1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T Series X TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU Supplement 25 (03/2016) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY ITU-T X.1231 Supplement on guidance to assist in countering spam for mobile p
2、hone developers ITU-T X-series Recommendations Supplement 25 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECT
3、ORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050
4、X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV sec
5、urity X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 PKI related Recommendations X.1340X.1349 CYBERSECURIT
6、Y INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X
7、.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For furth
8、er details, please refer to the list of ITU-T Recommendations. X series Supplement 25 (03/2016) i Supplement 25 to ITU-T X-series Recommendations ITU-T X.1231 Supplement on guidance to assist in countering spam for mobile phone developers Summary As mobile phones are widely used nowadays, malicious
9、attackers tend to send spam intentionally to mobile application users, which causes financial problems and creates privacy issues. This Supplement to Recommendation ITU-T X.1231 provides guidance to assist in countering spam for mobile phone developers. In addition, this Supplement describes the fol
10、lowing elements: Security threats of mobile phones with application level aspects; Guidance to assist in countering spam for mobile phone developers. History Edition Recommendation Approval Study Group Unique ID* 1.0 ITU-T X Suppl. 25 2016-03-23 17 11.1002/1000/12854 Keywords Countering spam, mobile
11、 phone developers, security threats. * To access the Recommendation, type the URL http:/handle.itu.int/ in the address field of your web browser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii X series Supplement 25 (03/2016) FOREWORD The Inter
12、national Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, op
13、erating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn,
14、 produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE I
15、n this publication, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this publication is voluntary. However, the publication may contain certain mandatory provisions (to ensure, e.g., intero
16、perability or applicability) and compliance with the publication is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that c
17、ompliance with the publication is required of any party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibility that the practice or implementation of this publication may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or
18、 applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the publication development process. As of the date of approval of this publication, ITU had not received notice of intellectual property, protected by patents, which may be required to imple
19、ment this publication. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2016 All rights reserved. No part of this publication may be reproduced, by any means
20、 whatsoever, without the prior written permission of ITU. X series Supplement 25 (03/2016) iii Table of Contents Page 1 Scope . 1 2 References . 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Supplement 1 4 Abbreviations and acronyms 1 5 Conventions 1 6 Introduction . 2 7
21、Security threats on countering spam in mobile phones 2 8 Guidance to assist in countering spam for mobile phone developers . 3 8.1 Countering spam in mobile phones by binary obfuscation 3 8.2 Countering spam in mobile phones by integrity checking . 3 8.3 Guidance to assist in countering spam for mob
22、ile phone developers 4 Bibliography. 5 X series Supplement 25 (03/2016) 1 Supplement 25 to ITU-T X-series Recommendations ITU-T X.1231 Supplement on guidance to assist in countering spam for mobile phone developers 1 Scope This Supplement defines guidance to assist in countering spam for mobile phon
23、e developers. It investigates various application level aspects of security threats on mobile phones and provides guidance to assist in countering spam for mobile phone developers. 2 References None. 3 Definitions 3.1 Terms defined elsewhere This Supplement uses the following terms defined elsewhere
24、: 3.1.1 short message service (SMS) b-ITU-T X.1231: Short message service refers to a kind of message service, which allows mobile phones, telephones and other short message entities to transfer and receive text messages through a device-named service centre implementing functions such as saving and
25、 delivering. 3.1.2 spam b-ITU-T X.1242: The electronic information delivered from senders to recipients by terminals such as computers, mobile phones, telephones, etc., which is usually unsolicited, unwanted, and harmful for recipients. 3.1.3 smartphone b-ITU-T X-Sup.19: A mobile phone with powerful
26、 computing capability, heterogeneous connectivity and advanced operating system providing a platform for third-party applications. 3.2 Terms defined in this Supplement This Supplement defines the following terms: 3.2.1 message operator: Message operator is an entity that receives a short message ser
27、vice from a sender and transfers the requested message to the corresponding receiver. 3.2.2 message sender: Message sender is an entity that sends a short message service to the corresponding receiver through the message operator. 3.2.3 message receiver: Message receiver is an entity that receives a
28、 short message service from the corresponding sender through the message operator. 4 Abbreviations and acronyms This Supplement uses the following abbreviations and acronyms: ID Identity SMS Short Message Service 5 Conventions None. 2 X series Supplement 25 (03/2016) 6 Introduction A mobile phone (i
29、.e., smartphone) is commonly widely utilized as a convenient way of sending messages (e.g., short message service (SMS). However, vulnerabilities of mobile phones also become a problem (e.g., data disclosure of mobile phone, financial harm). An attack to the mobile phone can cause an unwanted modifi
