy over internet-based networks, we design a content key distribution framework for DRM systems. The security proof of the proposed framework is given in the random oracle model along with informal security analysis. Moreover, the security analysis performed using widely adopted simulation tool, namely, ???Automated Validation of Internet Security Protocol and Application (AVISPA)???. The study of performance is conducted, which indicates that it fulfils the requirements of computation and computation efficiency.

Users face various privacy risks in smart homes, yet there are limited ways for them to learn about the details of such risks, such as the data practices of smart home devices and their data flow. In this paper, we present Privacy Plumber, a system that enables a user to inspect and explore the privacy "leaks" in their home using an augmented reality tool. Privacy Plumber allows the user to learn and understand the volume of data leaving the home and how that data may affect a user's privacy -- in the same physical context as the devices in question, because we visualize the privacy leaks with augmented reality. Privacy Plumber uses ARP spoofing to gather aggregate network traffic information and presents it through an overlay on top of the device in an smartphone app. The increased transparency aims to help the user make privacy decisions and mend potential privacy leaks, such as instruct Privacy Plumber on what devices to block, on what schedule (i.e., turn off Alexa when sleeping), etc. Our initial user study with six participants demonstrates participants' increased awareness of privacy leaks in smart devices, which further contributes to their privacy decisions (e.g., which devices to block).

The proposed research work aims to develop not only portable devices but also huge items that may require charging at times when there is an immediate shortage of power supply. It is anticipated that, every portable device will be IP-based via the DHCP protocol so that it may be accessed via the app, in which users must previously register their usable gadgets. When the user wants to obtain power charging from a remote partner, they may do it by entering their phone number into a phonepe or any other similar app. The user who intends to transfer power in an eco-friendly manner must make a request to the person on their contact list, wherein the state of charging in the percentage form is immediately updated. When the recipient accepted the request with mutual permission, he or she was given the option of selecting the percentage of charging that they were willing to provide to the sender using QR-codes that held the amount of charging. The sender will be notified of the static QR-code via the app. When the sender scans the receiver's QR-code, their charge status is changed to the new level. This procedure comprises technical upgrades as well as enabling plug-ins to be added to the device in order to create an internet-based gadget, as well as supporting long-term batteries with quick charging and fast discharging capabilities. KeywordsAppFasten chargingFasten dischargingCustomized optionsQR-codes and IoT

Sensors (e.g., light, gyroscope, and accelerometer) and sensing-enabled applications on a smart device make the applications more user-friendly and efficient. However, the current permission-based sensor management systems of smart devices only focus on certain sensors and any App can get access to other sensors by just accessing the generic sensor Application Programming Interface (API). In this way, attackers can exploit these sensors in numerous ways: they can extract or leak users' sensitive information, transfer malware, or record or steal sensitive information from other nearby devices. In this paper, we propose 6thSense, a context-aware intrusion detection system which enhances the security of smart devices by observing changes in sensor data for different tasks of users and creating a contextual model to distinguish benign and malicious behavior of sensors. 6thSense utilizes three different Machine Learning-based detection mechanisms (i.e., Markov Chain, Naive Bayes, and LMT). We implemented 6thSense on several sensor-rich Android-based smart devices (i.e., smart watch and smartphone) and collected data from typical daily activities of 100 real users. Furthermore, we evaluated the performance of 6thSense against three sensor-based threats: (1) a malicious App that can be triggered via a sensor, (2) a malicious App that can leak information via a sensor, and (3) a malicious App that can steal data using sensors. Our extensive evaluations show that the 6thSense framework is an effective and practical approach to defeat growing sensor-based threats with an accuracy above 96 percent without compromising the normal functionality of the device. Moreover, our framework reveals minimal overhead.