Smartphone Insecurity

Smartphone Insecurity


Click to edit the outline text

•
Georgia
Click to Weidman
formatedit the outline text format

 Second Outline Level
Second Outline Level
−
− Third Outline Level
Third Outline Level

 Fourth Outline
Fourth Outline

Agenda


Smartphone Security Basics

Common Attack Vectors and Examples

Mitigation Strategies

Common vulnerabilities in 3rd party apps

Attack strategies against apps

Secure coding practices for developing apps


Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

What is a smartphone?



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

What’s on your phone


Personal info


Work info


Location info



Account info formatedit the outline text format

Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Do We Need Privacy? (SMS examples)


“Hi meet me for lunch”


“Meet me for lunch while my wife is out”


“Here is your bank account credentials”



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Attacks on Privacy (Infrastructure)

Cell Network



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline


? ? Cell Network

io n
p t
c ry
E n


Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Is GSM traffic encrypted?

SMSPDU:07914140540510F1040B915117344588F100
000121037140044A0AE8329BFD4697D9EC37



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Is GSM traffic encrypted?

Sending Number: 1-571-435-4881
Data: hellohello



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

2G(EDGE)

Bad crypto:

Up to the base station

Algorithms breakable



No authentication of base format
stations
Click to edit the outline text format



−
Third Outline Level

 Fourth Outline
Fourth Outline


Cell Network



Click to
Research by: Chris Pagent

−
Third Outline Level

 Fourth Outline
Fourth Outline

Breaking 2G Crypto

Break session key to get on the network

A5/2 trivial to break

Karsten Nohl broke A5/1 in 2009 in minutes



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Who cares about EDGE anyway?


Still deployed


By default phones will drop back to EDGE


Is anyone on EDGE right now?



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Mitigation Strategies


Replace 2G


Option to turn off 2G on phones


Encrypt data on phones before sending



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Attacks on Privacy (Platform)

=
Attackers know how to attack these platforms



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Rooting/Jailbreaking


Exploiting kernel/platform flaws


Client side attacks


Gain system level privileges similarly to PC platforms



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

JailbreakMe 3.0


iPhone jailbreak


Client side flaw in PDF (Mobile Safari)


Kernel exploit



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Rootstrap


Android app loads kernel exploits


Loads code dynamically


Runs native code



Packaged with interesting app formatedit the outline text format

Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

DroidDream


Android app in the market


Rooted phones via kernel exploits


Stole information



Ran up charges formatedit the outline text format

Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Payload example: SMS botnet



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

SMS PDU

SMSPDU:07914140540510F1040B915117344588F100
000121037140044A0AE8329BFD4697D9EC37



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

How the Botnet Works

1. Bot Receives a Message

3. Bot Decodes User Data

5. Checks for Bot Key


7. Performs Functionality formatedit the outline text format

Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

How the Botnet Works

1. Bot Receives a Message

3. Bot Decodes User Data

5. Checks for Bot Key (Swallows Message)


7. Performs Functionality formatedit the outline text format

Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Demo

Demo of Botnet Click to edit the outline text
Payload


Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Mitigations for Platform Attacks


Updating


Better sandboxing


Vigilance from users



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

App attacks on privacy



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

App Stores


iPhone

Expensive

Closed

Identity verified


Android

Cheap 

Self Signed 
Click to


Open
−
Third Outline Level

Anonymous Fourth Outline
Fourth Outline



Android Permission Model


Specifically request permissions


Users must accept at install


Send SMS, Receive SMS, GPS location



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

App attacks on privacy

Is this system working? Are users
making good decisions about
apps? Click to edit the outline text



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Top Android App of All Time



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Demo

Demo: App Abusing Permissions


Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

App Attacks Mitigations


Oversight on apps


Analysis of permissions


User awareness



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Vulnerabilities in Android Apps


No coding standards for Android apps


Badly coded apps


Data Leak



Permission Leak formatedit the outline text format

Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Data Leak


Access to sensitive data


Insecure storage

sdcard

World readable

Stored in source code



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Return to the Source


Free tools available


Complete source available


Don’t store secrets here



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Demo

DEMO: Abusing bad storage practices


Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Mitigating this risk


Store sensitive data privately


Don’t use the sdcard


Don’t put secrets in source code



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Permission leak through components


Other apps can call public components


That’s a reason Android is awesome


If not used safely, this can be dangerous



Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Demo

DEMO: Stealing permissions from exposed
components


Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Mitigating This Risk


Require permissions to access components


Use custom permissions


Don’t have dangerous functionality accessible without
user interaction


Click to

−
Third Outline Level

 Fourth Outline
Fourth Outline

Contact

Georgia Weidman
Security Consultant, Researcher, Trainer
Website: http://www.georgiaweidman.com
Slides: http://www.slideshare.net/georgiaweidman


Email:georgia@grmn00bs.com
Click to


Twitter: @georgiaweidman Outline Level

Second


−
Third Outline Level

 Fourth Outline
Fourth Outline

Smartphone Insecurity

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Empfohlen

Empfohlen (20)

Smartphone Insecurity

Hinweis der Redaktion