Insecure Internal Storage in Android
|
|
|
- Elwin McKenzie
- 10 years ago
- Views:
Transcription
1 Insecure Internal Storage in Android Claud Xiao HITCON, Taipei
2 It s well known that in Android external storage is globally read/writable thus not secure; internal storage is isolated for each apps by sandbox thus is secure enough. By Google s suggestion, applications store sensitive data and configurations here. h"p://developer.android.com/training/ar4cles/security- 4ps.html#StoringData 2 Claud Xiao. Insecure Internal Storage in Android. HITCON,
3 Today, we re going to Present an attack to read/write data in internal storage by combination of disclosed attacks and vulnerabilities. Explain why 94.2% of popular apps are all vulnerable Disclose one category of apps storing password in plaintext which are under the attack above, affect billions of Android users, and may lead to enterprise or server account leaking. Discuss some ideas of mitigation. 3 Claud Xiao. Insecure Internal Storage in Android. HITCON,
4 Attacks
5 ADB backup and restore Android Debug Bridge ADB backup Fully backup almost all apps internal data from device to PC. Password to encrypt backup archive is optional but not enforced. ADB restore Restore a backup archive to device. Can modify data in the archive before restore it. More details on archive format: 5 Claud Xiao. Insecure Internal Storage in Android. HITCON,
6 Exceptions These apps won t be backup or restored: whose android:allowbackup is false in AndroidManifest.xml who implemented a BackupAgent by themselves. When developers not set android:allowbackup manually, its value will be true by default! How many apps can be backup? Will be discussed later. 6 Claud Xiao. Insecure Internal Storage in Android. HITCON,
7 It s a known attack surface Used to root Android devices like some phone/tablet models (on XDA Developers) and even Google Glass But these methods are NOT designed for real attacks need user interactions only for rooting your own devices 7 Claud Xiao. Insecure Internal Storage in Android. HITCON,
8 Restrictions of abusing ADB backup/restore 1. Connect to target device through an USB cable. 2. The system supports ADB backup/restore. 3. ADB debugging is enabled. 4. The device s screen is unlocked. 5. The PC can pass ADB authentication. 6. Click Back up my data button in ADB backup interface. Let s bypass them all J 8 Claud Xiao. Insecure Internal Storage in Android. HITCON,
9 Connect to the device Bridge-way: use victim s PC as a bridge/proxy Suppose attacker has controlled victim s PC by malware or phishing and plans to attack remotely. Need to automate all further steps. Direct-way: directly attack victim s Android device Suppose attacker can physically touch the target device temporarily. Thus allow his interactions with device in further steps. 9 Claud Xiao. Insecure Internal Storage in Android. HITCON,
10 To find a bridge/proxy is not hard Cross infection between PC and mobile devices Mobile -> PC:USBCleaver, Ssucl, PC -> Mobile: Zitmo, Droidpak, WinSpy/GimmeRat, PC isn t the only bridge May 2014, a customer bought a portable charger from Taobao, which was then found to be a customized remote control spy box with SIM card embedded. Just like a real version of Mactans presented in Black Hat 2013 Or the Juice-Jacking attack 10 Claud Xiao. Insecure Internal Storage in Android. HITCON,
11 To physically touch a device is also not hard Intentionally (target someone) steal it temporarily borrow it or even buy it from victim s family Unintentionally buy second-hand devices from resellers find a lost phone touch some public Android embedded devices 11 Claud Xiao. Insecure Internal Storage in Android. HITCON,
12 System s support to ADB backup/restore Introduced in Android ICS 4.0. ~85.8% devices support it (Jul 7, 2014). Google announced there re over 1 billion 30-day active users on the Android platform at Jun Claud Xiao. Insecure Internal Storage in Android. HITCON,
13 Enable the ADB debugging Some enthusiasts have enabled it. Most of PC auxiliary tools ask and guide users to enable it. Some vendors even enable it by default. When using utilities like adbwireless, even a normal app can use ADB debugging locally Interesting. Apps may bypass sandbox in this way. 13 Claud Xiao. Insecure Internal Storage in Android. HITCON,
