Mobile Malware defense and possibly Anti-forensics
•
2 likes•1,729 views
Mobile Malware defense and possibly Anti-forensics - Sheran Gunasekera
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Mobile Malware defense and possibly Anti-forensics
Similar to Mobile Malware defense and possibly Anti-forensics (20)
More from idsecconf
More from idsecconf (20)
Recently uploaded
Recently uploaded (20)
Mobile Malware defense and possibly Anti-forensics
- 1. Mobile Malware Defense and possibly Anti-Forensics Sheran A. Gunasekera <sheran@zenconsult.net> IDSECCONF 2013, Surabaya, Indonesia 1
- 2. Digital forensics - Analyzing & gathering evidence of incidents occurring on a digital device Malware - Malicious software designed to disrupt or collect sensitive information from digital devices 2
- 3. In 2011, we saw unprecedented growth of mobile malware attacks with a 155 percent increase across all platforms. -- Daniel Hoffman (Juniper) Malware 3
- 4. Detection Signature based? Unique characteristics No signature, no detection 4
- 5. In 2012, 45 percent of the AV signatures failed to detect malware that used such basic transformation techniques -- Dark Reading Article [April 2013] ACME Malware Detector Malware Signatures 5
- 6. PWN3D Assume you’ve been infected Helps you stay paranoid 6
- 7. Actors You Your Mobile Device The guy spying on you 7
- 8. Inbound & outbound email Inbound & outbound SMS/MMS Phone Call Logs BBM Messages Contact information How does it work? 8
- 9. Crippling Malware Relies on exfiltrated data Expects data to be accurate But what if the data wasn’t accurate...? 9
- 10. Techniques DDTS - Don’t Drop The Soap * POEPFlood - Phony Object Escalation Process FML - Flush My Log * * Can be used for Anti-forensics 10
- 11. DDTS Possible use for Anti-Forensics Works on USB trigger Use IOPortListener or USBPortListener Trigger on event connectionRequested() 11
- 12. USB Connection •Flood Email •Flood SMS •Flood Contact •Flush Log 12
- 13. Hooking email Email Messages Package: net.rim.blackberry.api.mail.event Interface: FolderListener Methods: messagesAdded() - Intercept and forward all emails on the BlackBerry handheld 13
- 14. Listener 14
- 16. 16
- 19. Contact Flooder Contact 1 Contact 2 Contact 3 Contact 4 19
- 20. A note about keywords Fake email only as good as keywords Build an algorithm to mine existing keywords Think like the person that spies on you If they search for “bank”,”password”,”pin”... 20
- 21. Log Files Event Log Log Entry 1 Log Entry 2 Log Entry3 Log Entry n-2 Log Entry n-1 Log Entry n ... 16Kb Log Size New entries written to the bottom Old entries are ejected 21
- 22. FML Event Log Log Entry 1 Crap Crap Crap Crap Crap ... 16Kb Log Size FMLog attack writes fake data Valid Entries are deleted 22
- 23. FML BlackBerry Log Size - 16kb Android LogCat size - 64kb 23
- 24. Why? 24
- 25. Why? Unorthodox Good wing-man for conventional Frustrates the guy spying on you 25
- 26. Recap • Assume you’re pwn3d • Introduce controlled “noise” in your data • Make it harder for the guy spying on us • Sit back and laugh 26