Mobile hacking, pentest, and malware
•
11 likes•2,050 views
Nowadays, like the technology itself, hacking activities against mobile phone is growing very rapidly, both for mobile devices (operating system) or mobile applications, some applications providers even dedicate a penetration testing activity for applications that they created right before it gets released to the public, while others open a bug bounty programs, and sadly the rest just watch and do nothing. On the other side, malware developer arround the world also already move their main target and has been developing malware to take over the mobile devices which surely keep all our personal/private and our work, some of it even make us to pay for getting it back. This talks will be focusing more on the trend of mobile device security lately, mobile security penetration testing activity, also in practice, showing several types of common weaknesses/vulnerabiliies within the mobile applications and how the exploitation is done by the attacker, malware is created and planted, until it is successfully to take over the target mobile device.
![Mobile [hacking, pen-test, malware]
Ahmad Muammar OSCE, OSCP, eMAPT](https://image.slidesharecdn.com/mobilehackingpentestmalware-161013041334/85/Mobile-hacking-pentest-and-malware-1-320.jpg)
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Mobile hacking, pentest, and malware
Similar to Mobile hacking, pentest, and malware (20)
More from Ammar WK
More from Ammar WK (20)
Recently uploaded
Recently uploaded (20)
Mobile hacking, pentest, and malware
- 1. Mobile [hacking, pen-test, malware] Ahmad Muammar OSCE, OSCP, eMAPT
- 2. Ahmad Muammar WK Freelance IT Security Consultant/Pen-Tester Certification: OSCE, OSCP, eMAPT Founder echo.or.id (2003), ubuntulinux.or.id (2005), idsecconf.org (2008) http://me.ammar.web.id me@ammar.web.id @y3dips
- 3. Why Mobile?
- 4. Image taken from: http://www.wired.com/gadgetlab/2012/02/meet-the-asus-padfone-the-phone-thats-a-tablet-thats-a-notebook/
- 5. Mobile phone Image taken from: www.astanos.ch/img/apple-android-windows-mobile-blackberry-logo.png
- 7. Sophisticated, targeted mobile attack against high- value targets on iOS - Pegasus Malware by NGO
- 8. Sophisticated, targeted mobile attack against high- value targets on iOS - Pegasus Malware by NGO
- 9. Pegasus Exploit CVE-2016-4655: Information leak in Kernel – A kernel base mapping vulnerability that leaks information to the attacker allowing him to calculate the kernel’s location in memory. CVE-2016-4656: Kernel Memory corruption leads to Jailbreak – 32 and 64 bit iOS kernel-level vulnerabilities that allow the attacker to silently jailbreak the device and install surveillance software. CVE-2016-4657: Memory Corruption in Webkit – A vulnerability in the Safari WebKit that allows the attacker to compromise the device when the user clicks on a link.
- 10. Pegasus is developed by an American-owned NSO Group in Israel, which specialises in zero-days, obfuscation, encryption and kernel level exploitation. The attack sequence, boiled down, is a classic phishing scheme: send text message, open web browser, load page, exploit vulnerabilities, install persistent software to gather information. Pegasus Exploit
- 14. StageFright "Stagefright" is the nickname given to a potential exploit. vulnerability in libStageFright mechanism which helps Android process video files. http://www.androidcentral.com/stagefright
- 16. Mobile Pen-Test
- 17. M1. Weak Server Side Controls OWASP Top 10 M2. Insecure Data Storage M3. Insufficient Transport Layer Protection M4. Unintended Data Leakage M5. Poor Authorization and Authentication M6. Broken Cryptography M7. Client Side Injection M8. Security Decisions via Untrusted Inputs M9. Improper Session Handling M10. Lack of Binary Protections OWASP Mobile top 10 2014 - https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks
- 18. Mobile Pen-test What pen-tester “normally" doing is static analysis, dynamic analysis Static simply recompile, reversing, decrypt Dynamic simply run the apps and see apps behaviour, logs, db updates, etc.
- 19. SecureBox Apps “SecureBox: protect all your text using Login for every account.”
- 20. SecureBox Apps Pen-test Decompile Apps Using Apktool First, see AndroidManifest.xml !
- 22. SecureBox AndroidManifest Decompile Apps Using Apktool See AndroidManifest.xml if nothing wrong continue… We can try to access Activity Secure using Activity Manager tool
- 23. SecureBox Bypass $adb shell root@android:/#am start -a android.intent.action.S ecure -n inc.ammar.securebox/. Secure o/ w00t no passwd needed!
- 24. Mobile Malware
- 25. Inject valid Apps with MSF Create Metasploit APK Decompile Metasploit APK using Apktool Decompile Legitimate applications using Apktool Copy smali folder from Metasploit to smali folder in legitimate applications Find “correct place” to inject and invoke Metasploit project Recompile Applications Sign and verify.
- 30. Survive Anything that must truly remain private should not reside on the mobile device; Keep it on the server. Design mobile client and the server following security best practice. Design and implement all apps under the assumption that the users device will be lost or stolen. Include mobile security Pen-test/Audit in software development life cycle.
- 31. Image takern from: http://sciencetoybox.com/images/Procedures/Raising_hands.jpg
- 32. Mobile [Hacking, Pen-test, Malware] Thank you ;-) Ahmad Muammar OSCE, OSCP, eMAPT