30、cation of the authorization code (e.g., injection of malicious codes), especially when installed applications within the mobile phones are being upgraded. Security issues should not only be considered inside the mobile phones but also on the network sides. In a message transfer scenario as illustrat
31、ed in Figure 6-1, a message sender sends a message to a message receiver through a message operator which transfers the received message to the message receiver. The message operator has the ability to filter spam (e.g., by using security mechanisms) during this message transfer. Figure 6-1 briefly
32、demonstrates the entities in this scenario of message transfer. Figure 6-1 Entities of message transfer in mobile phones Nowadays, encryption is executed within the application based on encryption library that can protect personal information. It is possible for malicious attackers to use encryption
33、 manner that is intended for bypassing filtering manner. The scope of this Supplement covers only a guidance to assist in countering spam for mobile phone developers. The term mobile phone developer in this Supplement indicates an application developer who develops software applications for mobile p
34、hones. Therefore, this Supplement only considers the perspective of applications. An operating system of mobile phone is also important in security, but it is not the scope of this Supplement. 7 Security threats on countering spam in mobile phones Figure 7-1 Scenario for security threats of message
35、transfer in mobile phones X series Supplement 25 (03/2016) 3 Figure 7-1 illustrates a scenario for security threat of message transfer in mobile phones. It is assumed that there are several message operators and message receivers (i.e., N message operators and N message receivers). It is also assume
36、d that there is only one message sender, and the message sender is connected to several message operators. Each message operator is connected with the corresponding message receivers. There is a malicious actor, who wants to attack the message sender that causes the security threat. In this case, ma
37、licious attack (e.g., injection of malicious code) can be executed by the malicious actor. In mobile phone environments, users are vulnerable to the Persona security concept. Persona is not related to a person but rather to an identity (ID) or a credit card. The Persona perspective can be a breakawa
38、y from the existing user access control concept and provide a different approach for authentication. However, mobile phones are also subject to other security threats faced at the application level, and at the network level; the latter issues are not addressed in this Supplement. From the perspectiv
39、e of applications, attacks can be produced by: a) reverse engineering; b) and repackaging. Two security threats of the application perspective in mobile phones are as follows. Disclosure of source code Reverse engineering of a mobile app can yield decompiled source code; this causes the security thr
40、eat where the source code becomes subject to disclosure. When the source code is disclosed, an application can be analysed. The disclosure of the source code yields the security risk whereby vulnerabilities (i.e., forgery, modification, disclosure of algorithms) become known and can be exploited. Fo
41、r instance, a disclosure of source code in financial applications can cause financial harm. Repackaging When the source code is disclosed, an identical application can be intentionally produced. This is called the repackaging problem. The repackaging problem causes a crack application, and it is one
42、 of the serious security threats in mobile phone environments. From b-McAfee Report, other functions (e.g., calling, installing other mobile app, SMS sending without permission) can be added during the repackaging. 8 Guidance to assist in countering spam for mobile phone developers In b-ITU-T X.1231
43、 it is mentioned that there is no single solution for countering spam. One of the feasible methods for countering spam is to mitigate hosts of spam. In b-McAfee Report, it is mentioned that 80% of the identical Flappy Bird application is malware. The identical application can send SMS or electric ma
44、il without user permission, and it causes the host of spam. This Supplement provides the following guidance to assist in countering spam for mobile phone developers. 8.1 Countering spam in mobile phones by binary obfuscation A binary obfuscation of the source code is a recommended method for mitigat
45、ing the disclosure of the source code. The binary obfuscation of the source code renders the unauthorized and dedicated modification of applications more difficult. 8.2 Countering spam in mobile phones by integrity checking A popular method for the prevention of repackaging is the usage of modificat
46、ion detection through an integrity check. In order to mitigate the repackaging problem, integrity checking of application is recommended to determine whether applications are modified. It is to construct an integrity checking 4 X series Supplement 25 (03/2016) system to identify whether the mobile a
47、pp is forged. The use of hashing is one of the integrity protection methods. 8.3 Guidance to assist in countering spam for mobile phone developers Countering spam can be provided by mapping of security threats and countering spam. Figure 8-1 illustrates the guidance to assist in countering spam for
48、mobile phone developers, in terms of life cycle for mobile phone development. Figure 8-1 Guidance to assist in countering spam in the life cycle for mobile phone development The life cycle for mobile phone development is composed of four phases (i.e., plan, design, coding, and implementation/mainten
49、ance/deployment). Among the four phases, the guidance to assist in countering spam for mobile phones is only related to implementation/maintenance/deployment phase. Plan The first phase of the life cycle for mobile phone development is a plan phase. In the plan phase of the life cycle for mobile phone development, mobile phone developers plan for designing mobile phone applications in the plan phase. Design In the design phase, mobile phone developers design the mobile phone applications t