14 Enable the ADB debugging (cont.) For the rest devices, we can still try to enable it by an USB multiplexer in just tens of dollars for hardware cost refers Kyle Osborn and Michael Ossman s Two Timing Data Connectors in Infiltrate infiltrate-osborn-ossmann.pdf 14 Claud Xiao. Insecure Internal Storage in Android. HITCON,
15 ADB authentication Introduced in Android For preventing unauthorized devices (e.g., PC, portable recharger) connect to Android in ADB mode. 15 Claud Xiao. Insecure Internal Storage in Android. HITCON,
16 Bypass ADB authentication In all devices which support ADB, 45.7% don t have ADB authentication thus not need to bypass. (till July 7, 2014) For the rest 54.3%, in bridge-way, we can suppose the victim s PC passed authentication before. in direct-way, if device screen is unlocked, we can manually approve it. in direct-way, if device screen is locked, we can use a new disclosed vulnerabilities to bypass it. affect Android <= secure-usb-debugging-bypass/ 16 Claud Xiao. Insecure Internal Storage in Android. HITCON,
17 Unlock device s screen lock Not all users use screen lock If it s locked, since we can use ADB now: Disable it by CVE affect Android (Optional) use exists exploit to get root privilege, then disable it like CVE or Android bug # affect Android <= (almost all Android devices) Notice: root exploit isn t essential for the whole attack 17 Claud Xiao. Insecure Internal Storage in Android. HITCON,
18 Click confirmation button In direct-way, just manually click it. In bridge-way, can simulate user s click by adb shell sendkey to automate it in background: 18 Claud Xiao. Insecure Internal Storage in Android. HITCON,
19 Conclusions 1. Highly possible to attack through USB cable via PC or touching device % of 1 billion devices support ADB backup. 3. In plenty of devices, ADB debugging has been enabled, or can be enabled by special hardware. 4. ADB authentication can be bypassed in almost all of them. 5. Screen lock can be bypassed in most of them. 6. User interaction can be performed automatically. Jobs done J 19 Claud Xiao. Insecure Internal Storage in Android. HITCON,
20 DEMOs Bridge-way Direct-way Nexus 4 Nexus 4 Android 4.3 Android ADB debugging is enabled ADB debugging is enabled The PC has been authenticated The PC has not been authenticated Screen is locked Screen is locked Totally automatically 20 Claud Xiao. Insecure Internal Storage in Android. HITCON,
21 Impact
22 If an app can be backup/restore attackers can read its internal sensitive data e.g., password, tokens, etc or modify these sensitive data or configurations e.g., login URL of banking Serious. 22 Claud Xiao. Insecure Internal Storage in Android. HITCON,
23 How many apps can be backup/restore? Analyzed 12,351 most popular apps from Google Play. 556 of them explicitly set android:allowbackup to false. 156 of the rest implement an BackupAgent to restrict backup. The rest 11,639 apps can be fully backup/restore. Statistics of Installations of Fully Backup-able Popular Apps in Google Play installa'on counts # of backup- able apps 500,000,000-1,000,000, ,000, ,000, ,000, ,000, ,000,000-50,000, ,000,000-10,000, ,000,000-5,000, ,000-1,000, Claud Xiao. Insecure Internal Storage in Android. HITCON,
24 Unimaginable Result 94.2% of the most popular Android apps are under threat of the attack. 24 Claud Xiao. Insecure Internal Storage in Android. HITCON,
25 What s next? From this perspective, everyone can easily find tons of vulnerabilities in them. Here we just discuss the most serious case: Plaintext Storage of a Password 25 Claud Xiao. Insecure Internal Storage in Android. HITCON,
26 How to store password, or, remember account? A balance between user experience and security. 1. Friendly but not secure: store password in plaintext store password in other reversible way, or obscure it 2. Secure but not friendly: not store password at all store password with symmetric-key algorithm, and request user to input passphrase every time 26 Claud Xiao. Insecure Internal Storage in Android. HITCON,
27 Using token as a replacement of password Pros restrict resource access and control privilege more precisely e.g., when login by token, users can t change password or security questions expiration and renewing mechanism Cons A non-restricted, full-privileged, non-expired token nearly equals to a password e.g., Amazon s Android app Can also be stolen by our attack Ø Developers have to control and deploy servers to cooperate with their client applications 27 Claud Xiao. Insecure Internal Storage in Android. HITCON,
