GigaOM » mobile security

1Password update for iOS adds better syncing, browsing

Geoffrey Goetz — Wed, 12 Dec 2012 17:04:10 +0000

On Wednesday, Agilebits is releasing a long-awaited update to its 1Password app for iOS. The new app has been completely rewritten and has major upgrades, including the addition of cloud-based syncing, tabbed browsing, and an overall simpler user interface.

A little over a year ago, I took an in-depth look at password apps for iOS and OS X devices. At that time I found the simplicity of mSecure’s user interface to be exactly what I was looking for. Back then, most password manager apps offered Wi-Fi sync and a few offered synchronization through Dropbox. Having a way to keep all of my data in sync across all of my devices was becoming more of a priority. Since then I have come to appreciate the seamless data integration across all of my devices with other iCloud Sync enabled apps. So when 1Password was updated with iCloud sync, I just had to give it a try.

The first thing you will notice with the latest update of 1Password on iOS is that the user interface has been completely redesigned. One of the confusing bits in the last version was that you had to know what type of password you were looking for — was it a login, an account, an identity or a note? There was no unified search that could find your secure information across all of the different data vaults you stored your passwords within. That has all changed, and not only can you now search across all of your data stored in 1Password, you can also see all of your stored items listed in a global “All Items” category. In addition to enhancing the way that categories are accessed, Folders and Favorites have been added to help you quickly find the information you are looking for.

Another major improvement is the addition of tabbed browsing. It use to be that you had to first locate your account information, then tap on the URL in order to enter into a hidden browser mode. Now you can actually use 1Password as a replacement for Safari and go to your favorite websites first. It then knows which passwords are associated with that site and presents you an option to log in with the credentials you have stored.

And that brings me back to the iCloud Sync, the main reason that I decided to take a look at the new version in the first place. What can one say, it just works. The account information I created on my iPad showed up on my iPhone, and since I had already configured all of my iOS devices to use iCloud Sync, I did not have to do any additional configuration or log on to any account. Overall I am very impressed with the redesign of 1Password 4 for iOS. It has turned a powerful yet complicated app into a utility that just about anyone will find easy to use.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

New solutions for the evolving mobile network

Mon, 01 Oct 2012 18:31:41 +0000

Cisco’s VNI graph shows mobile data growing 18 times over the next five years, and it makes a strong case for the need of mobile networks to evolve to reflect the transition from voice- to data-centric usage models. Yet to make these fundamental changes in operating networks, it is crucial to move beyond compelling graphics and understand what requirements new usage models impose on the network infrastructure. To successfully address the increase in data traffic, operators need to act on multiple fronts, because no single solution will be sufficient in isolation.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Pre-merger, Apple, AuthenTec were working on new tech together

Erica Ogg — Thu, 16 Aug 2012 15:22:18 +0000

Before Apple decided to open its wallet for mobile-security chip company AuthenTec last month, the two companies had already been collaborating on some new technology for a future Apple product. That news was teased out of a recent AuthenTec SEC filing by The Next Web on Thursday. That means we might see the product of their collaboration sooner than previously thought.

The deal for Apple to purchase AuthenTec for $356 million was disclosed quietly, through an SEC filing, on July 26. But the outright purchase of the company wasn’t the original plan, apparently. AuthenTec, a pioneer in biometric security that makes fingerprint sensors for mobile devices, had some new technology it was looking to sell to device makers. It approached several companies last year, but apparently Apple was the only one interested, according to the filing:

Late in 2011 and early in 2012, the Company [AuthenTec] discussed new technology with several leading consumer electronics companies to gauge potential market interest for such a product. For a number of reasons, including cost, Apple was the only potential customer that expressed substantive interest in pursuing further development of and a commercial agreement with respect to this technology.

Beginning late in February 2012, management of the Company, including Larry Ciaccia, Chief Executive Officer, Phil Calamia, Chief Financial Officer, and Fred Jorgenson, Vice President and General Counsel, met with representatives of Apple to discuss and negotiate the terms of a potential commercial agreement between the Company and Apple relating to the development of this new technology. These discussions continued through March and April 2012 in several meetings held at the offices of Apple in Cupertino, California, as well as telephonically.

Long story short, there was a lot of back-and-forth between Apple and AuthenTec over licensing, exclusivity, cost and other details about this new product Apple wanted to use. Then suddenly on May 1, Apple said, “what the heck, we’ll just buy the whole company instead of this one technology” (that’s a paraphrase) and offered $7 per share. Apple played hard ball too: it said if Apple couldn’t buy the company, it would also no longer be interested in the “new technology” the two were working on.

