Security Support in Mobile Platforms (part I) Vincent Naessens - MSEC

Transcription

1 Security Supprt in Mbile Platfrms (part I) Vincent Naessens - MSEC

2 Security Mechanisms in Mbile Platfrms 1. Platfrm Supprt fr Data and Credential Prtectin 2. App Distributin 3. App Islatin 4. Mbile Device Management

3 Mbile Device Encryptin Systems 1. Different appraches t encrypt assets File encryptin vs file system encryptin Key derivatin mechanisms 2. Different cnfiguratin strategies Develper cnfiguratin End user r MDM cnfiguratin 3. Different strategies applied by app develpers Rely n platfrm security functins Develpment f prprietary slutins

4 Key Derivatin Mdule user input secure element KDF Encryptin Mdule Carse grained encryptin Fine grained encryptin file system keystre

5 Assumptins and attack scenaris Assumptins 1. Cryptgraphic algrithms are crrectly implemented 2. Stlen device is nt jailbreaked/rted yet 3. Attacker steals with gal t retrieve data, and is security expert Attack scenaris 1. Attacks n the encryptin system 2. Attacks n the key derivatin mechanism 3. Attacks n unfeasible cnfiguratin r weak develpment Key Derivatin Mdule user input secure element KDF Carse grained encryptin Encryptin Mdule Fine grained encryptin file system keystre

6

7 The Andrid encryptin system Key Derivatin Mdule user input KDF Encryptin Mdule Carse grained encryptin file system keystre

8 The Andrid encryptin system Encryptin system file system encryptin based n dm-crypt in Linux kernel keychain encrypted with AES key sme vendrs have extended Andrid functinality t supprt encryptin f external strage media Key derivatin PIN/passcde cmbined with salt PBKDF2 (i.e. repeating SHA1 many times) 128 bit AES key used t decrypt master key Offline attacks are pssible!!!

9 The Andrid encryptin system Cnfiguratin ptins and develper decisins User (BYOD) r administratr (MDM) file system encryptin is nt enabled by default Length f passwrd r PIN impact n security MDM can enfrce minimum passwrd lenghts Applicatin develpers Needs t decide where t stre cnfidential data May nt assume that users cnfigure device well

10 The ios encryptin system Key Derivatin Mdule secure element KDF Key Derivatin Mdule user input secure element KDF Encryptin Mdule Carse grained encryptin Encryptin Mdule Fine grained encryptin file system keystre file system keystre

11 The ios encryptin system ios Hardware Security Features Every ios device has AES256 crypt engine in DMA path between flash strage and RAM UID en GID are 256 bit AES keys fused in applicatin prcessr N direct access by SW r firmware Keys cannt be tampered All ther keys are generated by RNG based n Yarrw

12 The ios encryptin system Encryptin system File system encryptin system (since ios 3.x) File system encryptin with EMF key EMF key is encrypted by UID that is stred in secure element Offline attacks are very hard!!! Decryptin pssible by jailbreaking/rting device!!! Data Prtectin API (since ios 4) Encryptin based n prtectin classes defined by develpers Prtectin class defines when encryptin keys are available - File prtectin NSFilePrtectin - KeyChain prtectin ksecattaccessible

13 The ios encryptin system NSFilePrtectin ksecattraccessible Nne Always N file prtectin Cmplete WhenUnlcked Keys available until device is lcked UntilFirstUserAuth AfterFirstUnlck Keys available until shutdwn CmpleteUnlessOpen --- Keys available as lng as files are pen Secure element and passcde required except fr Nne and Always Remark: KeyChain prtectin classes DeviceOnly versin: keys cannt be transferred t backups

14 The ios encryptin system Key derivatin File system encryptin system Attack by jailbreaking, key derivatin nt relevant Data Prtectin system PBKDF2 with input based n passwrd, UID key and salt time SHA (90 msec per trial) - 6 character alphanumeric passcde 5,5 years t try all cmbinatins - 9 digit passcde 2,5 years t try all cmbinatins Brute frce attack is slwed dwn Brute frce attack cannt be perfrmed ffline