28 Token is not the silver-bullet For client applications of standard network services, developers can NOT expect which specific server users will connect to. IMAP, SMTP, POP3 SSH, Telnet, FTP IRC HTTP These apps must follow standard network protocols and their authentication methods. Almost always password-based, e.g., IMAP-PLAIN and CRAM- MD5. 28 Claud Xiao. Insecure Internal Storage in Android. HITCON,
29 Common choice: user experience comes first Store or not store? In PC systems, the debate can be traced back to 1995 or earlier. Finally, most of popular IM clients, mail clients and browsers chose to store it. Why? h"ps://developer.pidgin.im/wiki/plaintextpasswords 29 Claud Xiao. Insecure Internal Storage in Android. HITCON,
30 Security assumption Rely password storage s security on system s access control mechanisms. Classic explanation: Google s opinion tl;dr: 1. They re old, insecure protocols; 2. We trust the system s security. 30 Claud Xiao. Insecure Internal Storage in Android. HITCON,
31 So we reported to Google 31 Claud Xiao. Insecure Internal Storage in Android. HITCON,
32 Android applications storing password in plaintext Applica'on Package Name Installa'ons K9 Mail com.fsck.k9 5,000,000 10,000,000 Blue Mail com.trtf.blue 100, ,000 MailDroid com.maildroid 1,000,000 5,000,000 mymail com.my.mail 100, ,000 SSH Tunnel org.sshtunnel 100, ,000 Unix Admin: FTP SFTP SSH FTPS org.kidinov.unixadmin 10,000 50,000 SSH Autotunnel cz.sde.tunnel 10,000 50,000 BotSync SSH SFTP AndFTP (your FTP client) FtpCafe FTP Client com.botsync 10,000 50,000 ysesoft.andftp 1,000,000 5,000,000 com.ftpcafe.trial 100, , Claud Xiao. Insecure Internal Storage in Android. HITCON,
33 Pre-installed apps is also vulnerable (com.android. and com.google.android. ) Passwords of POP3, SMTP and IMAP accounts are stored in Provider.db and ProviderBackup.db. The application is pre-installed in almost every Android devices. Again, there re 1 billion active Android users till Jun Claud Xiao. Insecure Internal Storage in Android. HITCON,
34 Pre-installed apps is also vulnerable (cont.) Browser (com.android.browser) Remembered passwords of websites are stored at webview.db. 22.7% of all mobile phone users use it (Jun 2014, by StatCounter). Some other third-party browsers have the same problem. 34 Claud Xiao. Insecure Internal Storage in Android. HITCON,
35 Specially for Taiwanese users PTT( 批 踢 踢 ) is the most popular BBS in Taiwan base on TELNET Vulnerable PTT clients Applica'on Package Name Installa'ons Mo PTT mong.moptt 500,000 1,000,000 Miu P" sg.xingzhi.miu_ptt 100, ,000 touchptt com.yuandroid.touchptt 100, ,000 JPTT com.joshua.jptt 50, , Claud Xiao. Insecure Internal Storage in Android. HITCON,
36 DEMOs Android AndFTP 36 Claud Xiao. Insecure Internal Storage in Android. HITCON,
37 Conclusions 94.2% of popular Android apps can be backup thus are affected by the attack Network services clients and some pre-installed apps will store password in plaintext and become vulnerable by the attack. Affect almost all Android users, and may lead personal and enterprise s account leaking 37 Claud Xiao. Insecure Internal Storage in Android. HITCON,
38 Mitigations
39 Easiest mitigation ways From OS s perspective, Set default value of R.attr.allowBackup to false. Just a description in document is not enough. Most of developers ignored it. From Developer s perspective, In AndroidManifest.xml, set android:allowbackup to false. Or implement a BackupAgent to specify what data to be backup. 39 Claud Xiao. Insecure Internal Storage in Android. HITCON,
40 Easiest mitigation ways (cont.) From user s perspective, Disable ADB debugging when not need it still not secure enough Avoid to lost it how? Update to the newest system Android L may be enough Reset useless phone to factory still vulnerable Encrypt the whole disk. 40 Claud Xiao. Insecure Internal Storage in Android. HITCON,
41 Third-party hot patching Need root privilege at first an dilemma Discussed before by Collin Mulliner et al at ACSAC '13 PatchDroid: scalable third-party security patches for Android devices Develop with existing dynamic instrumentation frameworks Xposed: adbi/ddi: Cydia Substrate for Android: There re lots of great security enhancement apps based on them. 41 Claud Xiao. Insecure Internal Storage in Android. HITCON,
