Make Mobilization Work - Properly Implementing Mobile Security
0 likes1,097 views
The document presents a session by Michael A. Davis on mobility in the workplace, discussing the rise of mobile device usage, security challenges associated with BYOD, and the need for effective management solutions. It highlights the various risks mobile devices face, including data interception, unauthorized activity, and insufficient security measures, and provides strategies for mitigating these risks. The session emphasizes forming a cross-functional mobility council and adopting comprehensive mobile device management (MDM) policies to ensure security and compliance in a multi-platform environment.
![MIS Training Institute Session # - Slide 21
© Savid Technologies
Logic or Time bomb [CWE-511]
Logic or time bombs are classic backdoor techniques that
trigger malicious activity based on a specific event, device
usage or time.](https://image.slidesharecdn.com/ss12makemobilizaitonwork-130728191830-phpapp02/85/Make-Mobilization-Work-Properly-Implementing-Mobile-Security-21-320.jpg)
![MIS Training Institute Session # - Slide 22
© Savid Technologies
Sensitive data leakage [CWE-200]
Sensitive data leakage can be either inadvertent or side channel.
A legitimate apps usage of device information and authentication credentials can be
poorly implemented thereby exposing this sensitive data to 3rd parties.
– Location
– Owner ID info: name, number, device ID
– Authentication credentials
– Authorization tokens
Example:
Sensitive data leakage -Storm8 Phone Number Farming
http://www.boingboing.net/2009/11/05/iphone-game-dev-accu.html
Android “DroidDream” Trojans steal data
http://www.androidpolice.com/2011/03/01/the-mother-of-all-android-malware-has-
arrived-stolen-apps-released-to-the-market-that-root-your-phone-steal-your-data-and-
open-backdoor](https://image.slidesharecdn.com/ss12makemobilizaitonwork-130728191830-phpapp02/85/Make-Mobilization-Work-Properly-Implementing-Mobile-Security-22-320.jpg)
![MIS Training Institute Session # - Slide 23
© Savid Technologies
Unsafe sensitive data storage [CWE-312]
Mobile apps often store sensitive data such as banking and payment system PIN
numbers, credit card numbers, or online service passwords.
Sensitive data should always be stored encrypted so that attackers cannot simply
retrieve this data off of the file system.
It should be noted that storing sensitive data without encryption on removable media
such as a micro SD card is especially risky.
Examples:
Citibank insecure storage of sensitive data
http://www.pcworld.com/businesscenter/article/201994/citi_iphone_app_flaw_raises_que
stions_of_mobile_security.html
Wells Fargo Mobile application 1.1 for Android stores a username and password, along
with account balances, in clear text.
http://osvdb.org/show/osvdb/69217](https://image.slidesharecdn.com/ss12makemobilizaitonwork-130728191830-phpapp02/85/Make-Mobilization-Work-Properly-Implementing-Mobile-Security-23-320.jpg)
![MIS Training Institute Session # - Slide 24
© Savid Technologies
Unsafe sensitive data transmission [CWE-319]
It is important that sensitive data is encrypted in transmission lest it be
eavesdropped by attackers.
Mobile devices are especially susceptible because they use wireless
communications exclusively and often public WiFi, which is known to be
insecure.
SSL is one of the best ways to secure sensitive data in transit.
Beware of downgrade attack if it allows degrading HTTPS to HTTP.
Beware of not failing on invalid certificates. This would enable that a
man-in-the-middle attack.](https://image.slidesharecdn.com/ss12makemobilizaitonwork-130728191830-phpapp02/85/Make-Mobilization-Work-Properly-Implementing-Mobile-Security-24-320.jpg)
![MIS Training Institute Session # - Slide 25
© Savid Technologies
Hardcoded password/keys [CWE-798]
The use of hardcoded passwords or keys is sometimes used as a shortcut
by developers to make the application easier to implement, support, or
debug.
Once this hardcoded password is discovered through reverse engineering it
renders the security of the application or the systems it authenticates to
with this password ineffective.
