GPS Fleet Tracking - Risks or Benefits?

GPS Fleet Tracking is usually associated with taxi fleets, armored transport and police/security vehicles. In reality, a lot of companies use GPS tracking not just for their company fleet, but also for personal tracking of their top employees or sensitive equipment. And GPS itself brings a whole new challenges to information security.

The Functionality
The Global Positioning System (GPS) is a Global Navigation Satellite System developed by the United States Department of Defense. It uses a constellation of between 24 and 32 Medium Earth Orbit satellites that transmit precise microwave signals, that enable GPS receivers to determine their current location, the time, and their velocity (including direction).

The GPS Fleet Tracking uses a GPS receiver paired with a radio transmitter. The GPS receiver determines it's location, direction and velocity and transmits this information to a central monitoring system via the radio transmitter. The radio transmitter part is most frequently a GSM mobile phone device which transmits the data via GSM Data or GPRS data capability as TCP/IP packets.
The central monitoring system is a server that receives the packets sent by the GPS tracking devices, stores them in a database and presents them as an overlay on a map.

The following diagram presents the overall system:

  1. The GPS receiver contacts the GPS satellites and calculates it's position, velocity and direction. At any given time, the GPS receiver has at least 3 satellites over the horizon to contact
  2. The GPS tracking device sends the calculated information via the GPRS data link to the information hub
  3. The information hub relays the received information to the GPS Tracking server
  4. The user uses the monitoring station to follow the fleet or to review the information about any vehicle stored in the database.
BrickHouse Security has a very comprehensive selection of GPS Fleet Tracking solutions.

The Business Benefits
There are well known business benefits of using a Fleet Tracking system. Here are several:
  1. Tracked vehicles are used much more responsibly and only for the intended purpose (no detours to buy groceries, or weekend trips to the lake).
  2. Because they are used for the planned purpose, the fuel usage is much more optimal.
  3. Ability to observe employee vehicle usage to establish their responsibility towards company assets.
The Physical Security Benefits
Apart from a clearly business perspective, GPS Tracking has security benefits
  1. GPS Fleet Tracking enables stolen vehicles to be recovered very fast.
  2. Paired with a panic button, it can be used for tracking and helping kidnapped or blackmailed key personnel (the chief officers and other key employees can be equipped with such GPS Tracking device)
  3. Valuable or sensitive equipment or assets can be observed during transport to identify situations where the asset has deviated or been delayed in transport - a major indication of attempt at tampering or theft

The open and sensitive questions
Naturally, every new system brings new challenges for information security. Here are the most common ones connected to GPS tracking:
  • How do you secure your GPS tracking database - the GPS tracking data is sensitive to say the least. Anyone stealing that data can analyze the travel patterns of each vehicle and subject tracked and plan a possible theft or crime. Also, the GPS tracking data will identify the 'blind spots' where tracking is impossible, like tunnels, parking structures, even streets with train tracks above them - which are first choice for theft.
  • How do access the GPS tracking data? - if one cannot steal the information from the database, it can be stolen in transit. If the monitoring station and the servers are at a distance from each other, always use an encrypted channel to access this information.
  • Do you inform your employees of GPS Tracking systems? - Informing the employees that their vehicles are tracked is a double edged sword: If you do inform them, they should be more careful, but on the other hand some of them will go to great lengths to destroy the GPS device so they can go about their way as they used to. If you don't inform them, you can end up in court for a number of infractions - depending on the judicial system
  • Do you control against rogue GPS devices - just as you use GPS for a legitimate function, a criminal may use a rogue GPS device to simply collect information off your vehicles. There isn't a very easy to find such devices once they are planted, but it is much easier to control the access to the relevant vehicles to prevent a criminal from approaching them for a time that will enable him to plant the rogue device.
The GPS Fleet Tracking systems are very useful systems, and can enable the company to achieve considerable savings to their fleet management, as well as provide additional security leverage for personal and asset safety.

But at the same time, it introduces a new system with it's own IT and communications requirements, and another repository of highly confidential data.

So any company implementing a GPS Fleet Tracking system should clearly define its objectives and requirements, and seek out a professional integrator to deliver the entire solution, always bearing in mind that the solution must be both functional and secure.

Talkback and comments are most welcome

Controlling Firefox Through Active Directory

Firefox is a great browser. But it is being widely avoided by corporations, since it is difficult to manage Firefox through a corporate-wide security policy, like IE through Active Directory.

FrontMotion has published FrontMotion Firefox Community Edition - a Firefox with the ability to lockdown settings through Active Directory using Administrative Templates. The concept is interesting, but how well does it work?

Here is a review of the FrontMotion solution for Firefox and Active Directory Integration

The Test
FrontMotion has prepared an MSI package of Firefox, with several modifications to enable group policy integration, as well as the administrative templates for Firefox.
Download the administrative templates (firefox.adm and mozilla.adm) and add them to your Group Policy Editor.

