Codecamp Iasi 2013 - Playing buggy Bogdan Alecu presents some real world examples of bugs, specially the ones related to mobile security For more info go to www.m-sec.net

2. Playing boogie buggy
Bogdan ALECU

3. Topics
▪ About me
▪ The buggy world
▪ Where does your data go?
Bogdan ALECU

4. About me
Bogdan ALECU
▪ Independent security researcher
▪ Sysadmin @ LEVI9
▪ Passionate about security, specially when it’s related to
mobile devices, CISSP, CEH, CISA,CCSP
▪ #infosec conferences: DeepSec, DefCamp, EUSecWest
▪ Started with NetMonitor, continued with VoIP and finally
GSM networks / mobile phones
▪ @msecnet / www.m-sec.net / alecu@m-sec.net

5. The buggy world
Bogdan ALECU
▪Developers
▪Testers
▪Customers
▪How do you test?
▪But is it enough?

6. The buggy world
Bogdan ALECU
READY FOR SOME
REAL LIFE EXAMPLES?

7. The buggy world
Bogdan ALECU

8. The buggy world
Bogdan ALECU

9. The buggy world
Bogdan ALECU

10. The buggy world
Bogdan ALECU
© Prisacaru Anatolie

11. The buggy world
Bogdan ALECU
NEVER trust the user’s input!

12. The buggy world
Bogdan ALECU

13. The buggy world
Bogdan ALECU
NEVER trust the user’s input!

14. The buggy world
Bogdan ALECU

15. The buggy world
Bogdan ALECU
NEVER trust the user’s input!

16. The buggy world
Bogdan ALECU

17. The buggy world
Bogdan ALECU
▪ 20K application
▪ Two factor authentication
▪ ACL IP
▪ User authenticated automatically if …
… coming from the right internal IP

18. The buggy world
Bogdan ALECU
PLEASE CHECK YOUR
ERS

19. The buggy world
Bogdan ALECU
▪How was the IP address checked?

20. The buggy world
Bogdan ALECU
▪ X-FORWARDED-FOR HTTP header

21. The buggy world
Bogdan ALECU
▪ Modify Headers – Firefox Extension
▪ https://addons.mozilla.org/en-US/firefox/addon/modify-headers/

22. The buggy world
Bogdan ALECU

23. The buggy world
Bogdan ALECU
▪ Try accessing the website while pretending
to be browsing from your mobile device
▪ You would be surprised of the instant
access you get
▪ No luck? Try Googlebot!
▪ If your log shows a sensitive access being
made by GoogleBot, will you worry ?

24. The buggy world
Bogdan ALECU
▪ Those damn headers …
DEMO time

25. The buggy world
Bogdan ALECU

26. The buggy world
Bogdan ALECU
▪ Having the right headers (security by
obscurity) can open a lot of doors

27. The buggy world
Bogdan ALECU
▪ Those damn headers … AGAIN!
Yet another demo

28. The buggy world
Bogdan ALECU

29. The buggy world
Bogdan ALECU
▪ Don’t bullshit me: admit your weakness!

30. The buggy world
Bogdan ALECU
▪Implementation gone wild
▪ How many of you use the Internet on
your mobile device?
▪ Do you know what DNS is?

31. The buggy world
Bogdan ALECU
Setup a VPN server on port 53, UDP (DNS
port)
… and connect to your server
… pass the traffic to the Internet
UNLIMITED
MOBILE DATA TRAFFIC!

32. The buggy world
Bogdan ALECU

33. The buggy world
Bogdan ALECU
▪ The standard itself may have issues

34. The buggy world
Bogdan ALECU
▪SIM Toolkit

35. The buggy world
Bogdan ALECU
▪SIM Toolkit

36. The buggy world
Bogdan ALECU
▪ SIM Toolkit
▪ Vulnerability discovered in June 2010
▪ Reported on August 26 2010
▪ CVE-2010-3612

37. The buggy world
Bogdan ALECU

38. The buggy world
Bogdan ALECU

39. The buggy world
Bogdan ALECU
▪ SIM Toolkit
… and the demo

40. The buggy world
Bogdan ALECU
▪ FIX THIS NOW!

41. Where does your data go?
Bogdan ALECU

42. Where does your data go?
Bogdan ALECU
▪Is the data securely transferred?
▪What info is the app sending?
▪When does it sends the info?
▪Does the app accept any certificate?
▪What is it stored locally?

43. Where does your data go?
Bogdan ALECU
▪Mallory gateway
http://intrepidusgroup.com/insight/
2010/12/mallory-and-me-setting-
up-a-mobile-mallory-gateway/

44. Where does your data go?
Bogdan ALECU
▪ Short demo

45. Where does your data go?
Bogdan ALECU

46. Call to action
Bogdan ALECU
▪ Don’t rely on thing that most users have no
idea how to check if your app is secure.
You might meet someone like me and it
will get ugly 
▪ Write your code in a secure way
▪ Testers: learn how to really tests mobile
apps. It’s not all about the usage
experience!

47. The end?!?
Bogdan ALECU
Thank you all!
Don’t forget about feedback
forms
www.m-sec.net / @msecnet