6. New Smartphone Best
Practices
1. IT will use the iPhone Configuration
Utility so you can talk to Exchange, use
the VPN, wireless, etc.
2. Get iFart, it’s hilarious.
Friday, July 9, 2010
8. If AT&T is in attendance:
• Facts about AT&T and me:
Friday, July 9, 2010
9. If AT&T is in attendance:
• Facts about AT&T and me:
• I enjoy my AT&T wireless service
Friday, July 9, 2010
10. If AT&T is in attendance:
• Facts about AT&T and me:
• I enjoy my AT&T wireless service
• Feel that I have fantastic coverage everywhere I go at
all times
Friday, July 9, 2010
11. If AT&T is in attendance:
• Facts about AT&T and me:
• I enjoy my AT&T wireless service
• Feel that I have fantastic coverage everywhere I go at
all times
• Am sure you have the largest/fastest 3G network,
regardless of what VZW says
Friday, July 9, 2010
12. If AT&T is in attendance:
• Facts about AT&T and me:
• I enjoy my AT&T wireless service
• Feel that I have fantastic coverage everywhere I go at
all times
• Am sure you have the largest/fastest 3G network,
regardless of what VZW says
• Looking forward to years of receiving quality service
from you
Friday, July 9, 2010
13. If AT&T is in attendance:
• Facts about AT&T and me:
• I enjoy my AT&T wireless service
• Feel that I have fantastic coverage everywhere I go at
all times
• Am sure you have the largest/fastest 3G network,
regardless of what VZW says
• Looking forward to years of receiving quality service
from you
• Would love to chat
Friday, July 9, 2010
14. Jailbreaking
blackra1n
pwnagetool
Friday, July 9, 2010
15. It opens up a whole new world
of applications
Friday, July 9, 2010
16. It opens up a whole new world
of applications
• common Unix
binaries
Friday, July 9, 2010
17. It opens up a whole new world
of applications
• common Unix
binaries
• sshd
Friday, July 9, 2010
18. It opens up a whole new world
of applications
• common Unix
binaries
• sshd
• tethering
Friday, July 9, 2010
19. It opens up a whole new world
of applications
• common Unix
binaries
• sshd
• tethering
• pirate software
Friday, July 9, 2010
20. It opens up a whole new world
of applications
• common Unix
binaries
• sshd
• tethering
• pirate software
• super easy to JB your
phone
Friday, July 9, 2010
21. Impact on security
“Jail breaking removes 80% of the
iPhone’s security precautions”
Charlie Miller, SyScan 2009
Friday, July 9, 2010
42. Devices On the Network
10,589* IPs scanned
Count Port What?
83 22 sshd
24 80 http
4 2008 PDANet
3,644 62078 iPhone Default
Friday, July 9, 2010
43. Other stuff out there
• Saw a Linux box with sshd
• Windows Mobile devices
• Blackberries
• Windows PC’s
• PDANet for the iPhone is an open proxy.
Friday, July 9, 2010
48. Let’s do a bit more
Erica Utilities - cmd line utilities for the
iPhone
recAudio: Record audio from the
recAudio
onboard microphone.
Queries the iPhone’s GPS API to
findme
return latitude/longitude
Friday, July 9, 2010
53. Other bad things
• ./openURL tel://1-900-XXX-XXX
Friday, July 9, 2010
54. Other bad things
• ./openURL tel://1-900-XXX-XXX
• ./openURL tel://911 or tel://mynumber
Friday, July 9, 2010
55. Other bad things
• ./openURL tel://1-900-XXX-XXX
• ./openURL tel://911 or tel://mynumber
• Pillage filesystem: email, sms, notes, app
data, etc.
Friday, July 9, 2010
56. Other bad things
• ./openURL tel://1-900-XXX-XXX
• ./openURL tel://911 or tel://mynumber
• Pillage filesystem: email, sms, notes, app
data, etc.
• apt-get install tcpdump nmap
Friday, July 9, 2010
57. Other bad things
• ./openURL tel://1-900-XXX-XXX
• ./openURL tel://911 or tel://mynumber
• Pillage filesystem: email, sms, notes, app
data, etc.
• apt-get install tcpdump nmap
• go wild on whatever network en0 is
connected to.
Friday, July 9, 2010
63. Some good news
• AT&T does segment part of their network:
Friday, July 9, 2010
64. Some good news
• AT&T does segment part of their network:
• e.g. I could not see friend in CA from DC
Friday, July 9, 2010
65. Some good news
• AT&T does segment part of their network:
• e.g. I could not see friend in CA from DC
• But I could see friend in Boston
Friday, July 9, 2010
66. Some good news
• AT&T does segment part of their network:
• e.g. I could not see friend in CA from DC
• But I could see friend in Boston
• No easy way to target specific individual (Identity to
AT&T NAT IP address not super easy)
Friday, July 9, 2010
67. Some good news
• AT&T does segment part of their network:
• e.g. I could not see friend in CA from DC
• But I could see friend in Boston
• No easy way to target specific individual (Identity to
AT&T NAT IP address not super easy)
• No way to correlate 10.x.x.x IP to person via Safari
Friday, July 9, 2010
68. Some good news
• AT&T does segment part of their network:
• e.g. I could not see friend in CA from DC
• But I could see friend in Boston
• No easy way to target specific individual (Identity to
AT&T NAT IP address not super easy)
• No way to correlate 10.x.x.x IP to person via Safari
• decloak.net doesn’t really work in Mobile Safari
Friday, July 9, 2010
69. Some good news
• AT&T does segment part of their network:
• e.g. I could not see friend in CA from DC
• But I could see friend in Boston
• No easy way to target specific individual (Identity to
AT&T NAT IP address not super easy)
• No way to correlate 10.x.x.x IP to person via Safari
• decloak.net doesn’t really work in Mobile Safari
• Man this is slow...
Friday, July 9, 2010
70. email to ID user
<img src=”http://10.69.62.220/i.jpg”>
10.69.63.220:80 10.69.63.110
src:10.69.63.110
10.69.63.220:80 10.69.63.110
dst:10.69.63.220
Friday, July 9, 2010
71. What to do
• Don’t Jailbreak your phone if you care about
security (sorry)
• Change root and mobile users’ passwords
• Attention Cydia Folks: Do not bind sshd to pdp
interfaces; force password change upon install
• IT Folks: Policy on jailbroken iphones
• AT&T: Filter mobile to mobile IP traffic
Friday, July 9, 2010
75. Location Based Apps
• Underworld: Sweet Deal
• Drug trafficking game with candy
Friday, July 9, 2010
76. Location Based Apps
• Underworld: Sweet Deal
• Drug trafficking game with candy
• Location matters, move product from point
A to point B
Friday, July 9, 2010
77. Location Based Apps
• Underworld: Sweet Deal
• Drug trafficking game with candy
• Location matters, move product from point
A to point B
• Phone sends high resolution coordinates to
game server
Friday, July 9, 2010
81. Paros
• Client side proxy
• Configure iPhone to use machine running
Paros’s IP address as proxy
• Watch what your apps send and receive
Friday, July 9, 2010
100. perl script
#! /usr/bin/perl
use strict;
use warnings;
# make single or multiline input into one scalar
my $glob = join('',(<>));
# extract name-to-flag records
my @records = $glob =~ /(<name>.*?</lon>)/ig;
for (@records)
{
my ($name,$lat,$lon) = $_ =~
qr|<name>(.*?)</name>.*?<lat>([-d.]*)</lat><lon>([-d
.]*)</lon>|i;
print "$lat,$lon,$namen";
}
Friday, July 9, 2010