15 The ios encryptin system Key derivatin different security level fr backups PBKDF2 functin is used but n UID invlved Hence, ffline attacks are pssible Hw t attack backup n itunes device? Unencrypted backup cpy whle backup Encrypted backup brute frce attack (ffline)

16 The ios encryptin system Cnfiguratin/develper File system based encryptin system enabled by default Data prtectin system is activated if: 1. Device passcde is set 2. Develper has chsen crrect prtectin classes fr app files Rule 1: select high cmplexity class f passcde pwd length, screen lck, time-uts, Rule 2: cnfigure gd backup ptins Encrypted versus plain backups n itunes Activating/deactivating itunes/iclud backups Strength f passcde is imprtant!

17 The ios encryptin system Cnfiguratin/develper Develpers influences vital aspects f encryptin system security 1. Specifies prtectin classes fr files and KeyChain entries NSFilePrtectin ksecattraccessible Nne Always N file prtectin Cmplete WhenUnlcked Keys available until device is lcked UntilFirstUserAuth AfterFirstUnlck Keys available until shutdwn CmpleteUnlessOpen --- Keys available as lng as files are pen 2. Decides whether a file is included in itunes/iclud backup - Backup flags (kcfurlisexcludedfrmbackupkey)

18 Prtectin f keychain items defined by ios

19 ios passcde and lck cnfiguratin

20 Lessns learnt Decrypting files and credentials in the Andrid Platfrm Master secret is encrypted with key based n passcde Offline brute-frce attack t reveal passcde pssible N file system encryptin by default Decrypting files and credentials in the ios Platfrm Security based n passcde and secure element Offline brute-frce attacks are hard feasible develper and cnfiguratin ptins are crucial

21 Lessns learnt ios platfrm ffers a better level f prtectin KDF based n passcde & secure element High security level can be achieved if right decisins are taken Develper: prtectin classes + backup flags User/administratr: passcde cmplexity + backup ptins Prblem: user/administratr d nt knw if right develpment ptins are taken

22 Security Mechanisms in Mbile Platfrms 1. Platfrm Supprt fr Data and Credential Prtectin 2. App Distributin 3. App Islatin 4. Mbile Device Management

23 2. App Distributin Andrid Marketplace Little applicatin vetting Pssible t install apps utside Ggle Play Apps are asking t much privileges Apple App Stre Strng identificatin f app develpers Static analysis f binaries Little app permissins shwn t users

24 3. App Islatin Sandbxing Each app runs with a distinct system identity N peratins allwed that wuld impact ther apps Each app is installed in its wn cntainer Malicius app is limited t that cntainer Permissins/entitlements Little cntrl n permissins Permissins are displayed t user at install time Sharing data thrugh external strage Larger cntrl n permissins Very little app permissins shwn t users N SD cards allwed

25 4. Mbile Device Management Mbile Device Management 1. Remte wiping 2. Plicy enfrcement Ggle Apps Device Plicy (full MDM) FindMyPhne (remte wipe + find lst device)

26 references 1. Peter Teufl, Thmas Zefferer, Christf Strmberger - "Mbile Device Encryptin Systems" - 28th IFIP TC-11 SEC 2013 Internatinal Infrmatin Security and Privacy Cnference 2. Andrid vs. Apple ios Security Shwdwn Tm Estn 3. ios Security, May Apple ios 4 Security Evaluatin Din A. Dai Zvi 5. Lst iphne? Lst Passwrds! Practical Cnsideratin f ios Device Encryptin Security Jens Heider, Matthias Bll 6. Ggle Andrid: A Cmprehensive Security Assessment - Shabtai, A., Fledel, Y., Kannv, U., Elvici, Y., Dlev, S., Glezer, C.