There were some other hiccups over that next month — Apple found something in the due diligence process it didn’t like — and eventually said it would rather go back to partnering on a product than buying AuthenTec. That was the beginning of June. And for the next month the product development continued.

Eventually AuthenTec resolved the due diligence matter and Apple changed its mind (again) and said it would like to acquire AuthenTec after all and the deal was done by the last week of July. The merger hasn’t been voted on by AuthenTec shareholders yet.

What’s the mystery product?

What Passbook looks like in iOS 6.

Far more interesting than the tedious negotiations of the two companies is what exactly the two were, and are, working on. As I wrote back when the deal was announced, it could have something to do with secure mobile transactions — those could include monetary payments or other personal info people want to secure, like tickets and corporate rewards cards. AuthenTec makes fingerprint sensors, but specifically, it makes a chip that secure NFC transactions.

Passbook, which is a new feature of iOS 6 that will be available likely in the next month or so, lets users keep boarding passes, tickets, coupons and rewards cards in one app. None of those allow direct access to a user’s debit or credit cards, but they can be used to make payments via stored-value cards like the kind Starbucks issues.

What this SEC filing reveals is that the two companies weren’t starting from scratch on a new product at the end of July. If they were, it would be extremely unlikely that there would be any product of their collaboration ready in time for a fall product launch. However, if this is something AuthenTec had been shopping around for the last year, then it’s extremely plausible that this fingerprint sensor, could be ready in time for a next-generation iPhone purportedly launching in a month, or a smaller iPad, also expected before the end of the year.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

How Bromium lets bad guys in and still keeps data safe

Derrick Harris — Wed, 20 Jun 2012 19:15:03 +0000

Forget the ideas of virtual desktops and desktop hypervisors to separate employees’ work lives from their personal lives. A new security startup called Bromium launched on Wednesday with the goal of protecting corporate data on employee devices while letting those employees operate the same as they ever have. Bromium — founded in 2011 by Xen hypervisor creators Ian Pratt and Simon Crosby, along with Guarav Banga — works its magic by creating isolated instances on a computer’s processor that keep code from going where it’s not wanted.

CTO Crosby explained to me the thinking behind Bromium like this: Human beings don’t do well when they’re fortified within the walls of a city. They want to go out, explore the world around them and click on shiny attachments. This means constantly entering into “areas of unfathomable trust” where it’s easy to get hurt if they’re not careful.

However, when employees are doing this exploring on computers that also store and have access to corporate data, the real concern is they’ll meet a nefarious but cunning stranger and bring him back into the city’s fortified walls. In fact, Crosby said, that will happen, which is why “any approach that says we can stop the bad guys is basically a lie.” What you need is a way to make sure that stranger sees as little as he needs to, and is shown the door in a hurry.

So what’s Bromium’s secret?

To some degree, Bromium’s product, called Microvisor, is like a traditional hypervisor that’s installed on a server or desktop’s operating system and divvies it into several smaller virtual machines, or VMs. Only whereas traditional VMs are full versions of an operating system complete with full suites of applications, Microvisor uses the hardware virtualization present on Intel desktop processors to create what Bromium calls micro-VMs. Microvisor creates micro-VMs immediately whenever someone opens a new application, clicks on a link or downloads an attachment (and destructs them when those tasks end). And each micro-VM gets only the operating system resources and file system access it needs to do its job.

Because micro-VMs exist at the hardware level and not within a hypervisor installed on the host operating system, they go a long way toward limiting unwanted intrusions into sensitive data by operating in isolation from one another. Bromium calls this “the principle of least privilege.” Essentially, if I’m a piece of malware, I can’t infect areas of the physical machine’s OS or those of any other micr0-VMs, and whatever damage I might do within my micro-VM becomes moot when the micro-VM shuts down, never again to exist.

This approach, Crosby said, solves one of the primary problems with virtual desktops and desktop virtualization products that view VMs as a value proposition rather than the problem that needs solving. For user endpoints rather than servers, he explained, “the abstraction that is a virtual machine is of no use whatsoever” because if an attacker targets someone’s corporate email address or otherwise infiltrates the “business” VM, he’s in. “God, how stupid is that?” Crosby joked.

To make itself as impenetrable as possible, Bromium has a small code base — presently around 100,000 lines — that will only get smaller in time. Less code, said Crosby, should mean fewer vulnerabilities. “Throw away a line of code every day,” he said. “If you can, throw away 10.”

