5 key ways to incorporate security protection into your organization’s mobile application development lifecycle

© 2014 IBM Corporation

IBM Security Systems

1


5 Key Ways to Incorporate Security Protection into your Organization’s Mobile Application Development Lifecycle



2

Mobile Application Security Landscape

Mobile Risks and Attack Vectors

Incorporating Protection Into Your Mobile Application Development Lifecycle

Agenda



3

Threats are Increasing – Old and New Targets

??????????????????????XSS and SQL Injection Exploitations

Mobile Devices Targeted

Web Application Vulnerabilities

??????????????????????Mobile Malware Increasing

Malicious code infects more than

11.6 millionmobile devicesat any given time

Source: InfoSec, "Mobile Malware Infects Millions; LTE Spurs Growth," January 2014

Mobile devices and apps that we rely on are under attack

90% of top mobile apps

have been hacked

Source: Arxan Technologies, “App Economy under Attack: Report Reveals More than 90 Percent of the Top 100 Mobile Apps Have Been Hacked”

Web Application Vulnerabilities

XSS and SQL injection exploits continue in high numbers

Source: IBM X-Force Threat Intelligence Quarterly, 1Q 2014Source: IBM X-Force Threat

Intelligence Quarterly, 1Q 2014

33% of vulnerability

disclosures are web application vulnerabilities



4

Mobile Malware Growth’s Logarithmic



5

Mobile Apps Under Attack

• “78 percent of top 100 paid Android and iOS Apps are available as hacked versions on third-party sites” (“State of Security in the App Economy”, Arxan, 2013)

• "Chinese App Store Offers Pirated iOS Apps Without the Need to Jailbreak” (Extreme Tech, 2013)

• “86% of Mobile Malware is legit apps repackaged with malicious payloads” (NC State University, 2012)



6

Mobile Risks and Attack Vectors



7

Data leakage– Malware attacks– Account information on

mobile devices Cracking mobile apps

– Easy access to applications– Reverse-engineering

Little to no App control– BYOD– Consumer devices

OWASP Mobile Top 10 Risks (RC 2014 V1)

#2 Insecure Data Storage#4 Unintended Data Leakage#10 Lack of Binary Protections

User vs. Enterprise Risk

Threat from Malware- Trojans and Spyware

Phishing

Fake Android marketplace- Malware bundled with

apps

Unauthorized Use of:- Contact DB- Email- SMS (text messages)- Phone (placing calls)- GPS (public location)- Data on device

User Enterprise



8

App Confidentiality and Integrity Risks

• Application binaries can be modified• Run-time behavior of applications can

be altered• Malicious code can be injected into

applications

Integrity Risk

(Code Modification or Code Injection Vulnerabilities)

• Sensitive information can be exposed• Applications can be reverse-engineered

back to the source code • Code can be lifted and reused or

repackaged

Confidentiality Risk

(Reverse Engineering or Code Analysis Vulnerabilities)



9

Lots of Ways to Hack an App



10

“Tools of the Trade” for Mobile Pen-Testers or Black Hats

Category Example Tools

App decryption / unpacking / conversion

• Clutch• APKTool• dex2jar

Static binary analysis, disassembly, decompilation

• IDA Pro & Hex Rays (disassembler/decompiler) • Hopper (disassembler/decompiler) • JD-GUI (decompiler)• Baksmali (disassembler)• Info dumping: class-dump-z (classes), nm (symbols), strings

Runtime binary analysis • GDB (debugger)• ADB (debugger)• Introspy (tracer/analyzer)• Snoop-It (debugging/tracing, manipulation)• Sogeti tools (dump key chain or filesystem, custom ramdisk boot, PIN brute force)

Runtime manipulation, code injection, method swizzling, patching

• Cydia Substrate (code modification platform) (MobileHooker, MobileLoader)• Cycript / Cynject• DYLD• Theos suite• Hex editors

Jailbreak detection evasion

• xCon, BreakThrough, tsProtector

Integrated pen-test toolsets

• AppUse (custom "hostile" Android ROM loaded with hooks, ReFrameworker runtime manipulator, reversing tools)

• Snoop-It (iOS monitoring, dynamic binary analysis, manipulation)• iAnalyzer (iOS app decrypting, static/dynamic binary analysis, tampering)



