This document discusses common vulnerabilities found in mobile applications. It begins by outlining the types of sensitive data stored on mobile devices and used by mobile apps. It then covers tools for analyzing the file system, application layer, and transport layer of mobile apps. Specific vulnerabilities are highlighted from the OWASP Mobile Top 10 list, including insecure data storage, weak server-side controls, and insufficient transport layer protection. Examples of vulnerabilities found in popular apps like Facebook, Evernote, MyFitnessPal, and LinkedIn are provided. The document concludes by emphasizing that mobile security issues go beyond just application vulnerabilities.

1. Smart Bombs: Mobile Vulnerability and Exploitation
Tom Eston

2. Grilled Smart Phones
http://youtu.be/cir-MOzVggQ 2

3. Windows Mobile Wins!
3

4. Tom Eston
• Manager, SecureState Profiling &
Penetration Team
• Blogger – SpyLogic.net
• Infrequent Podcaster – Security
Justice/Social Media Security
• Zombie aficionado
• I like to break new technology
4

5. What are we talking
about today?
• What’s at risk?
• Tools, Testing and Exploitation
• Common vulnerabilities found in popular apps
(this is the fun part)
• Special thanks to Kevin Johnson and John Sawyer who
helped with this research!
5

6. What are Smart Bombs?
• We’ve got powerful technology in the palm of
our hands!
• We store and transmit sensitive data
• Mobile devices are being used by:
– Major Businesses (PII)
– Energy Companies (The Grid)
– The Government(s)
– Hospitals (PHI)
– Your Mom (Scary)
6

7. That’s right…your Mom
7

8. Testing Mobile Apps
• What are the three major areas for testing?
– File System
What are apps writing to the file system? How is data
stored?
– Application Layer
How are apps communicating via HTTP and Web
Services? SSL?
– Transport Layer
How are apps communicating over the network? TCP
and Third-party APIs
8

9. OWASP Top 10 Mobile Risks
1. Insecure Data Storage
2. Weak Server Side Controls
3. Insufficient Transport Layer Protection
4. Client Side Injection
5. Poor Authorization and Authentication
9

10. OWASP Top 10 Mobile Risks
6. Improper Session Handling
7. Security Decisions Via Untrusted Inputs
8. Side Channel Data Leakage
9. Broken Cryptography
10. Sensitive Information Disclosure
10

11. OWASP Mobile Security Project
• You should get involved!
• https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
11

12. Other Issues
• Privacy of your data!
– Mobile apps talk to many third party APIs (ads)
– What’s collected by Google/Apple/Microsoft?
12

13. Common Tools
• SSH
• VNC server
• A compiler (gcc / agcc)
• Android SDK (adb!)
• Xcode
• iExplorer (iOS GUI file explorer)
• Jailbroken iDevice
• Rooted Android Device
13

14. File System Analysis
• Forensic approach
– File system artifacts
– Timeline analysis
– Log analysis
– Temp files
14

15. Forensic Tools
• Mobile Forensic Tools
– EnCase, FTK, Cellebrite
• Free and/or Open Source
– file, strings, less, dd, md5sum
– The Sleuthkit (mactime, mac-robber)
15

16. Timelines
• Timelines are awesome
– Anyone know log2timeline?
• Filesystem
– mac-robber
– mactime
• Logs
– Application- &
OS-specific
16

17. Temp Files
17

18. Viewing & Searching Files
• cat, less, vi, strings, grep
• SQLite files
– GUI browser, API (Ruby, Python, etc)
• Android apps
– ashell, aSQLiteManager, aLogViewer
18

19. Application Layer - HTTP
• Tools Used:
– Burp Suite
– Burp Suite
– oh yeah Burp Suite!
19

20. Why Look at the App Layer?
• Very common in mobile platforms
• Many errors are found within the application
– And how it talks to the back end service
• Able to use many existing tools
20

21. Misunderstanding Encryption
21

22. Base64 Encoding is NOT Encryption!
• Really. It’s 2012.
Base64:
TXkgc3VwZXIgc2VjcmV0IGtleSE=
Plaintext:
My super secret key!
22

23. Want Credentials?
Note: This is
actually a
hardcoded
password in the
UPS app…
23

24. Transport Layer - TCP
• Tools Used:
– Wireshark
– Tcpdump
– NetworkMiner
24

25. Why look at the transport layer?
• Check to see how network protocols are handled in
the app
• Easily look for SSL certificate or other
communication issues
25

26. NetworkMiner
• Extracts files/images and more
• Can pull out clear txt credentials
• Quickly view parameters
26

27. 27

28. TCP Lab Setup
• Run tcpdump directly on the device
• Run Wireshark by sniffing traffic over wireless AP or
network hub setup (lots of ways to do this)
• Import PCAPs into NetworkMiner
28

29. App Vulnerabilities
• Several examples that we’ve found
• Many from the Top 25 downloaded apps
29

30. Facebook
• OAuth Tokens Stored in PLIST file
• Simply copy the PLIST file to another device, you’re
logged in as them!
• I’m finding OAuth tokens in lots of PLIST
files…Dropbox and apps that use Dropbox like
password managers…
30

31. Evernote
• Notebooks are stored in the cloud
• But…caches some files on the device…
• OWASP M1: Insecure Data Storage
31

32. 32

33. MyFitnessPal
• Android app stores sensitive data on the device
(too much data)
33

34. 34

35. Password Keeper “Lite”
• PIN and passwords stored in clear-text SQLite
database
• So much for the security of your passwords…
35

36. 36

37. 37

38. 38

39. Draw Something
• Word list
stored on the
device
• Modify to
mess with
your friends
39

40. LinkedIn
• SSL only for authentication
• Session tokens and data sent over HTTP
• Lots of apps do this
• M3: Insufficient Transport Layer Protection
• Note: This was fixed with the latest version of the app
(for iOS at least)
40

41. Auth over SSL
Data sent over HTTP
41

42. 42

43. Pandora
• Registration over HTTP
• User name/Password and Registration info sent over
clear text
• Unfortunately…lots of apps do this
43

44. 44

45. Hard Coded Passwords/Keys
• Major Grocery Chain “Rewards” Android app
• Simple to view the source, extract private key
• OWASP M9: Broken Cryptography
• Do developers really do this?
45

46. Why yes, they do!
46

47. Privacy Issues
• Example: Draw Something App (Top 25)
• UDID and more sent to the following third-party ad
providers:
– appads.com
– mydas.mobi
– greystripe.com
– tapjoyads.com
47

48. What is UDID?
• Alphanumeric string that uniquely identifies an
Apple device
48

49. 49

50. Pinterest and Flurry.com
50

51. 51

52. Conclusions
• Mobile devices are critically common
• Most people use them without thinking of security
• Developers seem to be repeating the past
• Lots of issues besides Mobile Application Security
– BYOD
– The device itself (Jailbreaking/Rooting)
– MDM and Enterprise Management
– The list goes on…
52