Mobile containers - The good, the bad and the ugly

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Yair Amit
Mobile Containers—The Good, the Bad
and the Ugly
HT-F03
CTO & Co-Founder
Skycure
@...

#RSAC
Agenda
2
Containers
The Good
Inherent Limitations
Android for Work
App in the Middle
Demos
Summary & Recommendations

#RSAC
Sandboxing in Modern OS
3
Source: developer.apple.com

#RSAC
Containers
Another layer of separation
Attempts to restrain the risk

#RSAC
Types of Containers
OS-Level ContainersApp-Based Containers
Not available for iOS
Narrowed app-
selection
Limitation...

#RSAC
Containers
Breaking Container Security in the Wild

#RSAC
Jailbreaking/Rooting
Common Jailbreak Detections
• Existence of directories/files
• fileExistsAtPath(“/bin/sh”)
• fo...

#RSAC
Malicious Profiles
Reported to Apple on March 17, 2013
Problem:
Attackers lure victims to install rogue root CAs
Ra...

#RSAC
Containers
Breaking Container Separation of Duties in the Wild

#RSAC
Android for Work
Review
10

#RSAC
Android for Work
11
Personal Persona
Business Persona
Malware
Hacker Terminal
Android for
Work
The Premise:
Privacy...

#RSAC
Android for Work
Where does it break?

#RSAC
The Main Problem
13
While there are two personas,
there is only one screen
One screen == employee satisfaction
One ...

#RSAC
Android for Work uses
one screen
with
one Notification system
14

#RSAC
App in the Middle Flow
Leveraging Notification Features
Personal Persona Business Persona
Malicious app uses the not...

#RSAC
Demonstration

#RSAC
Android for Work uses
one screen
with
one Accessibility system
17

#RSAC
Security Implications of Accessibility Features
18
Accessibility frameworks are traditionally good source of trouble...

#RSAC
App in the Middle Flow
Leveraging Accessibility Features
Personal Persona Business Persona
User enables accessibilit...

#RSAC
Demonstration

#RSAC
Disclosure
21
Reported to Google on December 21, 2016
Notification AitM Attack:
— Google identified the behavior as ...

#RSAC
Caveats
22
setPermittedAccessibilityServices(…, List<String> packageNames)
Sounds good, but…
Whitelisting based on a...

#RSAC
App in the Middle
Getting users to grant permissions
23

#RSAC
Allow permissions
Social engineering
24
Users are led to allow the permission for seemingly
good reasons
Notificati...

#RSAC
Allow permissions
Accessibility clickjacking
25
Introduced by Skycure on RSA 16’
Victims can be tricked to perform a...

#RSAC
A Few Benign Features
26
Draw Over Apps
Can be presented on top of other apps
—SYSTEM_ALERT_WINDOW
Can be used to pa...

#RSAC
… Can Be Dangerous Together
27
Victims can be tricked to
perform actions without
their knowledge
https://youtu.be/...

#RSAC
What About Android 5?
28
Original technique
was believed to
extend till KitKat
Lollipop introduced
an extra prote...

#RSAC
What about Android 6.0+?
Draw Over Apps approval has to be
done manually.
Tapjacking is still possible:
Full & indi...

#RSAC
App in the Middle
Summary
30

#RSAC
App in The Middle
31
App in the Middle (AitM) bridges access between remote attacker and
sensitive apps
The two re...

#RSAC
Apply What You Have Learned Today
32
Next week you should:
Identify who is in charge of your corporate moblie securi...

#RSAC
READ MORE
https://www.skycure.com/blog/app-in-the-middle

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 33 Ad

View on Slideshare

1 of 33 Ad