Windows Phone 8 Security deep dive

Transcription

1 October 2012 Windows Phone 8 Security deep dive David Hernie Technical Evangelist Microsoft Belux Office Microsoft Corporation

2 All large screen, dual-core, LTE and NFC Nokia Lumia 920 Nokia Lumia 820 Samsung ATIV S HTC 8X 4.5, PureMotion display, PureView OIS camera 4.3, ClearBlack display, Carl Zeiss lens 4.8, HD super AMOLED display 4.3, Gorilla Glass 2 display, ultra-wide angle camera lens Nokia City lens, Nokia music streaming, Wireless charging Snap on back cover, Wireless charging, Nokia City lens, Nokia music streaming NFC Tap-to-send, Samsung Family Story Built-in Beats Audio, built-in amp

3 Shared Windows Core A shared core brings enterprise-class computing to mobile devices NT Kernel runs on Windows 8, Windows RT, Windows Phone 8, Windows 8 Embedded, and Windows Server 2012 Running reliably on 1.3 billion computing devices Consumers now have greater choice in form-factor, apps, and experiences Developers can rapidly develop for multiple platforms at a much lower cost due to a high level of code reuse Hardware manufacturers can now innovate and differentiate their offerings while enjoying their fastest time-to-market ever

4 Three different ecosystems Strategy Platform + Google Services Integrated experiences Integrated software and hardware Ecosystem Open source enabling anything Structured to optimize experience Apple controlled vertical Experience Varies by device Consistent with extensibility Apple defined

5 Agenda Security goals What is this all about? System integrity prevent malware from taking control App platform security architecture and recommendations Data protection Prevent unauthorized access to data stored Access control & Device Mgmt Provide secure access to device Remediation What if something goes wrong

6 Security Goals User first Great experiences What s the impact End user safety, not always aware.. Tools to protect Developer trust Business policy compliance

7 Secure Boot Secure Boot helps ensure the integrity of the entire Operating System Secure Boot implementation is provided by SoC Two phases: pre-uefi boot loaders to initialize the hardware UEFI secure boot helps ensure integrity of UEFI applications and Windows OS Secure Boot helps prevent malware from being installed on the phone

8 Secure boot process Power On Firmware boot loaders SoC Vendor OEM OEM UEFI applications Windows Phone boot manager Boot to flashing mode Windows Phone 8 OS boot Windows Phone 8 update OS boot MSFT

9 Trusted Pre boot loader During manufacturing Provisioning the hash of the public key used to sign the initial boot loaders + numbers of unique keys Blow appropriate fuses read only Provisioning of the UFEI key databases No secure boot bypass for users Secure flashing required

10 Secure UEFI Boot Loader All about Keys Platform Key Master key PK Once PK is provisioned the UEFI environment is enabled Can be used to sign updates to KEK Allowed and Forbidden Signature Database DB/DBX Controls what images can be loaded Contains forbidden keys Secure Boot Variable Secure Boot Policy SBP controls certain aspects of boot Sequence

11 Code Signing All Windows Phone 8 binaries must have digital signatures signed by Microsoft to run Microsoft and marketplace apps had digital signatures Different from WP7, OEM binaries will be signed by Microsoft With the control of every layers, it becomes very complicate to integrate a non-certify process or a custom build.

12 Windows Phone 7 Application security model Chamber Model (Sandbox) Fixed Permissions Chamber Types TBC for the Kernel & Drivers LPC for apps Elevated right for OS component Standard right are created ad-hoc base on capabilities Dynamic Build Capabilities Expressed in application manifest Disclosed on Marketplace Defines app s security boundary on phone

13 Capabilities Still in the process of identifying capabilities WP7 capabilities Video and Still capture; Video and Still capture ISV; Microphone; Location Services; Sensors; Media Library; Push Notifications; Web Browser Component; Add Ringtone; Place Phone Calls; Owner Identity; Phone Identity; Xbox LIVE; Interop Services; Networking; File Viewer; Appointments; Contacts; Debug; Networking Admin Additional WP8 capabilities capabilities for VxD

14 Windows Phone 8 Application security model Dynamic Build (LPC) WP8 chambers are built on the Windows security infrastructure TBC for the kernel LPC for all Apps OS components Drivers It reduces the attack surfaces

15 Internet Explorer 10 for Windows Phone Faster and safer browsing Run in the Least privilege sandbox One of the fastest HTML5 browsers Locked down and no plug-ins Real time anti-phishing protection with SmartScreen Filter

16 Device encryption Full internal storage encryption to protect information Build on Windows BitLocker architecture Encryption is available for all phones and is turned on with policy by IT professionals No user experience or pre-boot PIN entry All internal storage is encrypted Removable SD card not encrypted but can be managed

17 Information Rights Management (IRM) Helps prevent intellectual property from being leaked Protects s and documents on the phone from unauthorized distribution Easy to deploy on Exchange Server and SharePoint Active Directory Rights Management supports all your Mobile Information Management (MIM) needs

18 Security takeaways Secure boot turned on Security model for applications All binaries are signed Device encryption on Device access must be controlled!

19 Security is combination of Technology Process Users

20 Control access to device and applications Exchange ActiveSync with Exchange Server and Office 365 for and device management Widely used for mobile and access policy management App and device management with Mobile Device Management For app distribution and access policy management

21 EAS MDM Enterprise policies (NA) Simple password Alphanumeric password Minimum password length Minimum password complex characters Password expiration Password history Device wipe threshold Inactivity timeout IRM enabled Remote device wipe Device encryption (new) Disable removable storage card (new) Remote update of business apps (new) Remote or local un-enroll (new) + Reporting Server configured policy values Query installed enterprise app Device name Device ID OS platform type Firmware version OS version Device local time Processor type Device model Device manufacturer Device processor architecture Device language

22 Simplifying Management Across Platforms Devices & Platforms Single admin console Windows Intune

23 Enterprise Application Management Across Platforms App Hub IT organization 1. Registration 1. Device Enrollment 2. Signing Tools 3. Cert and Enterprise ID Registration 1. Enterprise registers with App Hub 2. Enterprise downloads app tools 3. Microsoft notifies CA of pending enterprise registration 4. CA checks that vetting is complete, and generates a certificate for enterprise 2. Get apps 1. Develop App 2. Package and sign 3. Private App Catalog 4. Create device Token Windows phone 8 supports multiple organizations tokens

24 Company Hub as private marketplace

25 Remediate Remote and local wipe Admin initiated or end user initiated Windowsphone.live.com (Demo) Windows update OTA only Application revocation Marketplace and enterprise apps

26 Robust security helps to protect information Secure boot Code signing App sandboxing Device encryption

27

28 5 6 7 MARCH 2013 Kinepolis Antwerp 3 days full of fascinating technical sessions for developers and IT professionals.

29 The information herein is for informational purposes only an represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.