Security with Windows CE

Is this lightweight OS safe?

Handheld PCs (H/PCs) are popular for mobile computing, and one of the most prevalent OSs for H/PCs is Windows CE. At press time, Windows CE was in release version 3.0, and it seems to be a stable platform. However, before you integrate Windows CE-based H/PCs into your network, consider the security implications of this lightweight OS.

Windows CE is essentially a stripped-down version of Windows 98. The new OS's functionality and robustness don't measure up to Windows NT's or Win98's; but this OS is fairly secure.

Microsoft designed Windows CE to extend (not replace) a Windows-based desktop's capabilities. You can connect the OS to a Windows desktop to copy files and synchronize informational sources (e.g., Microsoft Outlook folders, databases) between a desktop and a mobile device. Windows CE lets you take files from your desktop and resynchronize the files with the desktop later. Microsoft provides a variety of applications for Windows CE with Pocket Office, which contains stripped-down versions of Microsoft Word, Excel, PowerPoint, Access, and Internet Explorer (IE).

Pocket IE (PIE) supports proxy servers, Secure Sockets Layer (SSL) 2.0, SSL 3.0, and Private Communications Technology (PCT). I found that I could turn support on or off for each secure protocol individually. On the downside, PIE doesn't support security zones for controlling Web-based content, as the full-blown IE package does; however, PIE gives you limited control over cookies and caching files to disk. With cookies, PIE uses a take-it-or-leave-it approach, which means you can't configure the browser to prompt you before it accepts cookies—you must set it to either accept them or not. As for caching Web files, PIE lets you adjust only how much memory it uses to cache files and whether PIE deletes the files when you exit the Web browser. No option exists to tell PIE not to cache secured Web pages such as those you access using SSL. PIE doesn't support Java and other clientside ActiveX scripting technologies, so these technologies don't pose a security risk.

How Does Windows CE Connect?
You can connect a Windows CE device to a network with direct Ethernet connections, direct COM port connections, and dial-up connections that employ a modem. No matter how you connect your Windows CE device to a network, you'll probably need to supply a username, a password, and an NT domain name if you're authenticating against a domain controller. You don't need to provide a password for connections if your account doesn't require a password—but you must never have an account enabled without a defined password.

Ethernet Connections
With Ethernet connections, Windows CE operates similarly to any NT or Win98 system running a Microsoft TCP/IP stack. The OS supports a variety of PC Ethernet cards and uses an associated driver to communicate on a TCP/IP network. The user must define a DHCP server or a static IP address and a subnet mask, and the appropriate DNS server addresses. The Windows CE TCP/IP stack also supports WINS servers. You use a regular Ethernet cable to connect the system to the network. After you correctly configure the device, you can use an Ethernet connection to a supporting desktop to synchronize or copy data.

Direct COM Port Connections
With direct COM port connections, Windows CE relies on supporting soft-ware that you install on a workstation. I tested Windows CE on an NEC MobilePro 800 hand-held device running against an NT 4.0 workstation. Before I connected the hand-held device to the NT desktop, I had to load Microsoft's Mobile Devices software, which lets you connect Windows CE to the NT desktop. The Mobile Devices software relies on Microsoft's Remote Access Connection Manager to assist in the connectivity, so you must have RAS loaded on the workstation, which presents a security problem. Because you must load RAS, you must also secure RAS. I don't use RAS on my workstations, so I simply disabled the Windows CE RAS component to ensure it never answers an inbound call on my modem line.

If you use RAS for non-Windows CE purposes, be certain to adjust the settings to meet company or personal guidelines for security. For example, you can enable the RAS callback feature, set users' dial-up access permissions, define which COM ports will answer or allow outbound calls, set an encryption level, and configure any protocols your RAS installation supports.

With RAS configured, I configured the Mobile Devices application with my preferences. This configuration involved setting various communications properties, as Screen 1 shows.

In this dialog box, I could enable or disable mobile device connections, set the necessary COM port parameters for direct COM port connections, and enable or disable Ethernet-based connections. If you know you'll always connect your mobile device directly via a COM port on your local desktop, be certain that you disable the network connections so that an intruder can't hack your system over the Ethernet with a rogue Windows CE system.

Dial-up Connections
For dial-up connections, Windows CE operates almost identically to other Windows OSs. For example, to configure Windows CE to connect to my Internet dial-up account, from the Start menu, I selected Programs, Communication, Dial-up Networking. With the Dial-up Networking dialog box open, I se-lected Make New Connection. A wizard appeared that let me choose Dial-up Connection as the connection type, and then configure the usual TCP/IP parameters (e.g., IP address, DNS servers, Point-to-Point Protocol—PPP, or Serial Line Internet Protocol—SLIP) exactly as I would when using NT or Win98. From this point, I easily connected to the Internet by clicking the newly created connection icon.