42 Some simple patching ideas Disable ADB debugging when screen is locking Just like what FirefoxOS did. Fix the CVE for Android <= 4.3 Fix the CVE for Android <= Disable adb shell sendkey when doing backup Transparently encrypt all internal data by a master passphrase 42 Claud Xiao. Insecure Internal Storage in Android. HITCON,
43 DEMO 43 Claud Xiao. Insecure Internal Storage in Android. HITCON,
44 Summary An attack to read or modify internal data in high success rate. 94.2% of popular applications are influenced. Network services clients and pre-install apps store password in plaintext internally. Easy to mitigate the problem from different perspectives. 44 Claud Xiao. Insecure Internal Storage in Android. HITCON,
45 Thank you! Claud Xiao, Senior Security Researcher at Palo Alto DEMO code: Special thanks to: Elad Wexler, Zhi Xu, Ryan Olson, Bo Qu, visualwu, irene, tombkeeper Greets: Nikolay Elenkov, Collin Mulliner, Kyle Osborn, Michael Ossman, MWR Labs, rovo89, jduck, Jay Freeman(saurik) 45 Claud Xiao. Insecure Internal Storage in Android. HITCON,
What IT Auditors Need to Know About Secure Shell. SSH Communications Security
What IT Auditors Need to Know About Secure Shell SSH Communications Security Agenda Secure Shell Basics Security Risks Compliance Requirements Methods, Tools, Resources What is Secure Shell? A cryptographic
Locking down a Hitachi ID Suite server
Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime
That Point of Sale is a PoS
SESSION ID: HTA-W02 That Point of Sale is a PoS Charles Henderson Vice President Managed Security Testing Trustwave @angus_tx David Byrne Senior Security Associate Bishop Fox Agenda POS Architecture Breach
Linux VPS with cpanel. Getting Started Guide
Linux VPS with cpanel Getting Started Guide First Edition October 2010 Table of Contents Introduction...1 cpanel Documentation...1 Accessing your Server...2 cpanel Users...2 WHM Interface...3 cpanel Interface...3
Threat Modelling for Web Application Deployment. Ivan Ristic [email protected] (Thinking Stone)
Threat Modelling for Web Application Deployment Ivan Ristic [email protected] (Thinking Stone) Talk Overview 1. Introducing Threat Modelling 2. Real-world Example 3. Questions Who Am I? Developer /
DiamondStream Data Security Policy Summary
DiamondStream Data Security Policy Summary Overview This document describes DiamondStream s standard security policy for accessing and interacting with proprietary and third-party client data. This covers
It s 2 o clock: Who Has Your Data? Josh Krueger Chief Technology Officer Integrity Technology Solutions
It s 2 o clock: Who Has Your Data? Josh Krueger Chief Technology Officer Integrity Technology Solutions Your home is your business and your farm is your network. But who has access to it? Can you protect
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING
COMMONWEALTH OF PENNSYLVANIA DEPARTMENT S OF PUBLIC WELFARE, INSURANCE AND AGING INFORMATION TECHNOLOGY STANDARD Name Of Standard: Mobile Device Standard Domain: Security Date Issued: 09/07/2012 Date Revised:
BlackBerry 10.3 Work and Personal Corporate
GOV.UK Guidance BlackBerry 10.3 Work and Personal Corporate Published Contents 1. Usage scenario 2. Summary of platform security 3. How the platform can best satisfy the security recommendations 4. Network
Research Information Security Guideline
Research Information Security Guideline Introduction This document provides general information security guidelines when working with research data. The items in this guideline are divided into two different
Security Guide. BlackBerry Enterprise Service 12. for ios, Android, and Windows Phone. Version 12.0
Security Guide BlackBerry Enterprise Service 12 for ios, Android, and Windows Phone Version 12.0 Published: 2015-02-06 SWD-20150206130210406 Contents About this guide... 6 What is BES12?... 7 Key features
Threat Modeling. Frank Piessens ([email protected] ) KATHOLIEKE UNIVERSITEIT LEUVEN
Threat Modeling Frank Piessens ([email protected] ) Secappdev 2007 1 Overview Introduction Key Concepts Threats, Vulnerabilities, Countermeasures Example Microsoft s Threat Modeling Process
Windows Operating Systems. Basic Security
Windows Operating Systems Basic Security Objectives Explain Windows Operating System (OS) common configurations Recognize OS related threats Apply major steps in securing the OS Windows Operating System
