S 5.81 Secure transmission of data over mobile phones

Initiation responsibility: Head of IT Section, IT Security Management

Implementation responsibility: IT Security Management, users

Mobile phones are normally used for voice transmissions, but data and faxes can also be transmitted using them. Some of these services require additional accessories.

Short messages

With the Short Message Service (SMS) it is possible to send out up to 160 characters of text from one mobile phone to another or to an e-mail address. Short messages are always transmitted via the SMS message centre, which forwards the messages to the appropriate recipient.

Short messages are stored in the mobile phone as long as there is sufficient free memory available. If all the available memory has been used up, no further short messages can be received. If there are further messages to be delivered, the network provider will reattempt to transmit them, but only for a limited period of time. If the required storage space does not become free within that time, the short messages will be deleted by the network provider.

It is sometimes also possible to alter the period for which short messages will be temporarily stored at the network provider's from the mobile phone. The default setting is normally between 24 and 48 hours. However, unless the contract with the network provider allows for this, the storage period cannot be extended by changing such a setting. It should also not be reduced.

In order to be able to send SMS messages, the call number of the SMS message centre (SMS Gateway) must be pre-configured on the mobile phone via the appropriate menu. Usually this is already preconfigured on the SIM card by the network provider.

A variety of services offered on the Internet allow SMS messages to be sent at minimal cost. It is possible in this way to send a large number of short messages to a mobile phone quite cheaply. The effects of SMS spam are similar to those of e-mail spam (see also T 5.75 Overload due to incoming e-mails). The spam messages use up the available space in the mailbox or in the memory of the mobile phone so that serious requests cannot get through. Receiving these spam messages also costs the user money (and could in fact be quite expensive). The only remedy is to limit distribution of one's own call number, e.g. to forego entry in telephone directories or in case of damage to do without SMS for an extended period.

It is not always possible to reliably identify the originator of an SMS message. At the most, identification will be based on the call number of the originator and, depending on the network provider and/or the configuration of the mobile phone, this is not always transmitted with the message. When short messages are sent over the Internet, generally there is no unique identification. This should be clear to all users so that they can correctly assess the genuineness of a message. Messages such as the following should not be taken seriously: "Due to reorganisation, we need your ec-PIN. Please send this to the specified call number. Your bank." Depending on the content of a short message received, it may be appropriate to make subsequent enquiries as to whether the originator really did send this message.

It is quite common for short messages to end up with the wrong recipient as an incorrect call number has been entered or the wrong entry has been selected from the telephone directory as the recipient. Even if mobile phone displays are small, the recipient details should still be checked prior to sending a message.

Faxes

It is also possible to send faxes to the landline network via SMS. Again, faxes can be received as long as they satisfy the restrictions of SMS transmissions, especially as regards containing only a short text. Faxes can also be sent and received using an IT system linked to the mobile phone (e.g. a notebook).

When using the fax capability, the points to be noted are similar to those which apply to conventional fax machines (see Section 8.2 Fax machines), namely:

• The memory of the mobile phone can become overloaded by incoming faxes.

• Depending on the importance of the faxes, it may be necessary to make copies of them, something which can be difficult with a mobile phone.

• It may be appropriate to block the call numbers of certain fax recipients and originators.

• It may be appropriate to enquire after sending a fax whether it arrived in legible fashion.

• It may be appropriate after receiving a fax to check whether it was really sent by the originator indicated.

• It may be appropriate to review the destination addresses programmed from time to time.

E-mail

Again, it is possible to receive and send e-mails over mobile phones as well as short messages. The permitted length of an e-mail is usually only 160 characters, as for short messages. When this service is configured by the network provider, the mobile phone is given its own e-mail address.

With some network providers, e-mail services can be combined with other services. Thus, for example, incoming e-mails can be read by voice output software, forwarded to a fax machine or to a different e-mail address. Outgoing e-mails can be spoken into the mobile phone and sent as an audio file (WAV file).

Like short messages and faxes, e-mails too can quickly exhaust the available memory space. Moreover, the contract with the network provider may specify that only a limited number of e-mails can be sent or received per month.

Potential security problems and safeguards to be adopted in connection with the use of e-mail are described in Section 7.4 E-mail. It should be noted here that the e-mail functionality offered on mobile phones is severely restricted compared with other e-mail applications. Like SMS, e-mail should be viewed here as primarily a means of transmitting short messages with a short life. It is not possible to implement security measures such as encryption or digital signatures (unless additional modules or special devices are used).

The boundaries between the various types of message such as SMS, fax and e-mail are relatively fluid. What distinguishes them as far as the user is concerned is generally not the type of data input but the transmission format. Here the network provider may also offer other formats such as X.400 or paging.

Data transmission

If the mobile phone is linked to another IT system (e.g. a notebook or organiser), it is also possible to transmit larger quantities of data. Coupling of the devices may be effected in a number of ways, depending on the technologies supported by the two devices.

Plug-in card. A plug-in card (PC card or PCMCIA) is the conventional solution for connecting mobile phone and notebook. However, most plug-in cards can only be connected to mobile phones of a particular manufacturer.

Soft modem. Under this solution, special software is installed on the notebook instead of a plug-in card. The mobile phone is then simply connected to the notebook over the serial interface. This solution is cheaper than a plug-in card.

Infra-red. With an infra-red interface, data can be transmitted from the mobile phone to an IT system (e.g. a laptop or organiser) without any cables. This requires that both the mobile phone and also the IT system support Infrared Data Association (IrDA). IrDA is a world-wide standard for data transmission by infra-red.

Bluetooth. Bluetooth is a more recent standard which enables devices to exchange data with each other over short distances by radio. The Bluetooth technology uses the freely available Industrial Scientific Medical (ISM) radio network, which operates in the 2.45 GHz band.

Where data is to be transmitted e.g. from a laptop over GSM, it should be encrypted on the terminal device prior to transmission. A number of programs are available for achieving this relatively simply. Encryption of the information prior to transmission protects it over the entire route between originator and recipient. This goes beyond protection of the radio interface between mobile phone and base station, as is standard with GSM. Moreover, the messages can then also be digitally signed. Section 3.7 Crypto concept describes how to select cryptographic procedures and systems that are suitable.

There are a number of sites on the Internet from where additional ring tones, display icons or similar can be downloaded for the various mobile phones. It should, however, be noted that loading such data can sometimes render a mobile phone inoperable.

Data transmission should be properly controlled in all organisations. All data transmission facilities should be approved and their use should be subject to clear rules (see also S 2.204 Prevention of insecure network access).

In order that no security loopholes are created through data transmission over GSM interfaces, these should be subject to restrictions. For example, no mobile phone cards should be permitted on IT systems on which sensitive data is handled. This applies also to all IT systems which are connected to a computer network, to ensure that it is not possible for the firewall protection to be undermined.