How to Enforce Security on a Mobile Phone With an Emergency

Transcription

1 Welcome to 2 nd Beer-Talk iphone Security Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax team@csnc.ch

2 Who am I? Riccardo Trombini, B.Sc. FHO in Computer Science Business ª Working in IT Security since 2000 ª Study Information Technologies at FH in Rapperswil SG ª IT Security Analyst, with Compass since 2009 Private ª In a relationship with ª Apple follower, always in the first row ª ios Developer ª Social Media enthusiast (fb, twitter, foursqure, instagram.. ) Slide 2

3 iphone Security Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

4 An Ideal World Centralized management with a MDM solution, to Enforce security policies Monitor status of devices Real-time incident handling Synchronization Encrypted channel Strong authentication Fully Protected Device Access Control Strong Encryption Vulnerabilities Fully Aware Users Slide 4

5 Sadly there is no such thing Centralized management with a MDM solution, to Enforce security policies Monitor status of devices Real-time incident handling Synchronization Encrypted channel Strong authentication Fully Protected Device Access Control Strong Encryption Vulnerabilities Fully Aware Users Slide 5

6 What is MDM? Mobile Device Management Centralized Management of mobile devices Slide 6

7 Functionality OTA Over The Air enrollment and profile distribution (config) Easy synchronisation of s, Calendar, Contacts,... Enforce compliance policy Monitor device status for inventory and compliance Device Information (UDID, ios Version, Modem Version..) Network Information (Carrier Settings, Data roaming status..) Compliance & Security (Installed profiles, certificates, passcode status..) Remote administration like Remote wipe Remote lock Passcode reset Locate device Slide 7

8 MDM!= MDM ios Integration Nativ ios Apps Compass Security AG Sandbox Client Slide 8

9 MDM!= MDM Network Design NOC (Network Operation Center) Slide 9

10 MDM!= MDM Network Design Direct Access to DMZ Slide 10

11 Demo #1 Break Passcode Protection Break File Encryption on iphone Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

12 ios Security Controls Encryption Full Disk Encryption Since iphone 3GS AES CBC 256 bit does only provide one reason: Rapid device wiping FDE pretty useless. Kernel transparently decrypts requested files Data Protection API Introduced with ios 4 Additional level of encryption File encryption can be tied to the Passcode Slide 12

13 ios Security Controls Encryption - Data Protection API File Meta Data Device Key File Key Class Key User Passcode Key Slide 13

14 BootRom-Attack Slide 14

15 Summary User Awareness - Always know where your device is! Enforce strong Passcode Policy with MDM! Length Alphanumeric Special characters C0mpa$$ don t! Usability? Slide 15

16 LiveDemo [Free-WiFi-CertPush-Attack] Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel Fax

17 Free-WiFi-Cert-Push-Attack WiFi-MidM Free-WiFi Yeah! FreeWiFi available Compass Security AG Slide 17

18 Free-WiFi-Cert-Push-Attack The Problem with the Certificate. Slide 18

19 Free-WiFi-Cert-Push-Attack The Solution ;-) Slide 19

20 Free-WiFi-Cert-Push-Attack Behavior of the iphone HTTP GET request OK Redirect Hotspot Login-Site Hotspot Management Slide 20

21 Free-WiFi-Cert-Push-Attack Cert-Push HTTP GET request Redirect Mobile Conficuration Attacker Host Slide 21

22 Free-WiFi-Cert-Push-Attack Make your own Apple Certificate Slide 22

23 Free-WiFi-Cert-Push-Attack Result Slide 23

24 Free-WiFi-Cert-Push-Attack MitM with valid Cert Free-WiFi Attacker Host Slide 24

25 Summary User Awareness Think before accepting configurations Be suspicious Apple should improve certificate validation for mobile configuration Synchronization should be protected with two-way authentication Slide 25

26 Questions? Slide 26

27 Slide 27