Feature List for Kaspersky Security for Mobile
Feature List for Kaspersky Security for Mobile Contents Overview... 2 Simplified Centralized Deployment... 2 Mobile Anti-Malware... 3 Anti-Theft / Content Security... Error! Bookmark not defined. Compliance
Virtualization System Security
Virtualization System Security Bryan Williams, IBM X-Force Advanced Research Tom Cross, Manager, IBM X-Force Security Strategy 2009 IBM Corporation Overview Vulnerability disclosure analysis Vulnerability
Hacking Database for Owning your Data
Hacking Database for Owning your Data 1 Introduction By Abdulaziz Alrasheed & Xiuwei Yi Stealing data is becoming a major threat. In 2012 alone, 500 fortune companies were compromised causing lots of money
BYOD in the Enterprise
BYOD in the Enterprise MDM. The solution to BYOD? Context Information Security [email protected] October 2013 Context Information Security 30 Marsh Wall, London, E14 9TP +44 (0) 207 537 7515
RSA Authentication Manager 7.1 Security Best Practices Guide. Version 2
RSA Authentication Manager 7.1 Security Best Practices Guide Version 2 Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com. Trademarks
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
NHSmail mobile configuration guide Android mobile devices
NHSmail mobile configuration guide Android mobile devices Version: V.6 Date: September 2011 THIS INFORMATION IS FOR NHS STAFF AND IS NOT TO BE DISTRIBUTED OR COPIED OUTSIDE OF THE NHS Version 6.0 Crown
Configuration Guide - OneDesk to SalesForce Connector
Configuration Guide - OneDesk to SalesForce Connector Introduction The OneDesk to SalesForce Connector allows users to capture customer feedback and issues in OneDesk without leaving their familiar SalesForce
A Guide to New Features in Propalms OneGate 4.0
A Guide to New Features in Propalms OneGate 4.0 Propalms Ltd. Published April 2013 Overview This document covers the new features, enhancements and changes introduced in Propalms OneGate 4.0 Server (previously
SENSE Security overview 2014
SENSE Security overview 2014 Abstract... 3 Overview... 4 Installation... 6 Device Control... 7 Enrolment Process... 8 Authentication... 9 Network Protection... 12 Local Storage... 13 Conclusion... 15 2
SonicWALL PCI 1.1 Implementation Guide
Compliance SonicWALL PCI 1.1 Implementation Guide A PCI Implementation Guide for SonicWALL SonicOS Standard In conjunction with ControlCase, LLC (PCI Council Approved Auditor) SonicWall SonicOS Standard
Kaspersky Security for Mobile
Kaspersky Security for Mobile See. Control. Protect. MOVING TARGETS Mobile devices play a key role in connectivity and productivity. But they also introduce new risks to the business: in the past 12 months
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
Implementing two-factor authentication: Google s experiences. Cem Paya ([email protected]) Information Security Team Google Inc.
Implementing two-factor authentication: Google s experiences Cem Paya ([email protected]) Information Security Team Google Inc. Google services and personalization Identity management at Google 1. Internal
Secure Your Mobile Workplace
Secure Your Mobile Workplace Sunny Leung Senior System Engineer Symantec 3th Dec, 2013 1 Agenda 1. The Threats 2. The Protection 3. Q&A 2 The Mobile Workplaces The Threats 4 Targeted Attacks up 42% in
Mobile Application Security and Penetration Testing Syllabus
Mobile Application Security and Penetration Testing Syllabus Mobile Devices Overview 1.1. Mobile Platforms 1.1.1.Android 1.1.2.iOS 1.2. Why Mobile Security 1.3. Taxonomy of Security Threats 1.3.1.OWASP
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter [email protected]
ABSTRACT' INTRODUCTION' COMMON'SECURITY'MISTAKES'' Reverse Engineering ios Applications
Reverse Engineering ios Applications Drew Branch, Independent Security Evaluators, Associate Security Analyst ABSTRACT' Mobile applications are a part of nearly everyone s life, and most use multiple mobile
Five Steps to Improve Internal Network Security. Chattanooga ISSA
Five Steps to Improve Internal Network Security Chattanooga ISSA 1 Find Me AverageSecurityGuy.info @averagesecguy [email protected] github.com/averagesecurityguy ChattSec.org 2 Why? The methodical
What is Really Needed to Secure the Internet of Things?
