Vulnerability Analysis and Attacks on NFC enabled Mobile Phones
|
|
|
- Emma Osborne
- 8 years ago
- Views:
Transcription
1 Vulnerability Analysis and Attacks on NFC enabled Mobile Phones Collin Mulliner Fraunhofer SIT (Darmstadt, Germany) 1st International Workshop on Sensor Security March 2009 Fukuoka, Japan 1
2 Near Field Communication (NFC) Bidirectional proximity coupling technology NFC devices support three modes of operation Based on 13,56Mhz RFID ISO14443 and FeliCa PCD (read/write), PICC (card emu), peer to peer Standardized data formats on tags NFC Data Exchange Format (NDEF) 2
3 Introduction NFC phones and services are just being introduced into the public (outside of Japan!) NFC is designed for payment and ticketing Security is essential Current devices and services use passive tags Large scale use in the future because of low price Our work focused on interaction with passive tags 3
4 Contributions Methods for vulnerability analysis of NFC enabled mobile phones Developed tools for security testing of NFC mobile phones and NFC services Multiple novel attacks against NFC mobile phones and services 4
5 An NFC Mobile Phone Mobile phone that also integrates NFC chip and antenna and possible a smart card NFC system constantly scans for and reads tags Tag data is processed by either OS functionality or third party application Third party application can take control of NFC functionality for arbitrary use 5
6 An NFC Mobile Phone Nokia 6131 NFC 6
7 Analyzing an NFC Mobile Phone Interaction with passive tags (NDEF format) J2ME NFC API (JSR 257) What formats are supported, what can be attacked? Can the API be abused for attacks? System components that can be controlled through NFC Do these components have issues that can be abused through the NFC interface? 7
8 NDEF Security Toolkit Flexible implementation of the NDEF standard Arbitrary modification of format and data Tag reading/writing, dumping tools Immune against malformed data Test lab version (use with desktop computer) Mobile phone version for analyzing services 8
9 NDEF Fuzzing Fuzzing is a good choice when testing without access to source code Fuzzing procedure required a human operator Manually moved tag between writer and phone Found multiple vulnerabilities Tested phone crashes and resets 9
10 NDEF Smart Poster URIs are technical and not suited for the user Smart Poster allows to display information in addition to URI Human readable text Image (optional) URI: sms: ?body=fahrschein Title: Für Fahrscheinkauf (Eur 1,70) jetzt senden! 10
11 Smart Poster URI Spoofing Smart Poster display problem Informational text can be used to prevent the URI from being displayed Text can be used to spoof the URI Smart Poster details view can also be manipulated Show innocent looking URI to trick user into opening it! 11
12 Smart Poster URI Spoofing Attacks Web Browser Load malicious site (URL not displayed on phones) Web based Man in the Middle attack Steal credentials or inject malicious content Mobile Telephony Service Premium rate phone call or SMS 12
13 Example: Attacking the Mobile Telephony Service Title: Tourist Information\r \r\r\r\r\r\r. URI: tel:
14 Proof of Concept NFC Worm Push registry allows registration for plain URI App can intercept all tag read events for URI tags Basic idea: writable tags as transport for worm Use URI spoofing to hide the worm install URL Exploit phone's web browser vulnerabilities Silent/automatic install + ask user to run application Spreads by writing URL pointing to itself to tag Worm is activated by phone reading plain URI tag 14
15 Denial of Service Attacks Destroy trust relationship between customer and the service provider Competitor or prankster Sticky paper tag on top of service provider tag Data on tag causes the NFC phone to crash Paper tag cannot be linked to crash since it looks just like a sticker Attacks found through fuzzing 15
16 Security of NFC based Services Survey to verify that attacks are practical today All services only use built in functionality Three services surveyed in Vienna, Austria No additional software is installed onto user phones Survey was conducted using a NFC phone running our security toolkit applications 16
17 Wiener Linien SMS based ticketing (NDEF Smart Poster) Phone number can be spoofed Victim sends SMS to premium rate number 17
18 Selecta Vending Machines Mobile phone payment via SMS Phone number can be spoofed Payment can be redirect to another machine 18
19 Vienna ÖBB Handy Ticket Link to online ticket shop URL spoofed for Man in the Middle attack Steal credentials or inject malware 19
20 Conclusions We showed how NFC mobile phones and services can be analyzed for security Non NFC components also need to be taken into account We introduced a new set of attacks Attacks target both phones and services Attacks can be utilized for fraud, worms, phishing, and Denial of Service 20