Abusing Connections
I tried to bypass security when I connected my Windows CE unit to my NT workstation, but without success. I found that you can't connect a Windows CE device to an NT 4.0 workstation unless a user is already logged on to that desktop system and you have configured the Mobile Devices application to accept connections. And the username and password you use to connect Windows CE to the desktop system must be the same as the currently logged-on user's.

In my attempt to breach security, I configured my NT screen saver to require a password and activated the screen saver on the desktop. I also left the Mobile Devices application enabled for connections. With the NT screen saver active, I could connect a Windows CE device to the desktop, but I still had to know the username and password of the currently logged-on user. Determining which user is logged on to a given NT system isn't difficult if you have access to another machine on the network, but with access to another system, an attacker probably wouldn't need to use a Windows CE device to hack into your network.

Abusing the OS
Abusing Windows CE to gain network access is probably no less difficult than using NT or Win98. That is, to connect Windows CE to an NT-based network, you must provide a valid user account, a password, and relevant TCP/IP information, such as an IP address or a DHCP server. In my opinion, Windows CE presents no more of a risk to a network than NT or Win98 does.

In examining the Windows CE system, I found that, as with the older Windows for Workgroups (WFW), you can access the mobile device without entering a username or password. However, you can define a password so that when you power up the device, it prompts you for that password before you can access the system.

As for connecting to a desktop, Windows CE can cache usernames and passwords, which means an intruder could rummage through the system trying to glean such information. Windows CE will also save passwords for dial-up connections if you configure it to do so, just as NT and Win98. Consider not using the Save this Password feature, because it can lead to a compromised system or network if attackers get their hands on your mobile device.

Browsing Options
You can't browse the network (as you can with Network Neighborhood) with an out-of-the-box Windows CE system. Although the OS has a version of Windows Explorer, you won't find Network Neighborhood at your disposal. However, after you connect your mobile device to a desktop system, you can use Windows Explorer on the NT desktop to browse the resources on the Windows CE system.

Microsoft provides a Windows CE Network Client component, which lets independent software vendors (ISVs) write applications that return network browse lists and provide access to remote resources on systems that support the Common Internet File System (CIFS) protocol. However, when you load this component, don't assume that the Windows CE shell will support network browsing natively without custom programming.

The File System
Although I couldn't locate any technical details about the Windows CE file system, I did see that the OS doesn't offer any level of security. You can't define permissions that govern which users can access which files as you can with NT.

I assume that Microsoft based Windows CE's file system on the FAT file system, and although the FAT file system might seem unsafe, it's no different from any other standard FAT file system. In most cases, users don't share a mobile device, so the lack of file system security isn't much of a detriment.

Security Features for the Developer
Microsoft enabled Windows CE to support a variety of both wired and wireless communications, including infrared connections. The OS also supports Microsoft's CryptoAPI, Security Support Provider Interface (SSPI), Winsock, and WinInet API, and therefore can authenticate data links by using Password Au-thentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), and Microsoft CHAP (MSCHAP). Windows CE supports X.509-style certificates.

The WinInet API offers secure FTP and HTTP communications using SSL and PCT, and the same security applies for Winsock APIs. Winsock uses SSPI internally, which means you can access SSPI directly through API calls. Microsoft provides sample code for developers in its Windows CE Toolkit for Visual C++ (VC++) 5.0.

Third-Party Add-ons
I searched the Internet for security-related add-ons for Windows CE and found two encryption tools: Paragon Software's CryptoGrapher and AppStudio's PassKey. CryptoGrapher (http://pdahpc.paragon.ru/ products.htm) provides encryption for data stored on memory flashcards. PassKey (http://www.appstudio.com) stores sensitive information in an encrypted database.

I also found Epiphan Consulting's LinkSpy, a basic packet sniffer for Windows CE that is available at http://www.epiphan.com/vpnmon.htm. Epiphan also provides CEMon, a tool for monitoring file activity, such as DLLs. For the die-hard encryption fanatic, you can get BlowfishCE, which is the powerful Blowfish encryption algorithm for Windows CE, available at http://www.ceshopper.com. Two good sites for non-security-related Windows CE add-ons are http://www.cemonster.com and http://www.download.com.

The Bottom Line
Overall, Windows CE is a reasonably trustworthy OS that doesn't present much to the network for an intruder to attack. This OS also doesn't pose much risk to the network as a tool for staging attacks, because you can't run standard hacking tools on Windows CE (e.g., port scanners) unless they're specifically designed for Windows CE.

At the time of this writing, I couldn't find any port scanners or other hacking tools for Windows CE, except LinkSpy. Your biggest security concern with a Windows CE system is that thieves frequently steal mobile computers, so any information you store on such a device is vulnerable.

You need to establish an overall access password for your Windows CE system. (Go to Control Panel, Password.) With this password, if your mobile computer is stolen, the thief will probably have to perform a complete system reset to clear the access password. Fortunately, in most cases, this reset not only clears the access password but also erases all data on the system; this safeguard eliminates the thief's chance of accessing your information.