You get the following configuration parameters in the Group Policy - Administrative Templates for both under user and computer configuration can configure the following elements in the Firefox Section

  • General Settings - centraly configure and enforce Home Page setting for the Firefox users/computers
  • Enable Automatic Image Resizing - self-explanatory
  • Disable Firefox Default Browser Check - self-explanatory
  • Cache - setting cache size and path
  • Set Default Download Location - downloads path setting
  • Proxy Settings - centrally configure and enforce proxy setting for the Firefox users/computers
  • Disable XPI Installs - block installing of Moziila extensions
A configured policy is presented on the following image.

Upon testing, we installed the Firefox Community Edition and applied the configured policy.

When we ran Firefox and tried to change the proxy, we were unable to, as can be seen on the image below.

It can be confirmed that the overall Active Directory Group policy functions well. However, the number of configurable parameters for Firefox is very small, especially compared to the flexibility provided by Microsoft for Internet Explorer

Integrating Firefox into Active Directory is a great progress. But the current level of the solution makes it more of a curiosity, since it will change it's functionality with every new build from FrontMotion. If Active Directory integration is merged into the main Firefox development track and properly developed, for instance for Firefox 3.2, it will be a great step for Mozilla against Microsoft.
Once corporations are confident that Active Directory support is properly adopted into the generic Firefox and is there to stay, I know a lot of administrators that will happily phase out Internet Explorer for Firefox.

Talkback and comments are most welcome

Related posts
TrueCrypt Full Disk Encryption Review

Protecting from Meddling Web Applications

The current trend of web2.0 (or AJAX) is to abstract all processing from the local computer resources and just present the final 'drawing' of the web application, which contains only forms or lightweight widgets that pose very low security threat. However there are a lot of software companies that are still sticking to some old school (read outdated and insecure) programming technologies for web applications, that can leave your security cracked wide open.

So, how do you protect from web applications that wish to meddle with your computer.

Example scenario:

A vehicle service company has created an online ticketing system for fast problem reporting and resolution. A rent-a-car company which uses the vehicle service needs to use the application for logging of faults to their fleet. At first use, the web application does not work on any computer at the rent-a-car company. After some analysis, the security administrator concludes that the web application requires to install an ActiveX control on the client PCs in order to work - a function explicitly denied by the security policy.
Since business comes before security, the rent-a-car managers decide that everything must be done in order for the service web application to work properly. Thus, the ActiveX control is set as trusted and everything is fine.

Two months later, the service company ticketing web server crashes. At the same time, during regular fleet inventory, the rent-a-car company concludes that 17 luxury rentals are missing and have not been seen for at least a week. The GPS locators of the cars are found at an abandoned parking structure connected to a car battery.

Suspecting the system administrators are in on the theft, the police brings in forensic teams that sift the system for incriminating evidence. They discover none, but find a trojan horse that tampers with database records in the ActiveX control downloaded from the web server of the vehicle service company.The vehicle service company is contacted for investigation and it is concluded that the web server is formatted. It crashed due to corruption of several system files on the web server on the day when the 17 cars went missing. The manufacturer of the Web Ticketing application is also contacted and his ActiveX control is analyzed. The original ActiveX control does not contain any foul play code.

After the incident, the rent-a-car company files a damages suit against the service company, and the vehicle service company fires the administrator for gross negligence.

The entire chain of events in this scenario is a simple case of non-core competence comedy of errors:
  1. Both companies have a completely non-IT core business, and as such are most likely to use the cheapest product on the market, as long as it works.
  2. Their security awareness is an afterthought.The rent-a-car company trusted a foreign application and installed it on their computers.
  3. The foreign application was downloaded from the Internet, and there was no way to confirm that the application is unmodified.
  4. At the same time, the vehicle service company hosted a web application using their resources without proper knowledge and implementation of security
  5. ActiveX as a technology is risky - it has no technological security - it just relies on the user's permission to trust and install itself. After that the applications have unrestricted access to anything the user has access to - even hardware (keyboard, disk drives, network...)
Conclusion and Recommendations:
There are simple and effective strategic steps to alleviate the risks of this scenario

If you are in a role similar to the vehicle service provider
  1. Focus on core competence and outsource the application hosting to a reputable IT hosting company
  2. When purchasing applications - add a functional requirement for minimal interference to the client side systems
  3. Request a periodical reporting on security of the hosted application from an independent source (auditor)
  4. Request that all code and information transferred via the internet to be signed by an code signing certificate issued from a trusted issuer.
If you are in a role similar to the rent-a-car company
  1. Have a strict security policy and don't allow foreign code within your network (create isolated tunnels, separate isolated stations or similar level of isolation)
  2. Request a periodical reporting on security of the hosted application from an independent source (auditor)
  3. Request that all code and information transferred via the internet to be signed by an code signing certificate issued from a trusted issuer

Talkback and comments are most welcome

Related posts

Information Risks when Branching Software Versions

3 rules to keep attention to detail in Software Development

8 Golden Rules of Change Management

Application security - too much function brings problems

Security risks and measures in software development

Security challenges in software development

Designed by Posicionamiento Web