11

Real Life Android Vulnerabilities

• Android Java APK Reverse Engineering• Hackers can easily reverse engineer

binary code (the executable) back to source code and primed for code tampering

• Baksmali Code Modification• Hackers can easily crack open and

disassemble (Baksmali) mobile code

Video 1

Video 2



12

Incorporating Protection Into Your Mobile Application Development Lifecycle



13

Build and Keep It Secure

Secure and Protected

Application

Free of critical flaws and vulnerabilities

Protects itself against attacks

Build It Secure

ApplicationDevelopmen

t

IBM WorklightBuild and

Manage Mobile Apps

Vulnerability Analysis& Testing

IBM SecurityAppScanIdentifies

Vulnerabilities

Keep It Secure

ApplicationProtection

Release &Deployment

Arxan Application Protection for IBM Solutions

Defends, Detects & Reacts

Mobile application security risk is real and impacts Users and Enterprise

Don’t procrastinate – be proactive!



14

OWASP Mobile Top 10 Risks

Source: https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks



15

AppScan Vulnerability Analysis



16

Experts Recommend Protecting Binary Code

Consultants AnalystsOWASP

Mobile Top 10 Risks

“Protect Your Binary”



17

Risks Identified with the New AppScan Rules

New Custom Rules for AppScan identify key OWASP M10 issues:

OWASP M10 Issues That New AppScan Custom Rules Cover

1. Repackaging 6. Exposed Data Symbols

2. Swizzle With Behavioral Change 7. Exposed String Tables

3. Security Control Bypass 8. Cryptographic Key Interception

4. Automated Jailbreak Breaking 9. Presentation Layer Modification

5. Exposed Method Signatures 10.Application Decryption



18

A Number of Guards Can Be Leveraged

Defend against compromise

• Advanced Obfuscation• Encryption• Pre-Damage• Metadata Removal

Detect attacks at run-time

• Checksum• Debugger Detection• Resource Verification• Resource Encryption• Jailbreak/Root Detection• Swizzling Detection• Hook Detection

React to ward off attacks

• Shut Down (Exit, Fail)• Self-Repair• Custom Reactions• Alert / Phone Home



19

AppScan / Arxan Integration



20

Arxan® + IBM AppScan® Solution Components

Solution Components Benefits

1. Technical guide • How to integrate IBM Security AppScan®

and Arxan into the SDLC to use them in conjunction

Control full scope of risks and build in security from testing to run-time protection

2. Augmented IBM Security AppScan® rules • Custom scan configuration for AppScan to

better identify app integrity risksInform required protections against app integrity attacks that can compromise even ‘flawless’ code

3. Usage of Arxan protection tools• Informs creation of Arxan GuardSpec

based on AppScan-aided integrity risk assessment, supplemented by manual analysis

Design and implement "defend", "detect", and "react" app integrity protections inside your app, without modifying its source code

4. Tested and validated • Demonstration with a sample app Helps ensure interoperability and support



21

Why Arxan?

‘Gold standard’ protection strength Multi-layer Guard Network Static & run-time Guards Customizable to your application Automated randomization for each build

No disruption to SDLC or source code with unique binary-based Guard injection

Cross platform support -- > 7 mobile platforms alone

Proven– Protected apps deployed on over 300 million devices – Hundreds of satisfied customers across Fortune 500

Unique IP ownership: 10+ patents

Integrated with other IBM security and mobility solutions



22

Additional Resources

How to Protect Worklight Apps with Arxan from IBMDate: Thursday, September 4Time: 11AM EDT / 4 PM GMT

Register:http://www.arxan.com/resources/arxan-and-ibm-app-protection-webinars/

Arxan/IBM White Paper: Securing Mobile Apps in the Wild

http://www.arxan.com/securing-mobile-apps-in-the-wild-with-app-hardening-and-run-time-protection/

http://www.arxan.com/resources/arxan-and-ibm-app-protection-webinars/

http://www.arxan.com/resources/arxan-and-ibm-app-protection-webinars/







23

Additional Resources

Contact your IBM representative or email us at [email protected] for more information

Webinar Participants Eligible for Free Evaluation of Arxan Application Protection Software – Now offered as part of IBM’s Security Portfolio



24

Tom Mulvehill

IBM Product [email protected]

Will Frontiero

IBM Software Engineering

[email protected]

Jonathan Carter

Arxan Technical Director

[email protected]

Thank You!

mailto:[email protected]



Technology

5 key ways to incorporate security protection into your organization’s mobile application development lifecycle