Example:
Mastercard sample code:
http://jack-mannino.blogspot.com/2011/02/scary-scary-mobile-banking.html
final String companyId = "your-company-id-here";
final String companyPassword = "your-company-password-
here";](https://image.slidesharecdn.com/ss12makemobilizaitonwork-130728191830-phpapp02/85/Make-Mobilization-Work-Properly-Implementing-Mobile-Security-25-320.jpg)
Make Mobilization Work - Properly Implementing Mobile Security
- 1. How to Make Mobilization Work Session # Monday, April 23rd, 2012 12:45-1:45PM Michael A. Davis CEO, Savid Technologies
- 2. MIS Training Institute Session # - Slide 2 © Savid Technologies Who am I? Michael A. Davis CEO of Savid Technologies IT Security Consulting Risk Assessments/Auditing Security Remediation Speaker at Major Security Conferences Defcon, CanSecWest, Toorcon, Hack In The Box Open Source Software Developer Snort Nmap Dsniff
- 3. MIS Training Institute Session # - Slide 3 © Savid Technologies Author
- 4. MIS Training Institute Session # - Slide 4 © Savid Technologies InformationWeek Contributor
- 5. MIS Training Institute Session # - Slide 5 © Savid Technologies Your gut knows work anywhere mobility is here to stay… But to what extent?? Mobility Trends
- 6. MIS Training Institute Session # - Slide 6 © Savid Technologies Devices w/ Broadband CY2010 CY2015 Increase Tablets $600M $6B 1000% Netbooks $1.2B $6B 500% Mobility Trends
- 7. MIS Training Institute Session # - Slide 7 © Savid Technologies • Google Android flavors • RIM Blackberry • Apple iPhone • Microsoft Phone • Nokia Symbian • HP webOS • Don’t forget tablets! Smart Device Growth
- 8. MIS Training Institute Session # - Slide 8 © Savid Technologies Mobility Struggles BYOD vs. Enterprise- owned devices Combat security threats & meet compliance requirements Manage multiple device platforms & apps Gauge device usage and control user parameters
- 9. MIS Training Institute Session # - Slide 9 © Savid Technologies Mobility Struggles Source: Boxtone
- 10. MIS Training Institute Session # - Slide 10 © Savid Technologies But… Fragmentation makes management impossible without software
- 11. MIS Training Institute Session # - Slide 11 © Savid Technologies Mobile Device Risks at Every Layer NETWORK • Data interception • WiFi has all the same problems as laptops • GSM has shown some cracks. Chris Paget demo DEFCON 2010 HARDWARE • Baseband layer attacks • Memory corruption defects in firmware used to root your device • Demonstrated at Black Hat DC 2011 by Ralf-Philipp Weinmann
- 12. MIS Training Institute Session # - Slide 12 © Savid Technologies Mobile Device Risks at Every Layer OS • Every time iPhone or Android rooted/jailbroken risk increases • Defects in kernel code or vendor supplied system code APPLICATION • Your device isn’t rooted but all your email and pictures are stolen, your location is tracked, and your phone bill is much higher than usual. • Apps with vulnerabilities and malicious code have access to your data and device sensors PEOPLE • People lose their devices all the time • Can you tell the auditors, “I’m not worried when this happens.” ??
- 13. MIS Training Institute Session # - Slide 13 © Savid Technologies Mobile App Ecosystem Mobile platform providers have different levels of controls over their respective ecosystems Platform Signing Revocation Approval Android Anonymous, self- signed Yes No iOS Signed by Vendor Yes Policy & Quality Blackberry Signed with Vendor issued key Yes No Windows Phone Signed by Vendor Yes Policy, Quality & Security Symbian Signed by Vendor Yes Quality
- 14. MIS Training Institute Session # - Slide 14 © Savid Technologies Malicious Functionality 1. Activity monitoring and data retrieval 2. Unauthorized dialing, SMS, and payments 3. Unauthorized network connectivity (exfiltration or 4. command & control) 5. UI Impersonation 6. System modification (rootkit, APN proxy config) 7. Logic or Time bomb Vulnerabilities 7. Sensitive data leakage (inadvertent or side channel) 8. Unsafe sensitive data storage 9. Unsafe sensitive data transmission Veracode’s Top 10 List
- 15. MIS Training Institute Session # - Slide 15 © Savid Technologies Activity monitoring and data retrieval Risks: Sending each email sent on the device to a hidden 3rd party address Listening in on phone calls or simply open microphone recording. Stored data, contact list or saved email messages retrieved. The following are examples of mobile data that attackers can monitor and intercept: Messaging (SMS and Email) Audio (calls and open microphone recording) Video (still and full-motion) Location Contact list Call history Browsing history Input Data files
- 16. MIS Training Institute Session # - Slide 16 © Savid Technologies Activity monitoring and data retrieval Examples: Secret SMS Replicator for Android http://www.switched.com/2010/10/28/sms-replicator-forwards-texts-banned- android/ RBackupPRO for Symbian http://www.theregister.co.uk/2007/05/23/symbian_signed_spyware/
