3GPP TSG-T2 #7 / ETSI SMG4
Ystad, SWEDEN, 22-26 November 1999	TSGT2#7(99)949	

TSG-SA WG3 (Security) meeting #8	TSGS-WG3#8(99)449
Sophia Antipolis, 19th November 1999	

LIAISON STATEMENT

To:	3GPP TSG-T2 SWG1 (MExE)

Source:	3GPP TSG-S3 

Title:	MExE Release 99
_________________________________________________________________________

1 Introduction

This LS is response to the LS from T2 of the 4-6 October 1999 (Tdoc T2-99817), where the MExE group asks S3 for comments on the MExE security issues as described in 23.057 version 1.5.0.  These issues were discussed in a constructive way at the S3 meeting with appreciated assistance of the MExE chairman.

2 MExE security discussion summary

S3 appreciates the ambitious work which MExE group has put down in TS 23.057 and especially then the continued use of the requirement for users to explicitly approve of all downloaded applications and all actions these are able to perform. 

However concerns were raised relating to the following areas:

That applications could be downloaded that would set up bogus calls (combined with fake message on display) as untrusted applications can access screen and keyboard without user permission. (The provisioned facility mandated for call set up in the untrusted domain was explained not to make this possible though). 

Specifically it was questioned if it was necessary to allow call set up  for untrusted applications considering the low awareness normal users will show when asked to permit a proposed action.

That applications could be downloaded that would eavesdrop on keyboard entries.
This was believed to be a specific problem with untrusted applications interacting with trusted applications and could result in important security related data like PINs being picked up from keyboard and compromised.

The possibility to forbid untrusted applications to run at the same time as trusted applications was mentioned as a solution to some of the threats discussed and was found to have merits. This principle was not generally agreed though, as it was also found to be inconvenient for users.

That applications could be downloaded that would eavesdrop on voice via microphone (bugging). This was believed to be a risk through planted trojan horses also in “trusted applications” (under special circumstances)

The permissions relating to domains and actions (table 3) table is currently very complex.
It was felt that the status of actions not listed is uncertain and that a security table which lists forbidden actions only would be clearer and more likely to be implemented.

Should connections to external ports be forbidden? 
It would be difficult to manage permissions as it may not be known what is attached to the port
Agreed we have to  rely on user even if this will never be foolproof. 

The mechanism for designating the administrator role (figure 11) is currently very complex and open for misinterpretations.
and unreliable implementations.

3 Conclusions 
TSG S3 feels they can endorse the proposed R99 stage 2 specification relating to MExE security. However, continued investigations are recommended for areas mentioned above. 

4 Joint meetings

It was proposed by the MExE chairman that joint meetings should be arranged to further the MExE security issues. This was welcomed by S3 and a scheme with invitations from one group meeting to members of the other group, say three times per year was recommended.