Development of a Secure Mobile GPS Tracking and Management System

DEVELOPMENT OF A SECURE MOBILE GPS TRACKING AND MANAGEMENT SYSTEM Anyi Liu, PhD George Mason University, 2011 Dissertation Director: Dr. Jim X. Chen With increasing demand of mobile devices and cloud computing, it becomes increasingly important to develop efficient mobile application and its secured backend, such as web applications and virtualization environment. This dissertation reports a systematic study of mobile application development and the security issues of its related backend. First, to standardize the software development of mobile application, we design an efficient mobile application that investigate the key issues of mobile application development, such as location tracking, embedded database management (EDBM), and wireless communication. Our application has been implemented and commercialized on Window Mobile smartphones. Second, to prevent SQL injection attacks (SQLIAs), we propose a black-box input validation approach, which harnesses the effectiveness of genetic and input validation algorithms to dynamically extract users’ inputs and detect malicious SQL control queries. Compared to state-of-the-art protection approaches, our method does not require any code changes on either the client, the web-server, or the back-end database. To evaluate the overhead and the detection performance of our system, we have implemented the SQLProb and tested it by using benchmark SQL attacks. Our experimental results show that we can detect all known SQL injection attacks while maintaining very low resource utilization. Third, to protect user’s private information from being exfiltrated to outside attacker, we propose a architectural solution to detect covert channels in real-time. Our intrusion detection system, namely Observer, runs a secure virtual machine that mimics the malicious virtual machine so that any differences between two virtual machines can be identified in real time. Unlike most existing signature or anomaly-based covert channel detection approaches, Observer does not require any legitimate data to build a normal behavior model. To evaluate Observer, we have run covert channels and detected them in real-time. Our experimental results demonstrate that Observer can detect most covert storage channels with a high detection rate and low latency and overhead. Lastly, to detect more advanced covert channel attacks, such as covert timing channels (CTCs), we design a novel metric that can quantitatively measure the difference between the timing patterns of normal and CTCs. The key challenge we are facing is to detect CTC online in a environment, where accurate time keeping might be affected by many dynamic conditions. Our wavelet-based metric can quantitatively measure the distance between the outbound networking flows of benign VMs and malicious VMs, which contains CTCs. In addition, this online approach reduces the whole procedure of modeling legitimate traffic while remains transparent to end-users. Our experimental result demonstrates a high detection and a low false positive rate in detecting different CTC attacks. Chapter 1: Introduction Tremendous attention has been put on the advances of computer hardware and software. On one hand, small and relatively inexpensive handhold devices such as personal digital assistants (PDA), tablet computers, and mobile phones have become indispensable tools for today’s highly mobile workforce. On the other hand, more and more personal and enterprise users have been focused on how to sweep up data and program from personal computer (PC) to a remote server or networked virtual environment [33]. Networked virtual environment refers to a computer networking environment that connects simulated computer environment, or virtual machine (VM), on the top of a given host hardware and software platform. Indeed, reports show that the number of virtual machines has exceeded that of physical servers since 2009 [79], and mobile internet users will eventually outnumber the desktop internet users in 2014 [94]. While the advances of both technologies improve productivity remarkably, it is critical to develop a framework that integrates mobile application, web application, and networked virtual environment together. The application should provide key functionalities specifically adapt to mobilized utilities, such as location tracking, data management, and wireless communication. In addition, the computational power and storage of the mobile application should be extendable when connect to web applications and a networked virtual environment. As this multi-level framework has been used, it also pose new risks to personal user and organizations. A shift of hacker’s target from PC to mobile devices, web application, and virtual machines has made attacks more sophisticated and more dangerous than ever [56]. In light of these challenges, current research efforts have been put on developing efficient mobile application and its secured backend, which includes the hardening of web applications and virtual machines. For mobile application development, many development 1 environments that allow a developer to write, test, and deploy applications into the target platform environment have been developed, such as Android [5], iOS SDK [73], and Windows Mobile [130]. For web application security, different categories approaches of detecting and preventing code-injection attacks have been developed, such as input validation [19,30, 45,54,99–101], static analysis [11,42,42,68,72,132], learning-based technologies [9,47,118], and dynamic prevention [11, 20, 88, 113]. For virtual machine security, most of the covert channel detection approaches assume that sufficient quantity of legitimate networking traffic is available to model the legitimate traffic patterns [12,13,21,39,40,71,92,104,122–124]. In this dissertation, we explore different issues of mobile application development and web and virtual machine security. Specifically, we address the key functionalities specifically adapt to mobilized utilities, such as location tracking, data management, and wireless communication. In addition, we address two challenging intrusion detection and prevention problems for web application and virtual machine security: 1) preventing code-injection attacks for web applications, and 2) detecting covert storage/timing channels in virtual machines. In Chapter 3, we study an input-validation approach to preventing SQL injection attacks. Our approach uses an input-validation proxy as an additional layer between web application and its database, and thus avoids the complication of static analysis and learning, and is highly adaptive to most existing web applications. In Chapter 4 and Chapter 5, we investigate the intrusion system design and detective metric development. With the observation that inside secrete can be transmitted the outside attacker once a vulnerable VM has been compromised, we emphasis on the outbound traffic of virtual machines. Compared to the unnoticeable deviation between legitimate traffic, a greater deviation can be measured between a benign VM and compromised VM that contains covert channel. In the consideration that virtual machine lacks precise time keeping mechanism, our matric is robust enough to detect covert channel even with the presence of noises.