nci.Brief: iPad Security

nci.BRIEF IT & NETWORK SECURITY SPECIALISTS iPad Security in a Corporate Environment October 7, 2010

2 Table of Contents 1. iPad Security | Executive summary 2. Native Configuration and Security Settings 2.1 Overview of ICU Security Effectiveness 2.2 iPhone Conﬁguration Utility Proﬁle Testing 2.2.1 Feature Tested: Passcode Policy 2.2.2 Feature Tested: Restrictions 2.2.3 Feature Tested: Wi-Fi 2.2.4 Feature Tested: Exchange ActiveSync 2.2.5 Feature Tested: Credentials 3. Securing the iPad with Third-Party Solutions 3.1 VMware View 3.2 Citrix Receiver Appendix Appendix A Appendix B Summary: the Reality ©2010 NCI ∙ Secured Intelligence

3 1. iPad Security | Executive summary October 7, 2010. With over 3 million units sold in the ﬁrst 80 days of availability, the Apple iPad has achieved enormous popularity and user-adoption in a relatively short period of time. Although the iPad was initially considered a consumer-only product, NCI has been observing the gradual embracing of this new platform within corporate and enterprise environments. As a leader in the Canadian information security space, NCI has conducted research into the security readiness of the iPad as it concerns corporate and enterprise environments. This report details our ﬁndings regarding the ineffectiveness of built-in security settings and lack of available third-party applications capable of fully securing the platform. Given the security issues of the iPad, and inability to effectively bolster that security, it is our conclusion that the Apple iPad is not enterprise-ready and poses a serious security risk if deployed. For those environments with an existing capital investment in the product we have also included some recommendations regarding thin-clients and strong authentication that may allow iPad usage under limited circumstances. ©2010 NCI ∙ Secured Intelligence

4 2. Native Configuration and Security Settings Apple created the iPhone Configuration Utility (ICU) to centrally push configuration settings to iPods, iPhones, and iPads. Features which can configured via this utility are: • Passcodes • Application Restrictions • Wi-Fi Connections • VPN Profiles • E-mail Accounts • Exchange ActiveSync Accounts • LDAP Accounts for Calendar Lookups • CalDAV and Apple Calendar Subscriptions • Web Clips • Certificates • Carrier Access Point (GPRS) Connections ICU allows an administrator to install configuration profiles on iPads using three methods: • Push directly to physically connected iPad. • Send configuration profile via e-mail. • Host the configuration profile on a web server and have the user retrieve it. Additionally, ICU can send the configuration XML file in several different formats: • Plaintext • Signed plaintext. This will show up as ‘VERIFIED’ when being installed on the iPad. • Signed and encrypted. This option is only available if the iPad has been tethered to the workstation running ICU prior to configuration push. Encryption is individual keys per iPad so it is not possible to encrypt a configuration profile using a group or company key. ©2010 NCI ∙ Secured Intelligence

5 2.1 Overview of ICU Security Effectiveness Overall, the configuration profile capabilities native to the iPad should be considered a feature of convenience and not security. Using configuration profiles can certainly ensure that end-users do not have to manually configure corporate e-mail, calendar, wireless, and vpn settings but, there are several limitations to the ICU system which reduce its effectiveness as a security tool. Ineffective Profile Deployment Strategy Configuration profiles require the end-user to click ‘Install’ and enter the iPad’s passcode before installation is possible. This means that the end-user has the ability to block any configuration profile from installing regardless of the deployment method. Lack of Configuration Enforcement Once configuration profiles have been installed there are many settings which can still be change by the end-user. Also, the configuration profiles for Wi-Fi, e-mail, and vpn are not exclusive. This means an end-user can create additional accounts for personal and third-party connectivity. Missing Administrative Passcode Reset Functionality While it is possible to push a passcode configuration profile, it is not possible for an administrator to perform a passcode reset if the end- user is locked out. If the passcode is lost then the only recourse is to reset the iPad to factory defaults and reconfigure or restore from backups. The following sections contain a more detailed look at some of the security features and how effectively they are enforced. ©2010 NCI ∙ Secured Intelligence

6 2.2 iPhone Configuration Utility Profile Testing 2.2.1 Feature Tested: Passcode Policy User can change grace period regardless of settings in configuration file. Central configuration was set for ‘Immediately’. Issues / Concerns / Notes • Auto-Lock timing is changed but not enforced. User can change time-out but not disable feature. • ‘Grace period for device lock’ timing is changed but not enforced. User can change grace period to 1 hour (Screenshot 1. Grace Period) ©2010 NCI ∙ Secured Intelligence

