Mobile devices are not simply PCs. While one knows to look for an Advanced Persistent Threat(APT) on their desktop endpoints, mobile tends to be ignored. Setting up an MDM solution is not enough. Installing AV on as many devices as possible is not enough. The holes in the net are still too wide; attackers have more options than just malicious apps for getting on your network. Topics covered will be: How attackers are moving to mobile in order to bypass traditional protection. Apps are only one part of the problem. Documents, email, messaging are still left wide open Bypassing Mobile Antivirus Bypassing MDM, MAM and Containers Attackers are turning from apps to exploits. Finally we’ll cover what to do next – how to effectively deal with Mobile APT.

1. BYOD is now BYOT
Current Trends in Mobile APT
Jimmy Shah, Senior Director of Research

2. All rights reserved to Zimperium, INC.
Who AM I?
Jimmy Shah
• Sr. Director of Reseach at ZIMPERIUM -
Enterprise Mobile Security
• Antivirus Researcher(Symantec, McAfee, AVG)
• Involved with Mobile Malware and threats
since SymbOS/Cabir(ca. 2004)
Blog: MOBILE MALWARE DETECTION
Email: Jimmy.Shah@ZIMPERIUM.com
Twitter: @shah_jim

3. All rights reserved to Zimperium, INC.
Agenda
• Introduction to Advanced Persistent Threats(APT)
• The Real Mobile Threat Landscape
• How is it switching over to Mobile?
• Examples
• Bypassing Mitigations/Security
• Summary

4. April 24th, 2014
Introduction to Advanced
Persistent Threats(APT)

5. All rights reserved to Zimperium, INC.
Introduction to Advanced Persistent Threats(APT)

6. All rights reserved to Zimperium, INC.
APT friendly Exploits & Vulnerabilities (PC)
Client Side
Server side: MS08-067 (Conficker), Shellshock, Netbios, SMB,
Heartbleed, etc.

7. April 24th, 2014
The Real Mobile Threat
Landscape

8. All rights reserved to Zimperium, INC.
Next-generation attacks
Attackers are targeting mobile
devices.
The Changing Threat Landscape
4.3M+ Sensors
Reporting daily

9. All rights reserved to Zimperium, INC.
• Most devices are running outdated OS
• Lots of vulnerabilities
• We carry them with us everywhere
• Always connected
• Contain sensitive data
• Lack of effective security solutions!
The Low Hanging Fruit

10. April 24th, 2014
How is it switching
over to Mobile?

11. All rights reserved to Zimperium, INC.
APT Friendly Exploits in Mobile
• Widespread
• + Kernel/Root Exploit
• Targeted
• | | + Kernel/Root Exploit,
MITM,Push-SMS, etc.
• Cellular Network Attack Vectors
• Location Tracking, Call Forwarding, etc

12. April 24th, 2014
Examples

13. All rights reserved to Zimperium INC.
Widespread - App Surveillance

14. All rights reserved to Zimperium, INC.
Targeted - Airport/Hotel Scenario
Intercept Traffic
Scan (IPv4/IPv6)
Target discovery
MITM
Rogue AP
Rogue FemtoCell /
Basestation
Modify Traffic
SSL Strip
Browser Attack
Code Injection
Elevation of Privileges
OS / Kernel Exploit
Infected

15. All rights reserved to Zimperium, INC.
Targeted Attack - Spear-Phishing Scenario

16. April 24th, 2014
Infection Points

17. All rights reserved to Zimperium, INC.
Spreading in the Mobile Era
• Rogue AP
• SMS
• Using stolen Email client’s credentials
• Plug & Prey
• Juice Jacking
• Airdrop?

18. April 24th, 2014
Payloads

19. All rights reserved to Zimperium, INC.
Payloads
• Two types of payloads observed:
• Apps
• Easier to detect
• Processes
• Harder to detect
VS

20. April 24th, 2014
Bypassing Mitigations/
Security

21. All rights reserved to Zimperium, INC.
Methods used in the wild
• Mobile Anti-Virus
• Cloud Sandboxing
• Sandbox restrictions
• MDM / MAM Containers

22. April 24th, 2014
How to detect?

23. All rights reserved to Zimperium, INC.
• Persistent filesystem modifications
• Disabling security restrictions
• Spying on other sandboxes: Email App, Facebook, Whatsapp
and others
• Spying on information: SMS, Call log
• Active Spying: Camera, Pictures, Call Recording

24. April 24th, 2014
Summary

25. All rights reserved to Zimperium, INC.
Mobile
!=
PC
Credit: Flickr user - intelfreepress/

26. All rights reserved to Zimperium, INC.
• Mobile attacks becomes more sophisticated and powerful and can cause a
real damage to the corporation’s assets.
• Protecting mobile in BYOD world from various types of attack vectors
requires:
• Correlation of security events
• Anomaly detection techniques
• Mobile expert knowledge
• BYOD devices are fragmented to different versions of OS; A true solution
must work on all common devices.
ZIMPERIUM’s z9 engine was developed from the ground up for mobile to combat the unique challenges
of protecting iOS and Android devices in the organization. Contact us to request a demo
Summary

27. All rights reserved to Zimperium, INC.
Questions?

28. Thank you!
All rights reserved to Zimperium LTD.