Mobile containers - The good, the bad and the ugly
1 like201 views
The document discusses the security challenges posed by mobile containers, particularly focusing on Android for Work and the risks of 'app in the middle' attacks. It highlights vulnerabilities such as accessibility features that can be exploited, allowing malicious apps to access sensitive data and perform unauthorized actions. The presentation emphasizes the need for improved security measures and awareness of mobile threats within corporate environments.
Mobile containers - The good, the bad and the ugly
- 7. #RSAC Jailbreaking/Rooting Common Jailbreak Detections • Existence of directories/files • fileExistsAtPath(“/bin/sh”) • fopen(“/Applications/Cydia.app”,”r”) • Directory permissions • statfs() • Process Forking • fork()>=0 • Cydia scheme detection • Check if cydia:// is callable • Prohibited commands • system()==1 Attacks are much more sophisticated Library 1 Library 2 fopen “LegitLib.dylib” Library 3 fopen impl. Fake fopen impl.
- 15. #RSAC App in the Middle Flow Leveraging Notification Features Personal Persona Business Persona Malicious app uses the notification service: BIND_NOTIFICATION_LISTENER_SERVICE Malicious app can access business notifications Malicious app transmits data to a remote server Emails, meetings, etc – compromised Reset password link – compromised Malicious app can trigger quick actions on notifications C&C Server App in the Middle
- 18. #RSAC Security Implications of Accessibility Features 18 Accessibility frameworks are traditionally good source of trouble: 2007 – Windows Vista speech recognition exploit 2013 – Siri allows to bypass iPhone lock screen 2014 – Siri Lets Anyone Bypass Your iPhone's Lockscreen -- Feature or Bug? 2015 – iOS 9 allows access to photos and contacts on a passcode locked iPhone 2016 – Accessibility clickjacking Android Accessibility Framework ✓ Has full access to content in other apps (e.g. read emails) ✓ Ability to monitor user activity and take actions accordingly Accessibility services are global and shared between personas!
- 21. #RSAC Disclosure 21 Reported to Google on December 21, 2016 Notification AitM Attack: — Google identified the behavior as intended Accessibility AitM Attack: — Google identified the behavior as intended — Google recommended using this following method: setPermittedAccessibilityServices(…, List<String> packageNames) ¡ Whitelists approved Accessibility Services — We’ve outreached leading EMMs to make sure they implement this API