![5G Explained! A High Level Overview [Introduction]](https://cdn.slidesharecdn.com/ss_thumbnails/5gexplainedahighleveloverview-260119165306-cc137a3e-thumbnail.jpg?width=640&height=640&fit=bounds)
Mobile Securty - An Oxymoron?
- 1. Mobile Security An Oxymoron? Pedro Cabrita <pfcabrita@gmail.com> Bruno Morisson <morisson@genhex.org>
- 2. About us Pedro Cabrita Bruno Morisson <pfcabrita@gmail.com> <morisson@genhex.org> h>p://genhex.org/~mori/ • Principal Consultant and Partner @ • Infosec Consultant & Partner @ BiAHEAD; INTEGRITY S.A.; • Working in InformaSon Security for the • Working in infosec for over 12 years; past 11 years; • In a past life, Security OperaSons Manager • About 10 years working @ a financial and Senior Infosec Consultant @ a private insStuSon; telco; • I do mainly PenTesSng for living (and have • Did Sme as a developer (C/C++); fun); Also: secure coding guidelines & reviews; • CISSP-‐ISSMP, CISA, ISO27k1LA, ITILv3, … reverse engineering; risk assessments; audits… and other security related stuff! • MSc InformaSon Security student @ Royal Holloway, University of London • CISSP • But life isn’t all about security…
- 3. What is Mobile Security ?
- 5.
- 6. Why do we care ?
- 7.
- 8. Users ApplicaSons OS Transport Transmission Physical
- 9. Users ApplicaSons OS Transport Transmission Physical
- 10. Thinking security… • What can someone do with momentarily physical access to my device ? • How secure is my informaSon if my device is lost/stolen ? • What else can go wrong ?
- 13.
- 14.
- 16.
- 17.
- 18.
- 24.
- 27.
- 28.
- 29.
- 30. Bo>om line… • If someone has physical access to the device... GAME OVER! • Turn on security features (encrypSon, authenScaSon, remote wipe/lock) • Choose an appropriate PIN • Wash your hands frequently • Don’t connect it anywhere... except home!
- 31. Users ApplicaSons OS Transport Transmission Physical
- 32. Thinking security… • Is my informaSon transmi>ed securely? • Can someone eavesdrop my communicaSons?
- 33.
- 34. GSM Professional equipment US$75.000
- 35. GSM USRP US$1.500 h>p://openbts.sourceforge.net/
- 36. GSM Old phone Priceless h>p://openbts.sourceforge.net/
- 37. GSM Old phone Priceless US$10 h>p://openbts.sourceforge.net/
- 39. Bo>om line… Don’t trust the link layer J
- 40. Users ApplicaSons OS Transport Transmission Physical
- 41. Thinking security… • Do applicaSons transmit data securely ? • What data ? • Can someone intercept it ?
- 42.
- 43.
- 48. Bo>om line… • Lots and lots of apps send informaSon in clear • Some apps handle SSL errors really badly… • Bugs in the underlying OS CHAOS
- 49. Users ApplicaSons OS Transport Transmission Physical
- 50. Thinking security… • How do security issues affect the OS ? • Is it updated ? • For how long ? • Does it do anything should know about ?
- 52.
- 53.
- 54.
- 55.
- 59.
- 60.
- 61. Bo>om line… • Difficult (impossible?) to keep updated • “secret” features reveal private informaSon • Encourages uploading private informaSon to the “cloud” • Insecure default configuraSons However, they do provide interesSng security features
- 62. Users Applica4ons OS Transport Transmission Physical
- 63. Thinking security… • How do applicaSons handle security ? • Do they store informaSon securely ? • What informaSon do they share ? • Are the markets/app stores safe ?
- 64. OWASP Top 10 Mobile Risks Release Candidate v1.0 • Insecure Data Storage • Weak Server Side Controls • Insufficient Transport Layer ProtecSon • Client Side InjecSon • Poor AuthorizaSon and AuthenScaSon • Improper Session Handling • Security Decisions Via Untrusted Inputs • Side Channel Data Leakage • Broken Cryptography • SensiSve InformaSon Disclosure h>ps://www.owasp.org/index.php/OWASP_Mobile_Security_Project
- 65.
- 66.
- 67.
- 68.
- 69.
- 70. Markets and App Stores
- 71.
- 72.
- 73.
- 74.
- 75.
- 76.
- 77.
- 78.
- 79.
- 80.
- 81.
- 82.
- 83. Bo>om line… • Apps are leaking private informaSon • InformaSon is not stored securely • Have security vulnerabiliSes • Some include malware • Android malware is on the rise • Apps circumvent security features • ValidaSng apps is not enough
- 84. Users ApplicaSons OS Transport Transmission Physical
- 85. Given a choice between dancing pigs and security, users will pick dancing pigs every 8me Gary McGraw and Edward Felten: Securing Java (John Wiley & Sons, 1999; ISBN 0-‐471-‐31952-‐X), Chapter one, Part seven
- 88. Users ApplicaSons OS Transport Transmission Physical
- 89.
- 90. Wrap Up • Users trust by default • Apps sSll have room for improvement (security wise) J • Mobile devices are becoming a mainstream target for malware • Hardware has longer longevity than the OS • Lower layers are not helping Mobile security is sSll in its infancy
- 91. Thanks! Q&A Pedro Cabrita <pfcabrita@gmail.com> Bruno Morisson <morisson@genhex.org>