This document discusses how mobile devices collect a large amount of data about users through normal usage and sensors even without direct usage. It demonstrates how to set up Fiddler to inspect traffic from an iPhone to see what information is being sent without the user's knowledge or consent. It suggests developers inspect traffic, verify certificates, follow security best practices, and consider users' threat risk models to build trust and protect privacy.

1. Exposing the Spy in your Pocket
1

2. I n t r o d u c t i o n s

3. Mobile devices are ubiquitous
3

4. All that usage creates a lot of raw data
4

5. Add sensor data that doesn’t rely on usage
5

6. And you can figure out a lot…
6

7. In other words…
7

8. Do you trust <insert app here> with all this?
8

9. Don’t desktops have the same issue?
9

10. Mobile/IoT Problem
10

11. So what is your phone
doing anyway?
11

12. Let’s look under the hood
12

13. Things to watch
13

14. Demo
14

15. Basic Fiddler Setup
15

16. iPhone Setup
16

17. iPhone Setup – Connection Proxy
17

18. <explore>
18

19. HTTPS Fiddler Setup
19

20. HTTPS iPhone Setup
20

21. </explore>
21

22. What did we see?
22

23. What can we, the poor consumer,
do to defend ourselves?
23

24. Back up, what did we just do?
24

25. What could we have done?
25

26. Demo
26

27. Doesn’t this alert the user? 27

28. Not necessarily
28

29. Pen Pineapple
29

30. What can we, the devs, do for our users?
30

31. Inspect
31

32. Verify certificates
32

33. OWASP
33

34. Be your own
White Hat
34

35. Assess your threat risk model 35

36. Security == difficulty level
36

37. Questions?
37

38. • Josh.Gillespie@PolarisSolutions.com
• @jcgillespie
All images in the public domain except where otherwise attributed.
38