- 17. MIS Training Institute Session # - Slide 17 © Savid Technologies Unauthorized dialing, SMS, and payments Directly monetize a compromised device Premium rate phone calls, premium rate SMS texts, mobile payments SMS text message as a spreading vector for worms. Examples: Premium rate SMS – Trojan-SMS.AndroidOS.FakePlayer.a https://www.computerworld.com/s/article/9180561/New_Android_malware_t exts_premium_rate_numbers Premium rate phone call –Windows Mobile Troj/Terdial-A http://nakedsecurity.sophos.com/2010/04/10/windows-mobile-terdial-trojan- expensive-phone-calls/
- 18. MIS Training Institute Session # - Slide 18 © Savid Technologies Exfiltration or command & control Spyware or other malicious functionality typically requires exfiltration to be of benefit to the attacker. Mobile devices are designed for communication. Many potential vectors that a malicious app can use to send data to the attacker. The following are examples of communication channels attackers can use for exfiltration and command and control: Email SMS HTTP get/post TCP socket UDP socket DNS exfiltration Bluetooth Blackberry Messenger
- 19. MIS Training Institute Session # - Slide 19 © Savid Technologies UI impersonation Similar to phishing attacks that impersonating website of their bank or online service. Web view applications on the mobile device can proxy to legitimate website. Malicious app creates UI that impersonates that of the phone’s native UI or the UI of a legitimate application. Victim is asked to authenticate and ends up sending their credentials to an attacker. Example: Proxy/MITM 09Droid Banking apps http://www.theinquirer.net/inquirer/news/1585716/fraud-hits-android- apps-market
- 20. MIS Training Institute Session # - Slide 20 © Savid Technologies System modification (rootkit, APN proxy config) Malicious applications will often attempt to modify the system configuration to hide their presence. This is often called rootkit behavior. Configuration changes also make certain attacks possible. An example is modifying the device proxy configuration or APN (Access Point Name). Android “DroidDream” Trojans Rootkit Phone http://www.androidpolice.com/2011/03/01/the-mother-of-all-android- malware-has-arrived-stolen-apps-released-to-the-market-that-root- your-phone-steal-your-data-and-open-backdoor
- 21. MIS Training Institute Session # - Slide 21 © Savid Technologies Logic or Time bomb [CWE-511] Logic or time bombs are classic backdoor techniques that trigger malicious activity based on a specific event, device usage or time.
- 22. MIS Training Institute Session # - Slide 22 © Savid Technologies Sensitive data leakage [CWE-200] Sensitive data leakage can be either inadvertent or side channel. A legitimate apps usage of device information and authentication credentials can be poorly implemented thereby exposing this sensitive data to 3rd parties. – Location – Owner ID info: name, number, device ID – Authentication credentials – Authorization tokens Example: Sensitive data leakage -Storm8 Phone Number Farming http://www.boingboing.net/2009/11/05/iphone-game-dev-accu.html Android “DroidDream” Trojans steal data http://www.androidpolice.com/2011/03/01/the-mother-of-all-android-malware-has- arrived-stolen-apps-released-to-the-market-that-root-your-phone-steal-your-data-and- open-backdoor
- 23. MIS Training Institute Session # - Slide 23 © Savid Technologies Unsafe sensitive data storage [CWE-312] Mobile apps often store sensitive data such as banking and payment system PIN numbers, credit card numbers, or online service passwords. Sensitive data should always be stored encrypted so that attackers cannot simply retrieve this data off of the file system. It should be noted that storing sensitive data without encryption on removable media such as a micro SD card is especially risky. Examples: Citibank insecure storage of sensitive data http://www.pcworld.com/businesscenter/article/201994/citi_iphone_app_flaw_raises_que stions_of_mobile_security.html Wells Fargo Mobile application 1.1 for Android stores a username and password, along with account balances, in clear text. http://osvdb.org/show/osvdb/69217
- 24. MIS Training Institute Session # - Slide 24 © Savid Technologies Unsafe sensitive data transmission [CWE-319] It is important that sensitive data is encrypted in transmission lest it be eavesdropped by attackers. Mobile devices are especially susceptible because they use wireless communications exclusively and often public WiFi, which is known to be insecure. SSL is one of the best ways to secure sensitive data in transit. Beware of downgrade attack if it allows degrading HTTPS to HTTP. Beware of not failing on invalid certificates. This would enable that a man-in-the-middle attack.
