WM5 Security Queries

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance



Hi all,

Over the past couple of months, I have read almost everything there is for
the Security model in WM5. I realise this model was included on Smartphones
in the past but my app has been designed mainly for Pocket PCs and Pocket PC
Phone Editions (not Smartphones), and so this has been the first time I have
had to face security issues both for deployment and for general operation of
my app.

I have a Dell Axim X51v Pocket PC with WM5 and have been doing some testing
with my app on that model. As yet, I do not own a Pocket PC Phone Edition
device, like the i-mate JasJar, so in order to get my app working on these
type of devices, I have some queries (below). Also, I must add that I always
test on a real device and have never used an emulator for testing now for
nearly 3 years.

* From my knowledge and testing, I have found that if a device had a
security configuration of "Locked" or "Third-Party-Signed", RAPI was
blocked. I also learned that ActiveSync is also blocked so no synch'ing was
possible either. Is it true that if a device is Locked (RAPI blocked) by a
phone company that a user is unable to sync. anything via ActiveSync? If
that is the case, how is synch'ing of Contacts, Calendar etc. achieved?

* My app (presently VS2003-generated and un-signed) has a feature where I
can transfer data files (non-SQL nor XML) between a Pocket PC and a PC, and
vice versa. I depend on RAPI to get this working. My Dell Axim X51v has the
"One-Tier-Prompt" security configuration where RAPI is marked as Restricted
but the transfers both ways in my app are OK on that device. In planning
ahead, if my app was VS2005-generated for CF2, digitally signed and was
installed onto a Locked device (assuming it can be installed via AppMgr on
these Locked devices), is it still possible to transfer data files both ways
using RAPI, knowing that RAPI is blocked? If not, how is data file transfer
(both ways) possible on Locked devices?

* Is it true that ALL Pocket PCs with WM5 have a "One-Tier-Prompt" security
configuration?

* Is it true that ALL Smartphones with WM5 have a "Two-Tier-Prompt" security
configuration?

* Is it true that SOME Pocket PC Phone Editions have the "One-Tier-Prompt"
security configuration, like Pocket PCs but some others may be "Locked" by a
Phone company who sell these devices?


The reason for the last 3 questions is to give me an idea how some of these
devices are initially configured for consumer use. If my customers decide to
purchase any type of WM5 device, I need to know what default security
configuration to expect.


While I am gradually coming to grips with the Security model, the above
queries will help me to fill in some knowledge gaps. I eventually want my
app to be deployed successfully onto the widest possible number of WM5
devices for my customers.


Regards,
Neville Lang


.



Relevant Pages

  • Re: Interplatform (interprocess, interlanguage) communication
    ... If I'm using XML at all, and JAXB suits, I'll use JAXB. ... one can wonder though, what really would be the gain of using XML syntax in many such cases, vs the typical "relative niceness" of a line oriented format. ... typically I don't deal a whole lot with anything "security ... a 3rd party could somehow break the app and get control of the users' OS ...
    (comp.lang.java.programmer)
  • Re: Interplatform (interprocess, interlanguage) communication
    ... If I'm using XML at all, and JAXB suits, I'll use JAXB. ... typically I don't deal a whole lot with anything "security ... a 3rd party could somehow break the app and get control of the users' OS ... standards like the Java Secure Coding Guidelines, ...
    (comp.lang.java.programmer)
  • Re: Preview of changes to the Security susbystem for 2.6.36
    ... thanks for this explanation of why people don't want Yama as an LSM. ... "Since Yama has as a security model a container that is field with functionality of other security packages that have a security model but are no LSMs, then instead of making a new LSM like Yama the LSM architecture should be overworked to make the whole security packages and implicitly their security models LSMs." ...
    (Linux-Kernel)
  • Re: Security Exception when deploying a VB.NET 2003 Solution
    ... It runs fine on any workstation. ... folder 2 levels up from the BIN folder where the application resides. ... Microsoft .NET security errors upon trying to start the Executable. ... I bet the workstaion is WinXP and your app is trying to write data( ...
    (microsoft.public.vsnet.general)
  • [Full-disclosure] TWSL2011-008: Focus Stealing Vulnerability in Android
    ... Trustwave's SpiderLabs Security Advisory TWSL2011-008: ... Focus Stealing Vulnerability in Android ... the same app or a different app. ... This vulnerability has not been fixed at the time of this advisory. ...
    (Full-Disclosure)