Security with Windows CE

Abusing Connections
I tried to bypass security when I connected my Windows CE unit to my NT workstation, but without success. I found that you can't connect a Windows CE device to an NT 4.0 workstation unless a user is already logged on to that desktop system and you have configured the Mobile Devices application to accept connections. And the username and password you use to connect Windows CE to the desktop system must be the same as the currently logged-on user's.

In my attempt to breach security, I configured my NT screen saver to require a password and activated the screen saver on the desktop. I also left the Mobile Devices application enabled for connections. With the NT screen saver active, I could connect a Windows CE device to the desktop, but I still had to know the username and password of the currently logged-on user. Determining which user is logged on to a given NT system isn't difficult if you have access to another machine on the network, but with access to another system, an attacker probably wouldn't need to use a Windows CE device to hack into your network.

Abusing the OS
Abusing Windows CE to gain network access is probably no less difficult than using NT or Win98. That is, to connect Windows CE to an NT-based network, you must provide a valid user account, a password, and relevant TCP/IP information, such as an IP address or a DHCP server. In my opinion, Windows CE presents no more of a risk to a network than NT or Win98 does.

In examining the Windows CE system, I found that, as with the older Windows for Workgroups (WFW), you can access the mobile device without entering a username or password. However, you can define a password so that when you power up the device, it prompts you for that password before you can access the system.

As for connecting to a desktop, Windows CE can cache usernames and passwords, which means an intruder could rummage through the system trying to glean such information. Windows CE will also save passwords for dial-up connections if you configure it to do so, just as NT and Win98. Consider not using the Save this Password feature, because it can lead to a compromised system or network if attackers get their hands on your mobile device.

Browsing Options
You can't browse the network (as you can with Network Neighborhood) with an out-of-the-box Windows CE system. Although the OS has a version of Windows Explorer, you won't find Network Neighborhood at your disposal. However, after you connect your mobile device to a desktop system, you can use Windows Explorer on the NT desktop to browse the resources on the Windows CE system.

Microsoft provides a Windows CE Network Client component, which lets independent software vendors (ISVs) write applications that return network browse lists and provide access to remote resources on systems that support the Common Internet File System (CIFS) protocol. However, when you load this component, don't assume that the Windows CE shell will support network browsing natively without custom programming.

The File System
Although I couldn't locate any technical details about the Windows CE file system, I did see that the OS doesn't offer any level of security. You can't define permissions that govern which users can access which files as you can with NT.

I assume that Microsoft based Windows CE's file system on the FAT file system, and although the FAT file system might seem unsafe, it's no different from any other standard FAT file system. In most cases, users don't share a mobile device, so the lack of file system security isn't much of a detriment.

Security Features for the Developer
Microsoft enabled Windows CE to support a variety of both wired and wireless communications, including infrared connections. The OS also supports Microsoft's CryptoAPI, Security Support Provider Interface (SSPI), Winsock, and WinInet API, and therefore can authenticate data links by using Password Au-thentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), and Microsoft CHAP (MSCHAP). Windows CE supports X.509-style certificates.

The WinInet API offers secure FTP and HTTP communications using SSL and PCT, and the same security applies for Winsock APIs. Winsock uses SSPI internally, which means you can access SSPI directly through API calls. Microsoft provides sample code for developers in its Windows CE Toolkit for Visual C++ (VC++) 5.0.

Third-Party Add-ons
I searched the Internet for security-related add-ons for Windows CE and found two encryption tools: Paragon Software's CryptoGrapher and AppStudio's PassKey. CryptoGrapher (http://pdahpc.paragon.ru/ products.htm) provides encryption for data stored on memory flashcards. PassKey (http://www.appstudio.com) stores sensitive information in an encrypted database.

I also found Epiphan Consulting's LinkSpy, a basic packet sniffer for Windows CE that is available at http://www.epiphan.com/vpnmon.htm. Epiphan also provides CEMon, a tool for monitoring file activity, such as DLLs. For the die-hard encryption fanatic, you can get BlowfishCE, which is the powerful Blowfish encryption algorithm for Windows CE, available at http://www.ceshopper.com. Two good sites for non-security-related Windows CE add-ons are http://www.cemonster.com and http://www.download.com.

The Bottom Line
Overall, Windows CE is a reasonably trustworthy OS that doesn't present much to the network for an intruder to attack. This OS also doesn't pose much risk to the network as a tool for staging attacks, because you can't run standard hacking tools on Windows CE (e.g., port scanners) unless they're specifically designed for Windows CE.

At the time of this writing, I couldn't find any port scanners or other hacking tools for Windows CE, except LinkSpy. Your biggest security concern with a Windows CE system is that thieves frequently steal mobile computers, so any information you store on such a device is vulnerable.

You need to establish an overall access password for your Windows CE system. (Go to Control Panel, Password.) With this password, if your mobile computer is stolen, the thief will probably have to perform a complete system reset to clear the access password. Fortunately, in most cases, this reset not only clears the access password but also erases all data on the system; this safeguard eliminates the thief's chance of accessing your information.