What is Really Needed to Secure the Internet of Things? By Alan Grau, Icon Labs [email protected] The Internet of Things (IoT) has become a ubiquitous term to describe the tens of billions of devices
THE COMPLETE GUIDE TO GOOGLE APPS SECURITY. Building a comprehensive Google Apps security plan
THE COMPLETE GUIDE TO GOOGLE APPS SECURITY Building a comprehensive Google Apps security plan Contents Introduction................................ 3 1. Secure the core.............................4 Google
PREVENTING ZERO-DAY ATTACKS IN MOBILE DEVICES
PREVENTING ZERO-DAY ATTACKS IN MOBILE DEVICES Ira Winkler Codenomicon Session ID: MBS-W05 Session Classification: Intermediate Zero Day Attacks Zero day attacks are rising in prominence They tend to be
NETWORK SECURITY HACKS
SECOND EDITION NETWORK SECURITY HACKS 2008 AGI-Information Management Consultants May be used for personal purporses only or by libraries associated to dandelon.com network. Andrew Lockhart O'REILLY Beijing
Final Year Project Interim Report
2013 Final Year Project Interim Report FYP12016 AirCrypt The Secure File Sharing Platform for Everyone Supervisors: Dr. L.C.K. Hui Dr. H.Y. Chung Students: Fong Chun Sing (2010170994) Leung Sui Lun (2010580058)
Server Security. Contents. Is Rumpus Secure? 2. Use Care When Creating User Accounts 2. Managing Passwords 3. Watch Out For Aliases 4
Contents Is Rumpus Secure? 2 Use Care When Creating User Accounts 2 Managing Passwords 3 Watch Out For Aliases 4 Deploy A Firewall 5 Minimize Running Applications And Processes 5 Manage Physical Access
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines
Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines 1. Implement anti-virus software An anti-virus program is necessary to protect your computer from malicious programs,
Sticky Password 7. Sticky Password 7 is the latest, most advanced, portable, cross platform version of the powerful yet
Sticky Password 7 Reviewer Guide Introduction Sticky Password 7 is the latest, most advanced, portable, cross platform version of the powerful yet simple password manager and form-filler. Its main goal
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望 Agenda Information Security Trends Year 2014 in Review Outlook for 2015 Advice to the Public Hong Kong Computer Emergency Response Team Coordination
Digi Connect Wan 3G Application Guide Update the firmware, backup and restore the configuration of a Digi Connect Wan 3G using a USB flash drive.
1. Configure and prepare required files on the USB flash drive to allow firmware update and configuration backup/restore. Objective: Step by step instructions to upgrade the firmware, backup and restore
LifeSize Control Installation Guide
LifeSize Control Installation Guide April 2005 Part Number 132-00001-001, Version 1.0 Copyright Notice Copyright 2005 LifeSize Communications. All rights reserved. LifeSize Communications has made every
Information. Questions will be answered at the end. Please submit questions to Erick Mendoza using the chat function.
Information Questions will be answered at the end. Please submit questions to Erick Mendoza using the chat function. Securing Niagara, Part 2 Java 1.7.0.25 Update Announcement Review basic hardening steps
About Microsoft Windows Server 2003
About Microsoft Windows Server 003 Windows Server 003 (WinK3) requires extensive provisioning to meet both industry best practices and regulatory compliance. By default the Windows Server operating system
Bad Ads Trend Alert: Shining a Light on Tech Support Advertising Scams. May 2014. TrustInAds.org. Keeping people safe from bad online ads
Bad Ads Trend Alert: Shining a Light on Tech Support Advertising Scams May 2014 TrustInAds.org Keeping people safe from bad online ads OVERVIEW Today, even the most tech savvy individuals can find themselves
Lotus Domino Security
An X-Force White Paper Lotus Domino Security December 2002 6303 Barfield Road Atlanta, GA 30328 Tel: 404.236.2600 Fax: 404.236.2626 Introduction Lotus Domino is an Application server that provides groupware
@ChrisJohnRiley > whoami
@ChrisJohnRiley > whoami IT Security Analyst / Security Consultant Raiffeisen Informatik GmbH R-IT CERT Team Regular conference speaker DEF CON Bsides Hashdays SecZone blog http://blog.c22.cc Abject Failure
HP AppPulse Active. Software Version: 2.2. Real Device Monitoring For AppPulse Active
HP AppPulse Active Software Version: 2.2 For AppPulse Active Document Release Date: February 2015 Software Release Date: November 2014 Legal Notices Warranty The only warranties for HP products and services
Best Practices Guide to Electronic Banking
Best Practices Guide to Electronic Banking City Bank & Trust Company offers a variety of services to our customers. As these services have evolved over time, a much higher percentage of customers have