21 Future Work Improve fuzzing process through automation Follow development of NFC New devices and features More complex services 21
22 Questions? Thank you for your attention! 22
Attacking NFC Mobile Phones
Attacking NFC Mobile Phones Collin Mulliner Fraunhofer SIT EUSecWest May 2008 London, UK CollinMullinerAttackingNFCMobilePhonesEUSecWest2008 Attacking NFC Mobile Phones A first look at NFC Phone Security
Course Content: Session 1. Ethics & Hacking
Course Content: Session 1 Ethics & Hacking Hacking history : How it all begin Why is security needed? What is ethical hacking? Ethical Hacker Vs Malicious hacker Types of Hackers Building an approach for
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS www.kaspersky.com 2 Fraud Prevention for Endpoints KASPERSKY FRAUD PREVENTION 1. Ways of Attacking The prime motive behind cybercrime is making money, and today
Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities
Kaspersky Fraud Prevention: a Comprehensive Protection Solution for Online and Mobile Banking
Kaspersky Fraud Prevention: a Comprehensive Protection Solution for Online and Mobile Banking Today s bank customers can perform most of their financial activities online. According to a global survey
Security Evaluation CLX.Sentinel
Security Evaluation CLX.Sentinel October 15th, 2009 Walter Sprenger walter.sprenger@csnc.ch Compass Security AG Glärnischstrasse 7 Postfach 1628 CH-8640 Rapperswil Tel.+41 55-214 41 60 Fax+41 55-214 41
Overview of computer and communications security
Overview of computer and communications security 2 1 Basic security concepts Assets Threats Security services Security mechanisms 2 Assets Logical resources Information Money (electronic) Personal data
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilities
Overview of the Penetration Test Implementation and Service. Peter Kanters
Penetration Test Service @ ABN AMRO Overview of the Penetration Test Implementation and Service. Peter Kanters ABN AMRO / ISO April 2010 Contents 1. Introduction. 2. The history of Penetration Testing
APPFORUM2014. Helping the developer community build next-generation, multi-platform apps. SCHAUMBURG, ILLINOIS SEPTEMBER 8-10
APPFORUM2014 Helping the developer community build next-generation, multi-platform apps. SCHAUMBURG, ILLINOIS SEPTEMBER 8-10 NFC OVERVIEW Chuck Bolen Chief Architect Enterprise Mobile Computing APPFORUM2014
Security Challenges for User-Oriented RFID Applications within the Internet of Things
Security Challenges for User-Oriented RFID Applications within the Internet of Things G.P. HANCKE, K. MARKANTONAKIS and K.E. MAYES ISG Smart Card Centre Royal Holloway, University of London UNITED KINGDOM
All Your Mobile Applications Are Belong To Us
Security Art September 2011 All Your Mobile Applications Are Belong To Us Itzik Kotler, Chief Technology Officer www.security-art.com Hello Motto, Hello Hacker Mobile phones are no longer only for making
Mobile NFC 101. Presenter: Nick von Dadelszen Date: 31st August 2012 Company: Lateral Security (IT) Services Limited
Mobile NFC 101 Presenter: Nick von Dadelszen Date: 31st August 2012 Company: Lateral Security (IT) Services Limited Company Lateral Security (IT) Services Limited Company Overview Founded in April 2008
Android Commercial Spyware Disease and Medication
Android Commercial Spyware Disease and Medication By Eng. Mustafa Saad Computer Engineer 2003 Mobile App Developer 2011 Mobile Security Researcher 2012 Udemy Premium Instructor 2014 March 2016 Agenda Introduction.
Sitefinity Security and Best Practices
Sitefinity Security and Best Practices Table of Contents Overview The Ten Most Critical Web Application Security Risks Injection Cross-Site-Scripting (XSS) Broken Authentication and Session Management
Technical Article. NFiC: a new, economical way to make a device NFC-compliant. Prashant Dekate
Technical NFiC: a new, economical way to make a device NFC-compliant Prashant Dekate NFiC: a new, economical way to make a device NFC-compliant Prashant Dekate The installed base of devices with Near Field
Ethical Hacking & Cyber Security Workshop
Ethical Hacking & Cyber Security Workshop i3indya Technologies (A unit of ithree Infotech Pvt. Ltd.) Delhi Office: 37, First Floor, Defence Enclave, Preet Vihar, New Delhi-110092 Contact us: Email: info@i3indya.com
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter conpap@owasp.gr
How To Get Rid Of A Phish Locker On A Computer (For A Bank)
PHISH LOCKERS OUT IN THE WILD August 2013 RSA researchers have been increasingly witnessing the activity of highly targeted Trojans, dubbed Phish Lockers, used at the hands of cybercriminals to steal credentials.
