Study into the Implications of Smartphone Operating System Security

Study into the implications of Smartphone operating system security
Weak PINS: Research in 2011 by mobile app developer Daniel Amitay 16 discovered that 15
percent of monitored iPhone users were using ten easy-to-guess PINs. The ten PINS were
1234, 0000, 2580 (straight down the middle of the keypad), 1111, 5555, 5683 (spells out
LOVE), 0852 (straight up the middle of the keypad), 2222, 1212 and 1998. If a thief were to
enter in these PINS they could possibly gain access to around 15 percent of Smartphones.
Financial Fraud
There is evidence of financial fraud targeting Smartphones in at least two sectors, telephony
Premium Rate Services (PRS) and financial services, including banking and payment.
As commerce and financial services move onto mobile platforms than there will be more
opportunity to attempt financial fraud on Smartphones. This will lead to other services that
deal with finance and money, such as retail, becoming targets.
Telephony Premium Rate Services (PRS) Fraud
Premium Rate Services offer one way in which criminals can attack Smartphone in an
attempt to undertake financial fraud.
There is evidence that there have been attacks made against Smartphone-based Premium
Rate Services (PRS) in the UK.
In two separate reports 17 , commissioned by the UK’s PRS regulator, PhonepayPlus, Goode
Intelligence determined that there was a link between mobile malware and Smartphone PRS
fraud. This concurred with what PhonepayPlus was seeing as part of investigations carried
out by the regulator after they had received consumer complaints of unsolicited PRS
payments being charged to their mobile phone bills.
During the winter and spring of 2011/2012 PhonepayPlus recorded an increase in consumer
complaints related to unsolicited PRS charges on their Smartphone bills. Unsuspecting
users were being charged £15.00 every time (charged as three separate £5.00 premium rate
texts) they tried to open a ‘free’ app that had been downloaded to their Android Smartphones
from Android App store, including Google’s official App store (Google Play). The free apps
were fake versions of popular games such as Angry Birds, Assassins Creed and Cut the
Rope.
The subsequent investigation by PhonepayPlus resulted in action against a PRS provider,
A1 Agregator Limited, who “had control of, and responsibility for, the premium rate payment
system which enabled the malware to fraudulently charge consumer’s mobile phone
16 Why your Smartphone’s PIN is Far More Vulnerable Than You Think. CBS News, 22 nd June 2011:
http://www.cbsnews.com/8301-505143_162-28651662/why-your-smartphones-pin-is-far-morevulnerable-than-you-think/
17 ‘Unsolicited Billing and the Security of Broadband Dongles and Smartphones’. 17 September 2010.
Researched by Goode Intelligence for PhonepayPlus and ‘Malware Threats to UK Smart Phone
Users: Fraudulent use of Premium Rate Billing’. January 2012. Researched by Goode Intelligence for
PhonepayPlus
Goode Intelligence © 2013 P a g e | 31 www.goodeintelligence.com