The Four Horsemen of Mobile Security

Yair Amit, Co-‐Founder and CTO, Skycure

Adi Sharabani, Co-‐Founder and CEO, Skycure

The Four Horsemen of Mobile Security

© 2015 RSA Conference. All rights reserved.

The Four Horsemen of Mobile Security

IntroducJons

The Mobile Threat Landscape

Example ANacks

Hacking Demo


Introduc)ons

Adi Sharabani CEO, Co-‐Founder

Skycure

Yair Amit CTO, Co-‐Founder

Skycure

IDF 8200

30 Patents

IDF 8200


4

1.5B 400M

10-‐100X 3.1M

Smartphones

Tablets

Networks

Apps


Old Endpoint Vs. New Endpoint

? IPS

IDS

Firewall

DLP

Data EncrypJon

Wireless Security

ApplicaJon Control AV


Modern Mobile ALacks


Physical Security

Loss

TheV

Unauthorized Access


Network Security

Wi-‐Fi/ Cellular

Off-‐the-‐shelf

hacking gear

24x7 Exposure


Network Security

0%

23%

30% 35%

41%

0%

25% 30%

38% 43%

0%

10%

20%

30%

40%

50%

0 1 Month 2 Months 3 Months 4 Months

% affe

cted

devices

Affected Devices Over Time

2014 2015

Source: Skycure Threat Intelligence


Malware Security

External Android Stores

Repackaged Apps

New infecJon vectors


Vulnerabili)es

OS & App Level

Patching Challenges

Never Ending Story


Known iOS Vulnerabili)es (by Year)

0

20

40

60

80

100

120

140

160

180

2007 2008 2009 2010 2011 2012 2013 2014 2015

Number of CVEs Trajectory

Source: Skycure analysis based of CVEdetails.com

1. Physical ANacks


The Physical Layer

•  Threat vector •  Lost / Stolen / Temp Access

•  Basic physical security needs: •  Remote wipe •  Locate device •  Backup •  Local storage •  Passcode protec)on

•  OS responsibility • MDM solu)ons

2. Network ANacks

ImplementaJon vs. Design Issues


Implementa)on Issues

• Coding piWalls • Ubiquitous • Usually easy to fix once iden)fied


Example 1: GoToFail


Example 1: GoToFail static OSStatus SSLVerifySignedServerKeyExchange(SSLContext *ctx, bool isRsa, SSLBuffer signedParams, uint8_t *signature, UInt16 signatureLen) { … if ((err = SSLHashSHA1.update(&hashCtx, &clientRandom)) != 0) goto fail; if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0) goto fail; if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0) goto fail; goto fail; if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0) goto fail;

err = sslRawVerify(ctx, ctx->peerPubKey, dataToSign, /* plaintext */ dataToSignLen, /* plaintext length */ signature, signatureLen); …fail: SSLFreeBuffer(&signedHashes); SSLFreeBuffer(&hashCtx); return err;}

Always goto “fail”, even if err==0

Code is skipped (even though err == 0)

FuncJon returns 0 (i.e. verified), even though sslRawVerify was not called

Source: Apple’s published source code


Example 2: Heartbleed


Example 2: Heartbleed


iOS crashes

“No iOS Zone” exploited again

iPhone crashes again

Device restarts

and again

and again

and again

Example 3: “No iOS Zone”


Design-‐Based Vulnerabili)es

•  Logical issue. Harder to fix. Usually persist longer •  Two types:

•  General “protocol” vulnerabili)es •  Design issues affec)ng mobile OS

• Mobile -‐ more suscep)ble: •  Classical security solu)ons are inadequate •  Excessive use of untrusted networks


Example I: SSLstrip

ALacker removes redirec)ons and links to HTTPS

Vic)m con)nues to interact via HTTP instead of HTTPs

Server returns a redirec)on to HTTPS


Example 2: SSL Decryp)on

92% of users click on “ConJnue” compromising their Exchange idenJty (username and password)

ConJnue 92%

Cancel 8%


Example 3: WiFiGate


Real)me Threat Intelligence

100K+ global threats iden)fied in 2014

hLps://maps.skycure.com

hLps://maps.skycure.com

3. Malware ANacks


Evolu)on of Android Malware

Google introduces technologies such as “Bouncer” and “Verify Apps”

Google Play is riddled with malware

3rd party stores are riddled with malware 2011 2015


Malware Scanners Effec)veness

More InformaIon at RSA ASIAPAC (July 23rd, 2015)


Malware is Not Just an Android Problem

Malicious Profiles


iOS sandbox approach

Source: Apple’s App Sandbox Design Guide

App Characteristics Profile Characteristics

iOS Security Model

•  No Store •  No Screening •  No Sandboxing

•  One Store •  Heavy Screening •  App Sandboxing


Par)cipa)on Instruc)ons

1. Open your Safari 2. Tap the blue buLon 3. Click on ‘Install’ 4. Click on ‘Install Now’ 5. Click on ‘Done’

Start demo by opening Safari and browsing to:

aLack.skycure.net


Removing The Infec)on

34

1. Go to Senngs 2. Click on General 3. Click on Profiles 4. Click on “Movies for Free” 5. Click on Remove

Try again with Skycure installed on your device.

4. VulnerabiliJes


Example 1: Plain HTTP


Example 2: SwikKey Vulnerability

•  600 million Android (Samsung) devices vulnerable

Pre-‐installed Keyboard

Unencrypted Updates MITM System

Access


Example 3: HTTP Request Hijacking


-  (void)fetchArticles { NSURL *serverUrl = ! [NSURL URLWithString:@"http://journal.skycure.com"]; ! NSMutableURLRequest *request = ! [NSMutableURLRequest requestWithURL:serverUrl]; ! [request setValue:@"application/json” ! forHTTPHeaderField:@"Content-Type"]; self.connection = ! [[NSURLConnection alloc] initWithRequest:request delegate:self]; }

NSURL *serverUrl = ! [NSURL URLWithString:@"http://journal.skycure.com"]; ! NSMutableURLRequest *request = ! [NSMutableURLRequest requestWithURL:serverUrl];

NSURL *serverUrl = ! [NSURL URLWithString:@"http://attacker.site/skycureJournal"]; ! NSMutableURLRequest *request = ! [NSMutableURLRequest requestWithURL:serverUrl];

@"http://journal.skycure.com"

@"http://attacker.site/skycureJournal"

HTTP Request Hijacking


Vic)m interacts with the malicious server

A while later, vic)m opens the app

App logic has changed!

ALacker returns a 301 direc)ve specifying a

permanent change in URI

Vic)m opens the app in an untrusted environment

App con)nues to connect to the malicious server!

Malicious server can return actual results from the target server


Summary

• Mobile security threat landscape •  Physical, Network, Malware, Vulnerabili)es

• Mobile is a low hanging fruit for aLackers

• Recommenda)ons •  Awareness •  Focus on visibility as a baseline to security •  Security solu)ons for personal and business needs


Next Steps

[email protected]

hLps://www.skycure.com

hLps://blog.skycure.com

@YairAmit, @AdiSharabani, @SkycureSecurity

/Skycure

Technology

The Four Horsemen of Mobile Security