I’m an end-user, how does Bromium improve my life?

Simon Crosby, co-founder and CTO, Bromium
(c)2012 Pinar Ozger pinar@pinarozger.com

From a user’s perspective, Crosby said, one of the best parts about Bromium Microvisor is that the user just goes about business as usual. Whitelisted applications provisioned by the IT department aren’t affected at all, and even applications and tasks that run in micro-VMs do so transparently to the user. Employees don’t want multiple operating systems running on the same device, he said, they just want one experience that works.

Plus, Crosby said, because micro-VMs are so lightweight, they do their job with the performance lag often associated with other types of desktop virtualization products and antivirus programs. And a standard laptop can support hundreds of micro-VMs.

However, while it all sounds great in theory, there is one catch that end-users might not like — for now, Microvisor only runs on Intel processors running Microsoft Windows. Until it supports different OSes and processor architectures (which it will in time), Microvisor is no cure-all that will have employers embracing BYOD because iPads and Android tablets will suddenly be deemed safe.

Oh, and CIOs and IT departments still have to decide to go with Microvisor over the virtual desktops and client-side hypervisors that so many other IT vendors are pushing. Given Bromium’s executive pedigree and the general malaise over the alternatives, one has to think it will get plenty of consideration. But until it’s proven out in the wild, the decision to deploy something as unique as Microvisor is itself a decision of unfathomable trust.

Check out the rest of our Structure 2012 coverage, as well as the live stream, here.

Watch live streaming video from gigaomstructure at livestream.com

Feature image courtesy of Shutterstock user StillScott; Simon Crosby image by Pinar Ozger.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Stealthy startup Bluebox gets $9.5M to secure a BYOD world

Derrick Harris — Tue, 19 Jun 2012 11:30:34 +0000

A stealthy security startup called Bluebox has raised $9.5 million from a who’s who of investors, although the world will have to wait a little longer to hear about the technology justifying all that money. If venture capitalist reputations are indicative of big things to come, though, Bluebox must be onto something. Andreessen Horowitz led the round that also included Andy Bechtolsheim (who’s also a board member), Ram Shriram and Brian Cohen.

Here’s what we do know about Bluebox: the company is targeting the security of enterprise data on mobile devices and was co-founded by Caleb Sima and Adam Ely. Sima comes from HP, which acquired SPI Dynamics — the company he co-founded along with investor Cohen — in 2007. Ely was previously CISO at Heroku and security head at TiVO.

“Enterprise security on mobile is an unsolved problem, and, frankly, is in need of innovation. Bluebox is developing a solution that will change the way enterprises think of how to successfully and seamlessly protect their data,” Bechtolsheim, who co-founded Sun Microsystems and Arista Networks, is quoted a saying in the Bluebox press release.

Here’s what else we know: Bluebox isn’t the only hotly anticipated startup with an impressive security pedigree targeting the mobile space. At our Structure conference on Wednesday, Xen creator and former Citrix virtualization CTO Simon Crosby will unveil the the technology behind Bromium, the startup he founded last year along with Xen co-creator Ian Pratt and and former Phoenix Technologies CTO and SVP Guarav Banga. In the meantime, my weekend profile of Crosby gives a few details of Bromium, and the company has a fantastic placeholder website.

Of course, the inherent security issues around bring-your-own-device (BYOD) workplaces have companies of all types worried about securing their data. I don’t think it’s going out on a limb to suggest Bluebox, Bromium and anyone else currently targeting the BYOD movement will have a lot more company in the years to come.

Feature image courtesy of Shutterstock user Denis Vrublevski.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Poll: Will Carrier IQ influence your next handset purchase?

Kevin C. Tofel — Thu, 01 Dec 2011 21:19:03 +0000

Although the story is still developing, it’s clear that some phones on certain carriers have app called Carrier IQ pre-installed. The software has been demonstrated to capture nearly every action you take on a smartphone and view textual data, such as SMS messages and web searches. How much of that data is being sent to carriers and handset makers is still an open question, but clearly, there’s the potential for a total disregard of consumer privacy.

The situation might be different if the Carrier IQ software was more transparent. Unlike other services that can collect data, there’s no opt-in or opt-out choice with Carrier IQ. Instead, it runs silently in the background on a phone and can’t easily be disabled. Consumers effectively don’t even know if their phone has the Carrier IQ software installed, although we found a way to check on a rooted Android handset.

