New Security Threat Against
GPS feature is not only in GPS device for car anymore, Most smartphones today have GPS capabilities built in and have a new feature “geolocation services” or “location service” for new smartphone location-aware application including social network application such as facebook, twitter, foursquare and google latitude. The location service provides the latitude, longitude, speed, direction, and altitude of your phone to requesting applications. Even if mobile geolocation services have supported several useful and convenient mobile applications, these services also raise the potential security risks to the users. Like any tracking technology, geolocation service can make the application more personalized, but this personalization is attractive to both law enforcement and malicious parties. So, by enabling geolocation service on user’s smartphone, it would result in security and privacy issue to the users.
For any smartphone, if geolocation or location services are activated on the smartphone (unfortunately, many smartphones unsecured by default) , the current and historical physical user location will be continuously tracked and mobile phone makers also create a database that identifies and record the location of mobile cell towers and Wi-Fi access points. Then, these data can be used to identify an approximate location of the user’s device by comparing the mobile cell tower and Wi-Fi access points that a user’s device is connecting to the data recorded in location database. This data is also used by other “Location-Aware Applications” on user’s smartphone. Location-aware applications are growing rapidly in number and variety for smartphone devices that are GPS-enabled. These applications will continue to evolve rapidly to address consumer needs. If users allow specific location aware application to access their location data, it can connects with location services and use the user’s current location status to customizes content and behavior of Location-Aware application on Smartphone device. Please be careful when using social network location sharing to “post” your whereabouts online or whenever you “check-in” to a location by using location-aware application such as foursquare. The good things about location services is tracking feature , you can track, lock or wipe your lost/stolen smartphone, for example you can use “find my iphone” free software to find your lost/stolen iphone/ipad.
Rootkit attacks (by hackers) on smartphones or upcoming tablet computers could be more devastating because smartphone owners tend to carry their phones with them all the time. This creates opportunities for potential attackers to eavesdrop, extract personal information from phone directories, or just pinpoint a user’s whereabouts by querying smartphone’s Global Positioning System (GPS) receiver. This would enable an attacker to track the owner’s whereabouts. Finally, they showed a rootkit turning on power-hungry capabilities, such as the Bluetooth radio and GPS receiver to quickly drain the battery. An owner expecting remaining battery life would instead find the phone dead. Smartphones also have new ways for malware to enter the system, such as through a Bluetooth radio channel or via text message.
A safety warning to users of smartphones that have GPS/Location Services. Pictures you’ve emailed or uploaded to the web with a Smartphone can leak location information threatening the safety of your children and you. Hackers and strangers can track down your home, place of work or school with a click of the mouse and with free browser add-ons that translate data into maps.
The solution is very simple, as the location-aware application on GPS-enabled smartphone intends to deliver a better user experience by customized content based on user’s location, the smartphone owners can still choose to disable (turn off) it if required or concerned about security and privacy issues.
The information below is a quick guide to disable location services completely on your smartphones.
iPhone/iPad:
1. Tab on Settings
2. Tab on General
3. Tab on “Location Services”
4. Select the On/Off switch on “Location Services” or On/Off switch on each application
BlackBerry:
1. Click on Options
2. Clicks on Device
3. Click on Location Settings
4. Select Location Off/ On on “Location Services”
Android:
1. Tab on Settings
2. Tab on Location
3. Uncheck “Use Wireless networks” or “Use GPS satellites”
Windows Phone 7:
1. From Start, click left to the App list, and then taps Settings.
2. Tap Location and then turn off Location services.
Symbian:
1. Select “Menu”
2. Select Options
3. Select “Disable My Location”
Once location service is disabled on smartphone, no location data will be recorded, maintained and transmitted. So, none of location-aware application will be able to customize content based on user’s location data
Digital cameras with GPS-enabled functions also a concern
Cameras with a GPS function record location information in both images and movies. Most give you the option to turn the function on and off via a settings menu. When a camera is turned off, it continues to receive a signal from GPS satellite for a time, and will record the route taken. The information is typically recorded in a GPS log file, not in image files. If you do not wish to record a GPS log file, set it to off. Check your camera manual for complete instructions.
How Exchangeable Image File Format (EXIF) is a Security Threat
Exchangeable image file format (EXIF) is a standard that specifies the formats for images, sound, and ancillary tags used by digital cameras (including smartphones), scanners and other systems handling image and sound files recorded by digital cameras
The EXIF format has standard tags for location information.Currently, a few cameras and some higher-end mobile phones have a built-in GPS receiver and store the location information in the EXIF header when the picture is taken. Some other cameras have a separate GPS receiver that fits into the flash connector or hot shoe. Recorded GPS data can also be added to any digital photograph on a computer, either by correlating the time stamps of the photographs with a GPS record from a hand-held GPS receiver or manually using a map or mapping software. The process of adding geographic information to a photograph is known as geocoding. Photo sharing communities like Panoramio, locr or Flickr equally allow their users to upload geocoded pictures or to add geolocation information online.
Digital cameras are everywhere today, whether they are standalone or built into cellular telephones. 9 out of 10 people today have some sort of digital camera with them at all times; mainly because most cell phones today have them built-in. The explosion of social networking sites like MySpace, Facebook, and Twitter have created an easy and convenient avenue for individuals to share their pictures with friends and family. Social networking sites have proved to be invaluable business tools but have also been identified as a security risk. The same goes for Exchangeable Image File Format (EXIF). EXIF is metadata that is stored inside a digital image. In other words, EXIF embeds information about the digital image inside the file.
Most digital cameras capture EXIF information which usually consists of the date/time, ISO speed, whether or not a flash was utilized, focal length, etc… It is important to note that EXIF can contain hundreds of lines of information. If the camera has Global Positioning System (GPS) capability, mainly seen in Smartphones such as the iPhone, Blackberry, and Android, the EXIF will capture the GPS coordinates when the photo was taken. Many refer to this information as “geotagging”. Geotagging information found in EXIF data which is uploaded to social networking sites may pose a significant security threat.