MAXIMUM DATA SECURITY with ideals TM Virtual Data Room
MAXIMUM DATA SECURITY with ideals TM Virtual Data Room WWW.IDEALSCORP.COM ISO 27001 Certified Account Settings and Controls Administrators control users settings and can easily configure privileges for
Quick Installation Guide
V48.01 Model: FI8919W Quick Installation Guide Outdoor Pan/Tilt Wireless IP Camera For Windows OS ------- Page 1 For MAC OS ------- Page 15 ShenZhen Foscam Intelligent Technology Co., Ltd Quick Installation
GFI White Paper PCI-DSS compliance and GFI Software products
White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption
VMware Horizon Workspace Security Features WHITE PAPER
VMware Horizon Workspace WHITE PAPER Table of Contents... Introduction.... 4 Horizon Workspace vapp Security.... 5 Virtual Machine Security Hardening.... 5 Authentication.... 6 Activation.... 6 Horizon
Course: Information Security Management in e-governance. Day 1. Session 5: Securing Data and Operating systems
Course: Information Security Management in e-governance Day 1 Session 5: Securing Data and Operating systems Agenda Introduction to information, data and database systems Information security risks surrounding
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Windows Phone 8 Security Overview
Windows Phone 8 Security Overview This white paper is part of a series of technical papers designed to help IT professionals evaluate Windows Phone 8 and understand how it can play a role in their organizations.
Today s Topics. Protect - Detect - Respond A Security-First Strategy. HCCA Compliance Institute April 27, 2009. Concepts.
Protect - Detect - Respond A Security-First Strategy HCCA Compliance Institute April 27, 2009 1 Today s Topics Concepts Case Study Sound Security Strategy 2 1 Security = Culture!! Security is a BUSINESS
Appalachian Regional Commission Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2
Report No. 13-35 September 27, 2013 Appalachian Regional Commission Table of Contents Results of Evaluation... 1 Areas for Improvement... 2 Area for Improvement 1: The agency should implement ongoing scanning
Privileged. Account Management. Accounts Discovery, Password Protection & Management. Overview. Privileged. Accounts Discovery
Overview Password Manager Pro offers a complete solution to control, manage, monitor and audit the entire life-cycle of privileged access. In a single package it offers three solutions - privileged account
APT Advanced Persistent Threat Time to rethink?
APT Advanced Persistent Threat Time to rethink? 23 November 2012 Gergely Tóth Senior Manager, Security & Privacy Agenda APT examples How to get inside? Remote control Once we are inside Conclusion 2 APT
Bypassing Local Windows Authentication to Defeat Full Disk Encryption. Ian Haken
Bypassing Local Windows Authentication to Defeat Full Disk Encryption Ian Haken Who Am I? Currently a security researcher at Synopsys, working on application security tools and Coverity s static analysis
Lab 8.3.1.2 Configure Basic AP Security through IOS CLI
Lab 8.3.1.2 Configure Basic AP Security through IOS CLI Estimated Time: 30 minutes Number of Team Members: Students will work in teams of two. Objective In this lab, the student will learn the following
Welcome to the Protecting Your Identity. Training Module
Welcome to the Training Module 1 Introduction Does loss of control over your online identities bother you? 2 Objective By the end of this module, you will be able to: Identify the challenges in protecting
Digital certificates and SSL
Digital certificates and SSL 20 out of 33 rated this helpful Applies to: Exchange Server 2013 Topic Last Modified: 2013-08-26 Secure Sockets Layer (SSL) is a method for securing communications between
Basics of Internet Security
Basics of Internet Security Premraj Jeyaprakash About Technowave, Inc. Technowave is a strategic and technical consulting group focused on bringing processes and technology into line with organizational
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
1. Scope of Service. 1.1 About Boxcryptor Classic
Manual for Mac OS X Content 1. Scope of Service... 3 1.1 About Boxcryptor Classic... 3 1.2 About this manual... 4 2. Installation... 5 2.1 Installing Boxcryptor Classic... 5 2.2 Licensing Boxcryptor Classic
Security in Android apps
Security in Android apps Falco Peijnenburg (3749002) August 16, 2013 Abstract Apps can be released on the Google Play store through the Google Developer Console. The Google Play store only allows apps
IceWarp to IceWarp Server Migration
IceWarp to IceWarp Server Migration Registered Trademarks iphone, ipad, Mac, OS X are trademarks of Apple Inc., registered in the U.S. and other countries. Microsoft, Windows, Outlook and Windows Phone
Agenda. 3 2012, Palo Alto Networks. Confidential and Proprietary.