- 25. MIS Training Institute Session # - Slide 25 © Savid Technologies Hardcoded password/keys [CWE-798] The use of hardcoded passwords or keys is sometimes used as a shortcut by developers to make the application easier to implement, support, or debug. Once this hardcoded password is discovered through reverse engineering it renders the security of the application or the systems it authenticates to with this password ineffective. Example: Mastercard sample code: http://jack-mannino.blogspot.com/2011/02/scary-scary-mobile-banking.html final String companyId = "your-company-id-here"; final String companyPassword = "your-company-password- here";
- 26. MIS Training Institute Session # - Slide 26 © Savid Technologies Determine Your Risk Your risk is unique depending on use of mobile apps Start with e-mail, then calendar, then contacts, then the device Use DLP to prevent the data form reaching email in the first place Tablets should use RDP/Citrix to access “rich” applications Enforce policy from the get go
- 27. MIS Training Institute Session # - Slide 27 © Savid Technologies Form a Cross functional Mobility Council. Engage end users – “Consumerization.” Prioritize Goals & Establish Mobility Plan Determine Applications that can be used Make the plan part of approved policy Define policy Document End User License Agreement Define who pays for the device (all/none/partial subsidy) Establish data security & management controls Deployment with proper tools Strategy
- 28. MIS Training Institute Session # - Slide 28 © Savid Technologies Think outside the box. At minimum, entertain cutting edge MDM vendors with new ideas. MDM software can lessen the blow of multi- platform madness. Ultimately makes multi- platform management cheaper and more effective! Security Concerns Support Quality Performance Optimization Cost Control Mobile Management Over Time Strategy
- 29. MIS Training Institute Session # - Slide 29 © Savid Technologies Enroll devices in a controlled fashion vs. free-for-all Control Device Access to Corporate Network ActiveSync, Wi-Fi, VPN Enforce user-to-device authentication with pin code Set full or partial “lock/wipe” policies depending on who owns the device Be leery of platforms without embedded crypto. Encrypt devices and data cards, when possible. Deliver firewall and antivirus capabilities, if possible Whitelist Mobile Applications Tactics
- 30. MIS Training Institute Session # - Slide 30 © Savid Technologies Since most backend email systems are based on MS Exchange, it’s a convenient place to push policies. ActiveSync provides the basics of device mgmt Windows Mobile/Phone Apple Nokia Android Palm Blackberry is done via Blackberry Enterprise Server The Basics - ActiveSync
- 31. MIS Training Institute Session # - Slide 31 © Savid Technologies Activesync features vary by phone platform and the version of Exchange you use Users can be enrolled in ActiveSync…meaning it off for everyone until turned on for individuals. Email / Calendar / Contacts / Tasks pushing and sync Full device wipe Device passwords Encrypted storage cards Bandwidth reductions Disable Wi-Fi / Bluetooth The Basics - ActiveSync
- 32. MIS Training Institute Session # - Slide 32 © Savid Technologies Maybe ActiveSync does not offer enough control? Mobile Device Manager platforms from a wide array of vendors offer all sorts of control Before buying: Do your research well. They need to support the major platforms. Don’t always take the first offer. Look at 3 minimum. Attempt to identify the visionaries Determine your business requirements and how they fit Verify vendor financial viability This space is moving fast? I want my MDM
- 33. MIS Training Institute Session # - Slide 33 © Savid Technologies Multi-platform MDM that uses an agent software and selective wipe. Multiple policies can be employed to monitor for situations that exceed permitted bounds. Ex: “If you jailbreak your device, you can’t VPN to Corp.” Comprehensive control & features across all major platforms. User self servicing. MobileIron speaks: “prepare to support 3 mobile OS platforms!” “IT should not be surprised that lines of business are building apps. IT can turn from being a blocker to an enabler.” MDM Approach Example: MobileIron
- 34. MIS Training Institute Session # - Slide 34 © Savid Technologies Conclusion Contact Information Michael A. Davis mdavis@savidtech.com 708-532-2843 Twitter: @mdavisceo