Enterprise Mobility Report 10/2014. Creation date: Vlastimil Turzík, Edward Plch

Transcription

1 10/2014 Creation date: Author: Vlastimil Turzík, Edward Plch

2 Content Content... 2 Introduction... 4 Interesting Articles % of companies challenged by BYOD security... 4 ios... 4 Vulnerability... 4 CVE CVE CVE Apple fixes vulnerabilities with ios Android... 6 Vulnerability... 6 Knox vulnerability... 6 Hackers can remotely lock Samsung phone... 6 Default browser vulnerability... 6 Sony Xperia smartphones vulnerability... 6 Blackberry... 6 Vulnerability... 6 BSRT POODLE vulnerability... 6 Critical Issue Advisory - Upgrading to BES 5.0 SP4 MR7 or MR8 installs Web Desktop Manager... 7 CVE Windows Phone... 7 Vulnerability... 7 MobileIron... 7 News... 7 MobileIron updates Docs@Work to secure personal cloud

3 3

4 Introduction This is the public version of System4u's Enterprise Mobility report. You can find here news about security of ios, Android, Blackberry and Windows Phone operating systems. We cover also EMM solution MobileIron in this report, others EMM solutions will come in the future. Full version of report is issued for our customers and subcsribers. You can find there not only the news about security, but also interesting articles, links from the enterprise mobility world and recommendations to mitigate the vulnerabilities. Interesting Articles 95% of companies challenged by BYOD security Around 95 percent of IT and security professionals are struggling with the security threat presented by BYOD (bring your own device) - and more than 80 percent expect the number of mobile security incidents their company suffers to grow in These findings are from Check Point's Impact of Mobile Devices on Information Security' report, based on the views of more than 700 IT professionals in the US, UK, Australia, Canada and Germany. The survey says professionals' biggest fear is the insider threat, with 87 percent of respondents believing careless employees are their main problem. The cost of mobile security incidents is also rising: 42 percent of those surveyed said mobile security incidents cost their company more than 150,000. And Android is still seen as presenting the greatest security risks. It was seen as the riskiest platform by 64 percent this year, up from 49 percent in Yet personal devices continue to proliferate on corporate networks, with 91 percent of IT professionals reporting an increase in the number of mobiles over the past two years. Check Point product vice president, Dorit Dor, commented: Through our survey it is clear that IT professionals are not seeing an end to mobile security threats, and in fact are preparing for an increase of these incidents in ios Vulnerability CVE

5 House Arrest in Apple ios before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID. CVE icloud Data Access in Apple ios before 8.1 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. CVE The QuickType feature in the Keyboards subsystem in Apple ios before 8.1 collects typingprediction data from fields with an off autocomplete attribute, which makes it easier for attackers to discover credentials by reading credential values within unintended DOM input elements. Apple fixes vulnerabilities with ios 8.1 News in ios 8.1: - Fixed CVE could have been exploited to establish a connection a malicious Bluetooth input device by bypassing pairing - Fixed CVE Fixed CVE Fixed QuickType which can learn users credentials when switching between elements. - Fixed POODLE vulnerability 5

6 - Android Vulnerability Knox vulnerability Knox stores the user s PIN i plaintext on the device in a file called pin.xml This file can be accessed by anyone browsing the filesystem. Hackers can remotely lock Samsung phone Samsung s Find My Mobile doesn t validate the security code information it receives and all an attacker needs to do is overwhelm the device with traffic to gain access to someone s handset. Default browser vulnerability Android browser enables attackers to direct a user to a malicious page. That page runs JavaScript that allows them to read data from web pages the user has left open in other browsers. Sony Xperia smartphones vulnerability Sony Xperia smartphones have default installed spyware. Virus named Baidu is inside the Sony Xperia smartphones which is sending or pinging to the servers at Beijing in China. Blackberry Vulnerability BSRT This advisory addresses a spoofing vulnerability that is not currently being exploited but affects BlackBerry 10 smartphone customers running the BlackBerry World app. Successful exploitation requires an attacker to intercept a user s application download/update request from BlackBerry World over a compromised network and replace the response from the server with a malicious file and requires that a user accept the permissions and install the malicious app. If the requirements are met for exploitation, an attacker could potentially gain access to any data or settings allowed by the app permissions that the user granted. POODLE vulnerability This weakness allows an attacker to, under specific conditions, control a session normally protected by encryption. If an attacker is able to both intercept and modify traffic between the 6

7 client and the server and induce the client to generate specific known requests to the server, the attacker could potentially gain access to the plain text of the session that they control. Critical Issue Advisory - Upgrading to BES 5.0 SP4 MR7 or MR8 installs Web Desktop Manager When you upgrade to BlackBerry Enterprise Server 5.0 SP4 MR7 or BlackBerry Enterprise Server 5.0 SP4 MR8, if your environment does not have a BlackBerry Web Desktop Manager instance installed with every BlackBerry Administration Service instance, an instance of the BlackBerry Web Desktop Manager might be installed during the upgrade. CVE The BlackBerry World app before on BlackBerry 10 OS , before on BlackBerry 10 OS , and before on BlackBerry 10 OS does not properly validate download/update requests, which allows user-assisted man-in-the-middle attackers to spoof servers and trigger the download of a crafted app by modifying the client-server data stream. Windows Phone Vulnerability MobileIron News MobileIron updates Docs@Work to secure personal cloud MobileIron released the latest version of its Docs@Work secure content hub that addresses what the company says is the most persistent security challenge facing public and private sector enterprises today: the personal cloud. Docs@Work lets users access, annotate and share enterprise content regardless of location, and in a variety of enterprise or personal cloud repositories, while providing IT a centralized way to secure and manage mobile content and device policies. The new Docs@Work app is a standalone application that includes the ability to: Connect natively to cloud services like Box, Dropbox, Microsoft Office 365 (SharePoint Online), and Microsoft OneDrive Pro. Search, view, download, and save documents across the user s preferred on-premise and cloud repositories. 7

8 Edit both locally on the device and remotely through an integrated browser. The latest version of expands access to popular cloud-based repositories like Office 365, Dropbox, OneDrive Pro and Box. 8