Mahindra

Security @ Mobile VAS Ltcdr. Pawan Desai, CISA, CISSP Derisk your business contact@mahindrassg.com www.mahindrassg.com

Agenda  What comprises VAS  Current Trends  Need for Security  Vulnerabilities  Risk Matrix  Domains of Mitigation  Mittigation Steps

What is mobile VAS  Includes services like:  Short Messaging Service  Multimedia media messaging service (MMS)  Caller ring back  Wallpapers  Screensavers  Other downloads  Mobile Banking

Current Trends  M-VAS is set to Grow 70% YOY  The combined market for all types of mobile payments is expected to reach more than 18000 Cr globally by 2013  The registered user base for mobile banking in India is around 25 mn, while the active users are only 2.5 mn  Mobile banking active user base is expected to reach 2% by 2012, up from the current 0.2%  35% of online banking households will use mobile banking by 2010, up from less than 1% at present  70% of bank center call volume is slated to come from mobile phones  VAS constitutes 7% of the total total telecom revenue for Indian operators  Digital music and ringtones constitutes 35% of VAS revenue

VAS Revenues by Category * Source: http://www.pluggd.in/indian-telecom-industry/mobile-vas-numbers-india-revenu

Need for Security  AT STAKE – INR 16,520 Cr Business  35% of online banking households will be using mobile banking by 2010, up from less than 1% in 2007  2005: first malicious mobile virus attack was recorded  2006: 60 mobile viruses  2007: > 400 mobile viruses + Snoopware + spyware + scripts specially written for "camera mobiles“  2009: Anybody’s guess !!! "The biggest challenge - ensuring malware - free content"

The Value Chain

Vulnerabilities of the Mobile Channel  "Curse of Silence Attacks" or "Curse SMS"  Reset of PIN/ Password by fraudsters  Increased "SIM Swop" Scam  IMEI (International Mobile Equipment Identity) duplicity  Lack of user knowledge leading to the prevelence of unsafe mobile usage practices  Denial of Services (DoS)  Virus Propagation  Overbilling Attack  Malware attacks - Ransomeware

Vulnerabilities of the Mobile Channel.. Cont… Relating to the Handset  Easily lost or handset change frequently so authentication and authorisation are challenging  Limited keypads Limited choice of PINS Related to Mobile Channel  Encryption not necessarily end-to-end Related to VAS applications  Often Outsourced – Interface with provider may create additional vulnerabilities

Risk Matrix Threats Vulnerability Result Fraudulent Privacy Service transaction loss Denial Reset of PIN by Known PIN and MSISDN and can initiate fraudster transactions off a stolen phone √ √ √ Lack of user Mis-formatted messages - DoS, invalid knowledge / exp attempts - PIN lock. User asks others for help √ √ √ and exposes PIN SIM swap The valid MSISDN is moved to another handset. The user has no access to their account and receives no notifications. The √ √ √ user with the other handset, on knowing the PIN, can transact on the account Movement of Funds gone and not retrievable funds beyond defined √ √ - beneficiaries Infection by virus 3rd party can see and send transactions - Advanced through device - act as relay for transactions, Feature and Smart PIN sent to 3rd party, information sent to 3rd √ √ √ Phones party, replay of transactions, stop valid transactions, stop notification messages

Domains of Mitigation Mitigation Domain Example Action Strategy Technology Change and / or Plaintext PIN exposure Move from no security on the modify the mobile to security on the technology to mobile (from structured SMS reduce the risk with PIN to SIM Toolkit with PIN) Process Implement Movement of funds to a - Require pre-registration of a process controls random beneficiary allows a beneficiary via the call centre to block process thief to send money to where the user‘s identity is paths that can whoever they want authenticated by asking be exploited questions. - Limit or set the value that can be sent to a beneficiary Fraud monitoring processes to look for out of normal transactions Environment Train and inform Theft / borrowing of mobile -Train users to not hand out users to handset and knowledge of the their PINs so as to let others influence PIN by thief. (This cannot be use their mobile behaviour stopped by technical or - Vigorous follow-up and process means) prosecution

Mitigation steps  For users:  Observe caution while using Bluetooth  Have an AV running  Know your IMEI number  For service providers  Ensure that connections to and from users are over secure channels.  All connections from and to other service providers must also be secured  Implement strong authentication  For regulators and service providers  Work together to secure the mobile infrastructure  Create implementable laws that minimize the instances of fraud

The Value Chain

Thank You… India Europe Singapore Mumbai London 30 Raffles Place 3rd floor, Landmark Building, 4 New Square # 23-00 Caltex House next to Mahindra Towers, Bedfont Lakes, Feltham Singapore 048622 Worli, Middlesex TW14 8HA Ph: +65– 6233-6853 / 54 Mumbai 400 018. India. Phone: +44 20 8818 0920 Ph: +91-22-24901441 Fax: +44 20 8818 0921 New Delhi Germany 2-A, Mahindra Towers, Bhikaji GMBH. Partnerport - Cama Place, Altrottstrabe 31, D-69190 New Delhi - 110 066, India Waldorf, Germany P: +91 (11)-4122 0300 Ph:+49 (0) 6227 381 106 Bangalore #150, Tower No. B-2, Level-I, Diamond District, Airport Road, Bangalore - 560 008, India. Phone: +91 80 4135 3200 www.mahindrassg.com

Mahindra

by sarikasareen

Accessibility

Categories

Upload Details

Usage Rights

1 Embed 1

Statistics

Mahindra Presentation Transcript