What we know and don’t know (yet)

We do know that Apple’s iOS did have Carrier IQ hooks in the past, but the company told AllThingsD that it stopped using Carrier IQ with iOS 5. Verizon Wireless has already said that it doesn’t use Carrier IQ. Meanwhile, Sprint has publicly admitted using the software for network monitoring and performance reasons, although it’s not clear which phones do or don’t use Carrier IQ on Sprint’s network. AT&T is now copping to using Carrier IQ data as well.

Microsoft’s Joe Belfiore has come forth to tweet that the Windows Phone platform doesn’t use it Carrier IQ at all. HTC and Samsung are two handset makers that have been found to use it, while Nokia and RIM both deny using the software on their devices. Again, more details will likely come forth over the next few days.

Will this modify buying behaviors?

Regardless, the situation has me wondering: Will the Carrier IQ situation cause people to think harder about their choice of smartphone or carrier? Might you shift your next handset purchase away from Samsung or HTC, for example?

We’ll keep this simple in the poll with a basic yes or no response, but don’t hesitate to sound off in the comments. As for me, I’m glad I just bought a new Galaxy Nexus because Google has said it doesn’t put Carrier IQ on any of its Nexus devices.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

How to check if your Android phone uses Carrier IQ

Kevin C. Tofel — Thu, 01 Dec 2011 14:54:52 +0000

More than 141 million smartphones are now running software that can log everything a user does and sees, including private web browsing, incoming texts and even which buttons are pressed. The application, called Carrier IQ, runs in the background unbeknownst to consumers and captures user and phone data as evidenced in this video shown on Wednesday. So how do you know if your handset is running the Carrier IQ software?

While details of how widespread Carrier IQ’s service are still coming to light, all the demonstrations so far have shown it on Google Android phones. There is some evidence Apple’s iOS had Carrier IQ integration two years ago, but no data showing it’s currently in use. For now then, the focus is on Android, and there’s an application that can tell you if Carrier IQ is on your Android phone.

The free software is available from the XDA-Developers site, where Carrier IQ’s activity was first pointed out. The app, pointed out by TheVerge, is bare-bones and was quickly developed by Trevor Eckhart, the person who demonstrated on video exactly what Carrier IQ is capable of. His detection software is called an .apk file, which is the standard Google Android application installation method, so don’t panic if you’re not familiar with the term .apk.

Eckhart has several versions of the software available at the bottom of the XDA topic page; at last check, I saw seven, because he added more security detection features as he developed the app. The one of most interest, however, is the Carrier IQ check, which is performed with a button tap after the app is installed.

I ran Eckhart’s app on my Samsung Galaxy Tab and Google Nexus One; both are free of Carrier IQ software, but I expected that. Both devices run custom versions of Android I installed myself. Carrier IQ is installed in the software versions from either a carrier or a hardware maker, and since I’ve overwritten their software, there’s practically zero chance my devices are spying on me.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Are carriers logging every action on your cell phone?

Kevin C. Tofel — Wed, 30 Nov 2011 16:26:46 +0000

After you buy a smartphone and the required mobile broadband service, what you do with the device is your business, right? Maybe not. Earlier this month, the XDA-Developer site noticed that a preinstalled mobile app, named Carrier IQ, was logging all smartphone activities with no way to opt out. On Wednesday, a new video demonstration surfaced that demonstrates exactly what the Carrier IQ software does. And it’s disturbing, especially when you consider more than 141 million Android, BlackBerry, and Nokia handsets have the software installed.

Here’s the entire 17 minute video; a bit long, yes, but if you have a smartphone, it’s well worth watching. If you want to skip the basic handset setup parts — showing that this is a freshly restored phone — hit the video around the 8 minute mark to see the logging aspects.

Trevor Eckhart created the video, which I found by way of Wired. Through using the Android developer tools to monitor the phone’s usage, he shows several concerning activities that CarrierIQ captures:

Logging of keystrokes. Nearly every button — hardware or software — is noted when pressed. I noticed the keystrokes for input were based on ASCII standard codes, which are fairly universal. That means the keylogging feature can easily work across nearly all devices.
Text of incoming SMS messages. Don’t expect privacy of what you’re sending or receiving on a phone with CarrierIQ installed.
Web browsing information through what are supposed to be encrypted transactions. Eckhart did a simple Google search with the browser in a private mode using the secure HTTPS protocol. Yet, his exact search term in the browser was captured, even when using the phone on his home Wi-Fi network.

