Mobile Security Recap–August 2012

It’s a little late, but I’m first now catching up on some of the recent news. With the BlackHat and DefCon conferences in Las Vegas recently completed, there was a flurry of security news happening last few months. Here is a brief run-down of some highlights I found as it possibly affects the mobile computing world.

Slow patching puts Android users at further risk:

http://www.infoworld.com/t/mobile-security/slow-patching-puts-android-users-further-risk-198668

Take away: Android Beam (via NFC or Bluetooth) vulnerabilities to execute files, down-level OS and apps still being used by mobile operators.

Tools released at Defcon can crack widely used PPTP encryption in under a day:

http://www.infoworld.com/d/security/tools-released-defcon-can-crack-widely-used-pptp-encryption-in-under-day-198882

Take away: Stop using PPTP VPN and WPA2 Enterprise, use IPSec or OpenVPN and don’t use WPA2 for WiFi if using MS-CHAPv2 authentication..

Inside how Google scans for Malware:

Slidedeck: https://media.blackhat.com/bh-us-12/Briefings/Percoco/BH_US_12_Percoco_Bouncerland_Slides.pdf
Whitepaper of their findings: https://media.blackhat.com/bh-us-12/Briefings/Percoco/BH_US_12_Percoco_Adventures_in_Bouncerland_WP.pdf

Take away: Google bouncer app verification holes, how to make your internal or public applications more secure.

BTW, Google has now updated their Developer policy per August 1st 2012 (unknown if Trustwave helped pushed this along): http://play.google.com/about/developer-content-policy.html.
Google now is combatting spam, malware, and SMS/email usage. Any app updates after 30 days of this new policy and don’t comply are subject to warning or removal from Google Play immediately. This is excellent news!

Devices scanned on Mobile Networks:

https://media.blackhat.com/bh-us-12/Briefings/Mulliner/BH_US_12_Milliner_Probing_Mobile_Operating_Slides.pdf

Takeaway: If deploying on a public mobile network, especially M2M devices, make sure the devices can be locked down in some fashion. Reminds me of the old modem war-dailing days.

Advanced Android Exploitation with AFE (Android Framework for Exploitation):

http://toorcamp.org/content12/38
http://www.infoworld.com/t/mobile-security/android-malware-made-easy-modular-kit-199294

Takeaway: The Android platform could quickly become infested with bot networks as the current Windows platform. Understand malware and secure against it.

Apple iOS SMS Security Vulnerability

http://www.pod2g.org/2012/08/never-trust-sms-ios-text-spoofing.html

Takeaway: Careful to take basic communications as granted, SMS spoofing exists on any platform. Apple states it’s iMessage verifies addresses.

Marco..