7 2.2.2 Feature Tested: Restrictions Screenshot 2. Fraudwarning User can disable fraud warning regardless of settings in configuration file. Central configuration was set for ‘On’. Issues / Concerns / Notes • Fraud Warning’ setting is changed but not enforced (Screenshot 2. Fraud Warning). ©2010 NCI ∙ Secured Intelligence

8 2.2.3 Feature Tested: Wi-Fi Screenshot 3. Wi-Fi Networks User can manually configure the iPad to connect to any wireless network within range. Screenshot 4. Bluetooth Bluetooth setting can be enabled/ disabled by local user. Issues / Concerns / Notes • Ability to include a trust root certificate ensures that the iPad will only connect to authorized access points advertising the SSID specified. Rogue APs advertising the corporate SSID will not present the required certificate. • User is not required to connect to SSIDs specified in the configuration profile. The iPad can still be configured to connect to additional SSIDs within range (Screenshot 3. Wi-Fi Networks). • No ability to disable Bluetooth via configuration profile (Screenshot 4. Bluetooth). ©2010 NCI ∙ Secured Intelligence

9 2.2.4 Feature Tested: Exchange ActiveSync Screenshot 5. ActiveSync Feature is enforced via configuration profile. Screenshot 6. E-mail Accounts User has authority to create additional third-party e-mail accounts. Issues / Concerns / Notes • Feature is enforced. User does not have the ability to change settings, or delete profile, once pushed via configuration profile (Screenshot 5. ActiveSync). • User is not blocked from creating additional e-mail account profiles on the iPad (Screenshot 6. E-mail Accounts). ©2010 NCI ∙ Secured Intelligence

10 2.2.5 Feature Tested: Credentials Issues / Concerns / Notes • Ability to push corporate certificates, vpn certificates, and machine certificates to iPad via configuration profile. ©2010 NCI ∙ Secured Intelligence

11 3. Securing the iPad with Third-Party Solutions The current state of native iPad security tools and conﬁguration capability has created a need for third-party solutions to provide security for the platform. However, given the control that Apple exercises over application development and approval, most of these solutions rely on using the iPad as a thin client for operating a full desktop environment remotely. The following sections will outline the capabilities of promising third party solutions. 3.1 VMware View Vmware View allows iPads to behave as thin clients. Users have the ability to interact with a full desktop environment. The following screenshot illustrates the interface presented to the user: VMware View uses the PC over IP (PCoIP) protocol for transmission facilitation. This protocol is capable of providing AES-128 bit data encryption while in transit. Details regarding session key establishment are not readily available. Furthermore, details as to how credentials and other sensitive information are stored (if stored) on the device are unavailable. To overcome issues with cached credentials, this solution is compatible with RSA SecureID. ©2010 NCI ∙ Secured Intelligence

12 3.2 Citrix Receiver Citrix Receiver uses a similar thin client approach to securing the iPad as VMWare View. Essentially, the Citrix virtual workspace has been ported to the iOS operating system. Citrix Receiver for iPad is a very new products that is still in it’s infancy. Citrix eludes to 128-bit AES encryption, but does not provide any details regarding the actual implementation of that encryption. The following is a screenshot of Citrix Receiver in use: Similar to VMWare View, the Citrix Receiver client is capable of supporting two-factor authentication to such as RSA SecureID and SMS-based authentication schemes. This should be considered mandatory iPad users within an enterprise environment. ©2010 NCI ∙ Secured Intelligence