The Carrier IQ software can’t be disabled, either, making the situation even worse. Eckhart shows the service is set to run at all times and can’t be shut off through the standard “Force Close” option in Android. There’s no opt-out method; the service runs invisibly in the background; and there’s nothing a consumer can do to stop it. Why does CarrierIQ capture this data? According to the company’s website, the reason is to help both carriers and handset makers:

Recognizing the phone as an integral part of a mobile service delivery, and using the device to measure key parameters of service quality and usage, the Carrier IQ solution gives you the unique ability to analyze in detail usage scenarios and fault conditions by type, location, application and network performance while providing you with a detailed insight into the mobile experience as delivered at the handset rather than simply the state of the network components carrying it.

I understand the need to log data and share details — to a point. Let’s face it: Computers have logged such data for years; mainly to help troubleshoot problems. But those logs weren’t sent anywhere without the user’s knowledge, and that’s what makes this situation very different.

I’ll be looking into this a bit deeper, but while I do, there are some interesting questions raised by this video. Although consumers are buying smartphones — and assume they have ownership — are the handsets theirs to do with as they please, without the carriers or handset makers knowing what they’re doing? One could argue that the smartphone isn’t owned until it’s fully paid for, since carriers often subsidize the actual hardware costs, but I think the argument is lame, at best.

What about the network itself, which is generally required to gain the full benefit of having a connected device? Does the monthly fee to “rent” mobile broadband service mean consumers have no privacy rights while on the carrier network? From a consumer standpoint, I’d argue that yes, there should be some level of privacy. Then again, carriers spent billions of dollars on the infrastructure and want to protect their investment. Thoughts?

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Where to watch the Murdoch testimony live online

Janko Roettgers — Tue, 19 Jul 2011 07:11:58 +0000

Rupert Murdoch and his son James Murdoch will be testifying in front of the U.K. parliament’s media select committee today, answering questions about the phone hacking scandal that led to the closure of Murdoch’s News of the World newspaper. Members of parliament will also grill Rebekah Brooks, former chief executive of Murdoch’s News International, who was arrested on Sunday on conspiracy charges.

The phone hacking saga is one of the biggest political scandals in recent U.K. history, and some have speculated that it could not only lead to the end of Murdoch’s reign at the helm of News Corp., but even cost the country’s prime minister David Cameron his job. No wonder media organizations from all over the world are going to cover the testimony live, with hearings beginning at 9:30 a.m. EDT / 6:30 a.m. PDT.

A few outlets are also streaming the testimony live online:

CNN.com will stream the entire testimony live on its website as well as through a number of mobile apps.
C-SPAN will stream the testimony live as well on C-SPAN3.

Image courtesy of Flickr user Gene Hunt.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Lots of promise, lots of competition for enterprise tablets

Colin Gibbs — Tue, 21 Jun 2011 19:00:00 +0000

The tablet market has suddenly become a very crowded space: Huawei unveiled its 7-inch MediaPad yesterday, Hewlett-Packard has begun taking orders for its TouchPad, Research In Motion has shipped 500,000 PlayBooks and Panasonic is preparing to come to market with an Android-based Toughbook, to name just a few. All of these devices take aim at Apple’s iPad, which has enjoyed runaway success among consumers and has been embraced by bigwigs in the enterprise, as my colleague Darrell Etherington pointed out last week.

And while end users are primarily driving the market for enterprise tablets today, businesses will increasingly take tablet deployments into their own hands, as a recent survey from Dimensional Research illustrates. The firm found that 22 percent of business and IT executives polled said that they had officially deployed tablets, and 78 percent plan to do so by the end of 2013.

But as I discuss in a new report on enterprise tablets at GigaOM Pro (subscription required), the competition will be fierce, because so many new tablets are coming to market. Apple has created something of a standard with its $500 price point for the least expensive iPad, so competitors who can’t match that price will have to differentiate themselves with other features or functionality. Both consumer and enterprise applications will also play a major role in determining the success or failure of tablets in the enterprise. And security will increasingly be a factor, especially for businesses that allow employees to use their own tablets for work.

Enterprise tablets represent a very promising space, especially in vertical markets such as education, retail and health care. But the market for business tablets is still in its infancy, and it will endure substantial growing pains over the next two to three years. Tablet manufacturers and application developers who understand the needs of businesses and their employees will thrive as the space gets legs. Those who fail to meet those needs will quickly find themselves left behind. For more thoughts on the promising market for enterprise tablets as well as a competitive analysis of major players in the space, please see my new report (subscription required).

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.