Enterprise Mobility Report 08/2015. Creation date: Vlastimil Turzík

Transcription

1 08/2015 Creation date: Author: Vlastimil Turzík

2 Content Content... 2 Introduction... 3 ios ios vulnerability targets corporate data... 3 Versions: Android Android DoS vulnerability Affects 95% of Android Devices Patch Released... 4 New vulnerability 'Certifi-gate' allows hackers to spy on nearly 1 billion Android devices... 4 Do this now: Use this app to see if your Android phone is vulnerable to the Stagefright bug... 6 Versions... 6 Blackberry Versions... 7 Windows Phone Versions

3 Introduction This is the public version of System4u's Enterprise Mobility report. You can find here news about security of ios, Android, Blackberry and Windows Phone operating systems from last week. We cover also EMM solution MobileIron in this report, others EMM solutions will come in the future. Full version of report is issued for our customers and subcsribers. You can find there not only the news about security, but also interesting articles, links from the enterprise mobility world and recommendations to mitigate the vulnerabilities. ios No vulnerabilities in this month. ios vulnerability targets corporate data The security flaw in the ios mobile operating system impacts all iphone, ipod touch, ipad devices running ios 7 and later. Quicksand is a sandbox security vulnerability that enables a malicious mobile app, or a bad actor who gains access to a physical device, to read other installed mobile apps' managed preferences. This gives cybercriminals the ability to harvest credentials and exfiltrate other sensitive corporate data. Versions:

4 Android Android DoS vulnerability Affects 95% of Android Devices Patch Released Security researchers at Trend Micro have reported finding a second DoS vulnerability in Android s mediaserver component. The latest Android vulnerability (CVE ) is triggered when mediaserver processes a malformed MKV video file causing an integer overflow. This overflow then sends the affected device to an endless loop when trying to read video frames. According to the security group, an attacker can exploit this Android vulnerability by using one of the following two methods: By making users install an app and then having mediaserver process a specially crafted MKV file via this app. This causes system to slow down until it has no battery left, continuing to loop until system resources or battery are exhausted. In the second scenario, attacker could trick users into visiting a website containing malicious MKV file embedded into the HTML page which triggers the same action as above when the video file is played. In this attack, service continues to loop even if the malicious app is terminated until system resources aren t depleted. Attackers could also program the app to start at boot causing endless reboot loop for the affected device. New vulnerability 'Certifi-gate' allows hackers to spy on nearly 1 billion Android devices Site: Security researchers have discovered a serious vulnerability in the Android mobile operating system that could allow hackers to take full control of Android phones, putting hundreds of millions of such devices at risk. The new vulnerability follows the recent discovery of the Stagefright exploit, which also poses a threat to Android users, and patches for the exploit have already been released by Google and other mobile OEMs. The new Certifi-gate vulnerability allows applications to gain illegitimate access usually meant for remote support applications, which come pre-installed on Android devices by the OEMs, or are installed by the user. This vulnerability is very easily exploited, and can lead to the loss and dissemination of a user's personal data. 4

5 Using Certifi-gate, hackers can gain unrestricted access to Android devices to steal personal data, track a device's location, and record conversations. With Certifi-gate, hackers can target insecure apps certified by OEMs and carriers to access Android devices, including screen scraping, key logging, and private information exfiltration. 5

6 Do this now: Use this app to see if your Android phone is vulnerable to the Stagefright bug Site: bgr.com Stagefright is the name of a massive vulnerability that affects more than 950 million Android devices. So far, Google, Samsung and LG have all confirmed they will roll out monthly security patches. Google has already taken steps to remove the flaw from Nexus devices, but that s hardly relevant for anyone not owning a device that runs a pure version of Android. However, while you re waiting for your fix to roll out, you can use a simple app that tells you if you re affected by Stagefright. As Engadget reports, Zimperium, the security firm that uncovered the flaw in the first place, made the Stagefright Detector App that tells you if you re susceptible to such attacks or not. The app can t do anything else about Stagefright, so this isn t a generalpurpose fix. What the Stagefright security issue does is to allow an attacker to take over a phone after tricking its user into clicking a video attachment sent via SMS or MMS. As the tech site says, using Hangouts as the default SMS app on an Android phone is also enough to infect the recipient, regardless of whether the attached file is opened by the user or not. Stagefright is the most important Android security issue uncovered to date, and one that shows how Android s fragmented state prevents Google from doing anything about it in a timely fashion. However, that doesn t mean someone will immediately target you with malicious content via SMS/MMS. What you should do after determining whether you re one of the 950 million people at risk (get the app from the Google Play Store) is to disable the Auto Retrieve MMS option in Hangouts on Android or stop using it altogether. Also, don t click on anything strangers send your way. Versions Android Lollipop Android KitKat Supported mobiles all supported mobiles Blackberry 6

7 No vulnerabilities in this month Versions Tmobile Czech 1) OS BlackBerry Bold 9900, ) OS Blackberry 9800, 9780, ) OS Blackberry ) OS Blackberry Curve ) OS Blackberry Curve 9320, 9360, ) OS Blackberry Curve ) OS Blackberry Bold ) OS BlackBerry PlayBook 9) OS Z30, Z10, Q10, Q5, Blackberry Passport, Porsche Design P 9983 Windows Phone No vulnerabilities in this month. Versions Windows Phone 8.1 7