13 Appendices Appendix A Jailbreak: The Business Impact The real source of the iPad’s security issues stem from the inability to prevent jailbreak of devices. The only option is to try and keep updated to the newest version at all times. This places a considerable strain on IT departments though; OS updates can- not be pushed out from a central management approach. All devices would have to be updated independently via iTunes while physically tethered to a workstation. The foremost issue in jailbreaking devices is the risk that an openSSH server may be installed on the device. This now creates a machine running a remote terminal service with root access to the device; the big problem is most hackers will know that the default password for both user accounts mobile and root is <alpine>. Once logged in to the remote device the attacker can leverage other jailbreak capabilities to perform virtually any operation on the device. Before we delve in to the damage that can be wreaked by an attacker, it is worth not- ing that jailbreaking of iOS devices removes many of the security controls implement- ed to prevent malicious use. For example, jailbreaking an iOS device allows a user to install a terminal on their phone. This terminal can be abused to cause adverse effects to the device. Since users now have root, they have the capability of adding many input vectors to the phone that it was not designed to tolerate. Secondly, most users will jailbreak devices to customize wallpapers, icons and other themes. This is facilitated through a third party substrate layer known as MobileSubstrate. This application effectively acts as a middle layer between the SpringBoard interface and underlying functions. This application was developed by a third party and comes with no guarantee. Lastly, and perhaps most importantly; all jailbroken software is unverified and unofficial code. This means that there is no guarantee that the applications retrieved using the jailbreak cydia or rock repositories will function as advertised. Many of these applications can cause the device to crash. Importantly, most applications come without any guarantee as to the function of code. This means that applications may perform operations that the user may not expect. For example, a free game or calculator could be programmed to steal e-mail messages, call logs, contacts, text messages, and upload to a remote server. All of this activity could be performed covertly and without knowledge of the end-user. Many jailbroken applications may require root access to the phone to operate and as such have access to any and all information on the device. Trever Hawthorn gave an excellent presentation on iPhone and AT&T insecurity at Shmoocon 2010. Hawthorn explains that the AT&T networks distribute internal IP addresses to mobile devices and rocket sticks. All external communication has NAT em- ployed when leaving the AT&T network. Hawthorn found through research that AT&T was not performing any filtering on traffic between hosts on the internal network. He was able to find devices with SSH access and default passwords. He then explained the myriad of tools and techniques that could be used to wreak havoc on users of these devices. Of those, the following are most interesting: ©2010 NCI ∙ Secured Intelligence

14 RecAudio This application can be remotely transferred through the SSH protocol to the victim device. This application can be executed by the attacker to discretely turn on the microphone and record all input with the built-in microphone. Remote Calling A package known as ‘Ericka utilities’ provides a command level application to perform phone calls. An attack could successfully use this application to dial out to other numbers from the victim device. Wireless Access Most interestingly, Hawthorn found that when ssh’d into the device an attack can use the ssh console to scan and communicate with the wireless network the victim device is associated with. This is a considerable concern for organizations that may adopt iPad’s with 3G connectivity. If jailbroken and not secured, the device could potentially bridge the wireless network with the 3G networks and allow attackers access to wireless networks that they could not otherwise compromise; for example WPA2 secured networks. The Rogers 3G network also distributes internal IP addresses to 3G devices. Attempts to communicate with other hosts on the internal network have not been made. However, if this network is found not to filter traffic between hosts a very real security issue exists with 3G enabled iPad’s. Appendix B Are there any other risks in jailbreak vulnerability? Certainly, jailbreaking is a fancy buzz word for executing exploitative code on a known software vulnerability. This means that iOS devices are jailbroken by having a software vulnerability exploited and that vector is then used to upload the payload and effectively jailbreak the device. A skilled attacker could very well use the vulnerability for different reasons; one that immediately comes to mind is bypass- ing the lock screen. Even if iOS devices are jailbroken, with the typical jailbreak software the device will reboot and still be locked. An unskilled attacker would be no closer to your private data then previous to the jailbreak. However, a skilled attacker can easily modify the payload sent to the device after the exploit is executed. This payload, for example, could be to remove / modify certain files indicating that the screen should be locked. The attacker could then reboot the device and unlock it without a password. ©2010 NCI ∙ Secured Intelligence

15 5. Summary: the Reality Based on our research, the iPad currently is not suitable for an enterprise environment due to a lack of enforceable security controls. The native security conﬁguration utility, provided by Apple, is suitable as a management tool of convenience but should not be relied upon as a tool for enforcing corporate policy. Inherent security issues aside, we fully understand that the iPad does provide an attractive form-factor for users who are highly-mobile. In these situations, the best option for secure usage is to implement a thin client solution that utilizes two-factor authentication. This will ensure that no corporate data is stored on the device in case of theft or compromise. Need help? Questions? Comments? www.nci.ca | info@nci.ca 905.607.9777 43-4120 Ridgeway Drive Mississauga, Ontario L5L 5S9 ©2010 NCI ∙ Secured Intelligence

http://www.nci.ca	64
http://www.marginscribbles.com	8
http://posterous.com	1
http://newsite.nci.ca:8080	1
http://65.39.236.89:8080	1

nci.Brief: iPad Security

by NCI on Oct 07, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

5 Embeds 75

Statistics

nci.Brief: iPad Security — Document Transcript