Agenda Evolution of the cyber threat How the cyber threat develops Why traditional systems are failing Need move to application controls Need for automation 3 2012, Palo Alto Networks. Confidential and
Configuring an Email Client to Connect to CASS Mail Servers
Configuring an Email Client to Connect to CASS Mail Servers Table of Contents Introduction... 2 Webmail... 2 Settings... 2 Forwarding... 2 Email Client Configuration... 3 Outlook 2003... 3 Outlook 2007...
System Security Policy Management: Advanced Audit Tasks
System Security Policy Management: Advanced Audit Tasks White Paper October 6, 2005 2005 Altiris Inc. All rights reserved. ABOUT ALTIRIS Altiris, Inc. is a pioneer of IT lifecycle management software that
Cybersecurity Best Practices
Ten Essential Cybersecurity Best Practices Banking Business Employees Brought to you by: 1 Did you know? One in five small-to-medium-sized companies were the victims of cyber breaches in 2013.1 In 76%
Proxies. Chapter 4. Network & Security Gildas Avoine
Proxies Chapter 4 Network & Security Gildas Avoine SUMMARY OF CHAPTER 4 Generalities Forward Proxies Reverse Proxies Open Proxies Conclusion GENERALITIES Generalities Forward Proxies Reverse Proxies Open
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Secure Transfers. Contents. SSL-Based Services: HTTPS and FTPS 2. Generating A Certificate 2. Creating A Self-Signed Certificate 3
Contents SSL-Based Services: HTTPS and FTPS 2 Generating A Certificate 2 Creating A Self-Signed Certificate 3 Obtaining A Signed Certificate 4 Enabling Secure Services 5 A Note About Ports 5 Connecting
Insecurity breeds at home
Insecurity breeds at home - Vulnerabilities in SOHO routers Amrita Center for Cyber Security Amrita University Small Office Home Office(SOHO) Routers 2 Problem at hand No technology available to detect/prevent
Kaspersky Security for Mobile Administrator's Guide
Kaspersky Security for Mobile Administrator's Guide APPLICATION VERSION: 10.0 SERVICE PACK 1 Dear User, Thank you for choosing our product. We hope that you will find this documentation useful and that
CHOOSING THE RIGHT PORTABLE SECURITY DEVICE. A guideline to help your organization chose the Best Secure USB device
CHOOSING THE RIGHT PORTABLE SECURITY DEVICE A guideline to help your organization chose the Best Secure USB device Introduction USB devices are widely used and convenient because of their small size, huge
Understanding the Pros and Cons of Combination Networks 7. Acknowledgments Introduction. Establishing the Numbers of Clients and Servers 4
Mac OS X System Administration GUY HART-DAVIS Mc Graw Hill New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul Singapore Sydney Toronto Acknowledgments Introduction,
Junos Pulse for Google Android
Junos Pulse for Google Android User Guide Release 4.0 October 2012 R1 Copyright 2012, Juniper Networks, Inc. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks
EZblue BusinessServer The All - In - One Server For Your Home And Business
EZblue BusinessServer The All - In - One Server For Your Home And Business Quick Start Guide Version 3.11 1 2 3 EZblue Server Overview EZblue Server Installation EZblue Server Configuration 4 EZblue Magellan
SECURITY TRENDS & VULNERABILITIES REVIEW 2015
SECURITY TRENDS & VULNERABILITIES REVIEW 2015 Contents 1. Introduction...3 2. Executive summary...4 3. Inputs...6 4. Statistics as of 2014. Comparative study of results obtained in 2013...7 4.1. Overall
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information
Securing your Linksys WRT54G
Securing your Linksys WRT54G Abstract Current implementations of the 802.11b and 802.11g wireless LAN standards have several potential pitfalls for security. However, built in security mechanisms in these
Topics in Network Security
Topics in Network Security Jem Berkes MASc. ECE, University of Waterloo B.Sc. ECE, University of Manitoba www.berkes.ca February, 2009 Ver. 2 In this presentation Wi-Fi security (802.11) Protecting insecure