Vous êtes sur la page 1sur 34

Smartphone Hacks and Attacks:

A Demonstration of Current Threats to Mobile Devices

Daniel V. Hoffman, CISSP, CEH, CHFI

Chief Technology Officer

Troy Vennon, CISSP, CEH, OPST

Global Threat Center Research Engineer
SMobile Global Threat Center
Exploit Research and Development
– Complete threat analysis against all exploit vectors
– Continual assessment of new devices and platforms
– Knowledge-share with worldwide device exploit

Malware Operation Center

– Actively monitor SMobile customer Malware alerts,
reporting and trending
– Monitor and scan publicly submitted Malware
– Scan partner feeds for discovered/
recent viruses, Spyware, etc.
– Continually monitor underground and public Malware
bulletin boards, websites, newsgroups, etc.

Page 2 Copyright 2009 SMobile Systems

• BlackBerry

• Symbian

• Windows Mobile

• iPhone

• Android

• Palm

Page 3 Copyright 2009 SMobile Systems

Security Perfect

Page 4 Copyright 2009 SMobile Systems

Smartphone Security – In The News

“Android Security Chief: Mobile-phone Attacks Coming”

PC World
August 12th 2009

"The smartphone OS will become a major security target," said Android Security Leader
Rich Cannings.

"We wanted developers to be able to upload their applications without anyone stopping
them from doing that," Cannings said. "Unfortunately this opens us up to malware."

Page 5
Identity Theft Moves to Mobile
• Identity theft is the Number 1 consumer crime in America¹

• Identity theft is a $50 billion per year industry¹

• 75% of “Phishing" e-mails are banking related¹

• 5 million U.S. consumers lost money to phishing attacks in 2008 - a 40% increase for that

• SMS (text) messaging is now the second leading conduit for phishing attacks¹

• 80% of mobile device owners store personal information on their handset ²

• 40% of users who store credit card information on their handset do not have a basic
password on the device to limit entry ²

• 24% of smartphone users store bank account details on their device ²

• 10% store credit card information ²

• Approximately 2 million smartphones were stolen in the US 2008 ²

¹ - Gartner Research
² - Credant Technologies

Page 6
Mobile Banking is on the Rise

Page 7 Copyright 2009 SMobile Systems

Mobile Banking Trojan – January 21, 2009

Page 8 Copyright 2009 SMobile Systems

Phone Virus Steals Money – February 8, 2009

Page 9 Copyright 2009 SMobile Systems

News Clips

Page 10
• Smartphones are rapidly replacing feature
phones. Analyst predictions state that by 2012,
65% of all cell phone sales will be smartphones

• Cell phones are used for the same functions

and have the same capabilities as PCs

• While most PCs have at least some security

software in place, smartphones commonly do
not have any security software installed

Page 11 Copyright 2009 SMobile Systems

Smartphones are the new PCs for consumers
Smartphones are the new workstations for
Smartphones are susceptible to the exact
same threats as PCs

Page 12 Copyright 2009 SMobile Systems

Threats to Mobile Devices

• Malware – Viruses, Worms, Trojans, Spyware

• Direct Attack – Attacking device interfaces, browser exploits, etc.

• Physical Compromise – Accessing sensitive data

• Data Communication Interception –

Sniffing data as it is transmitted
and received

• Authentication/Identity
Spoofing and Sniffing –
Accessing resources with a
user’s identity or credentials

• Exploitation and Misconduct –

Online predators, pornography,
inappropriate communications

Page 13 Copyright 2009 SMobile Systems

Are Application Signing and Review Processes the Answer?

Page 14 Copyright 2009 SMobile Systems

Page 15 Copyright 2009 SMobile Systems
Spyware Pushed By Carrier to BlackBerry Users

Page 16 Copyright 2009 SMobile Systems

Symbian Malware Infections

Page 17 Copyright 2009 SMobile Systems

Let’s get specific as to what’s
happening today with,
Spyware, Direct Attacks and
Loss and Theft

Page 18 Copyright 2009 SMobile Systems

Spyware Properties:
• Silently runs on devices without the
knowledge of the device user
• Easily installed via Trojans and other
• 2 of the top 3 BlackBerry infectors
are Spyware
• 4 of the top 5 Windows Mobile
infectors are Spyware

Spyware Capabilities:
• Intercept and post to a website every
SMS, MMS and e-mail (see image)
• Track every key typed by the device “Users and enterprises who are waiting to experience an infection before
implementing security software are placing themselves into the unsavory
• Remotely and silently turn on the position of unknowingly becoming infected with Spyware and having
phone to hear ambient conversations absolutely no security software in place to address that infection.”
– SMobile Global Threat Center
• Track the position of the device

Page 19 Copyright 2009 SMobile Systems

Mobile Banking Keylogger

Page 20 Copyright 2009 SMobile Systems

Spyware Demo

Page 21 Copyright 2009 SMobile Systems

Threat: Direct Attack

Curse of Silence Demo

Page 22 Copyright 2009 SMobile Systems

Curse of Silence Demo

Page 23 Copyright 2009 SMobile Systems

Threat: Data Communication

Page 24 Copyright 2009 SMobile Systems

iPhone E-mail Sniff

Sniffed Packets
118 and 140

Page 25 Copyright 2009 SMobile Systems

Threat: Loss and Theft

Page 26 Copyright 2009 SMobile Systems

Physical Compromise

• Even using a PIN/passcode

doesn’t guarantee protection
• Data is still unencrypted
• The authentication method can be

Page 27
27 Copyright 2009Copyright 2008 SMobile Systems
SMobile Systems
iPhone “Encryption”

Page 28 Copyright 2009 SMobile Systems

Threat: Exploitation and

Page 29 Copyright 2009 SMobile Systems

Exploitation and Misconduct

Page 30 Copyright 2009 SMobile Systems

Exploitation and Misconduct

• Where is your data going?
• What is your employee e-mailing, storing on
their phone, texting?
• What pictures are employees taking; Data
Leakage Protection
• What websites are being visited with the
company device? You control your PCs, why
not your smartphones?

Page 31 Copyright 2009 SMobile Systems

Threat SMobile Product

Antivirus, Firewall,
Application Revocation, Update OS

Direct Attack Firewall, AntiVirus, Update OS

Physical Compromise Encryption, Lock and Wipe

Data Communication Interception VPN, SSL

VPN, Antivirus, SSL, Firewall, Update

Authentication Attacks

Parental and Enterprise Controls,

Exploit and Misconduct
Application Revocation

* Treat the smartphone like a PC … because that’s essentially what it is

Page 32 Copyright 2009 SMobile Systems


• Threats to smartphones do exist and devices are

being exploited. This is an undeniable fact and the
data supports it
• Smartphones are the new PCs and need to be
protected with the same security technologies
• Physical compromise is currently the easiest
means of exploitation
• Smartphone Malware does exist and has infected
• Malware is now being written to be stealthy,
undetectable and for financial gain – infection and
exploitation can occur without the knowledge of the
device user/owner
• Not all smartphone security products do not
significantly drain the battery!

Page 33 Copyright 2009 SMobile Systems

Additional Resources:

• SMobilesystems.com (Global Threat Center/Mobile

Security News)

• Ethicalhacker.net

• BlackJacking Book

• Complete Guide to NAC Book

Page 34 Copyright 2009 SMobile Systems