In this engaging session, we demonstrate a live attack technique aimed at bypassing a popular MDM solution with an email encryption offering. Further, we show how the mobile surveillance software effectively renders the encryption feature useless. This demonstration includes a mobile spyware version which directly accesses the MDM’s memory storage, retrieves the plain-text emails and sends them on to a remote server. Finally, we present mitigation techniques to solve against this problem. Differentiate between mass consumer-oriented mobile attacks and targeted mobile cyber-attacks Recognise the shortcoming of MDM as a wholesome security solution Enhance mobile attack mitigation techniques through mobile activity visibility

1. Anatomy of a Targeted Attack
against Mobile Device
Management (MDM)

2. MDM: Penetration in the Market
Gartner, Inc. October 2012

3. TARGETED
MOBILE THREATS

4. Mobile Remote Access Trojans (aka Spyphones)

5. Recent High-Profiled Examples

6. Commercial mRATS

7. Survey: Cellular Network 2M Subscribers
Sampling: 250K
October 2012:
1 / 1000devices

8. Survey: Cellular Network 2M Subscribers
Sampling: 250K

9. BYPASSING
MOBILE DEVICE
MANAGEMENT
(MDM) SOLUTIONS

10. MDMs and Secure Containers




11. Demo
Let’s Test These Assumptions…

12. Overview

13. Step 1: Infect the device / Android

14. Step 1: Infect the device / iOS

15. Step 2: Install a Backdoor / Android: Rooting

16. Step 2: Install a Backdoor / iOS: Jailbreaking

17. Step 3: Bypass Containerization

18. Step 3: Bypass Containerization

19. Step 3: Bypass Containerization

20. Step 3: Bypass Containerization

21. MITIGATION
TECHNIQUES

22. MDM





26. Mitigation Steps (1)

27. Mitigation Steps (2)

28. Mitigation Steps (3)

29. March 26 2013 → Android Trojan Found in Targeted Attack
A combination of e-mail hacking, "spear phishing," and a Trojan built specifically
for Android smartphones to spy on Tibetan activists
Inside of Mobile Targeted Attack
C&C Server
View the software installed on the phone to
facilitate customer software hijacking / tool to
get software such as QQ, Email, MSN
password

30. Thank You.