Threat Modeling for offline NFC Payments
Threat Modeling for offline NFC Payments 1 Fan Jia, 2 Yong Liu, 3 Li Zhang *1,Corresponding Author,2 Key Laboratory of Communication and Information Systems, Beijing Jiaotong University, Beijing, China,
NFC Near Field Communication
NFC Near Field Communication Gregor Hohpe 2010 Google, Inc. All rights reserved, Core Technology Passive card powered by radio field 212kbps, 100ms read/write cycle Authentication, data integrity protection
Integrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com
SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration
The risks borne by one are shared by all: web site compromises
The risks borne by one are shared by all: web site compromises Having your company web site hacked or compromised can be a costly experience for your organisation. There are immediate costs in responding
Personal Data Security. Grand Computers Club New Technologies SIG May 21, 2014
Personal Data Security Grand Computers Club New Technologies SIG May 21, 2014 Topics Meeting Overview New Tech Newsletter Main Topic: Personal Data Security Open Discussion Questions 2 Overview Data privacy
Web Application Penetration Testing
Web Application Penetration Testing 2010 2010 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Will Bechtel William.Bechtel@att.com
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
FSOEP Web Banking & Fraud: Corporate Treasury Attacks
FSOEP Web Banking & Fraud: Corporate Treasury Attacks Your Presenters Who Are We? Tim Wainwright Managing Director Chris Salerno Senior Consultant Led 200+ penetration tests Mobile security specialist
Top tips for improved network security
Top tips for improved network security Network security is beleaguered by malware, spam and security breaches. Some criminal, some malicious, some just annoying but all impeding the smooth running of a
Cross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer (fabrice.bodmer@unifr.ch) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
NFC. Technical Overview. Release r05
Release r05 Trademarks The Bluetooth word mark and logos are owned by the Bluetooth SIG, Inc. and any use of such marks by Stollmann E+V GmbH is under license. Other trademarks and trade names are those
Man-in-the-Middle Attacks against the chiptan comfort Online Banking System
Man-in-the-Middle Attacks against the chiptan comfort Online Banking System RedTeam Pentesting GmbH November 23, 2009 ChipTAN comfort is a new system which is supposed to securely authorise online banking
Be Prepared for Java Zero-day Attacks
Threat Report Be Prepared for Java Zero-day Attacks Malware Analysis: Malicious Codes spread via cloud-based data storage services December 19, 2013 Content Overview... 3 Distributing Malicious E-mails
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
You don t hear me but your phone s voice interface does. José LOPES ESTEVES & Chaouki KASMI
You don t hear me but your phone s voice interface does José LOPES ESTEVES & Chaouki KASMI Hack In Paris - 18/06/2015 WHO WE ARE José Lopes Esteves and Chaouki Kasmi ANSSI-FNISA / Wireless Security Lab
Six Essential Elements of Web Application Security. Cost Effective Strategies for Defending Your Business
6 Six Essential Elements of Web Application Security Cost Effective Strategies for Defending Your Business An Introduction to Defending Your Business Against Today s Most Common Cyber Attacks When web
Using RFID Techniques for a Universal Identification Device
Using RFID Techniques for a Universal Identification Device Roman Zharinov, Ulia Trifonova, Alexey Gorin Saint-Petersburg State University of Aerospace Instrumentation Saint-Petersburg, Russia {roman,
OWASP AND APPLICATION SECURITY
SECURING THE 3DEXPERIENCE PLATFORM OWASP AND APPLICATION SECURITY Milan Bruchter/Shutterstock.com WHITE PAPER EXECUTIVE SUMMARY As part of Dassault Systèmes efforts to counter threats of hacking, particularly
Big Data in Action: Behind the Scenes at Symantec with the World s Largest Threat Intelligence Data
Big Data in Action: Behind the Scenes at Symantec with the World s Largest Threat Intelligence Data Patrick Gardner VP Engineering Sourabh Satish Distinguished Engineer Symantec Vision 2014 - Big Data
Factoring Malware and Organized Crime in to Web Application Security
Factoring Malware and Organized Crime in to Web Application Security Gunter Ollmann - VP of Research gollmann@damballa.com Blog - http://blog.damballa.com Blog - http://technicalinfodotnet.blogspot.com
An NFC Ticketing System with a new approach of an Inverse Reader Mode
An NFC Ticketing System with a new approach of an Inverse Reader Mode Christian Saminger, Stefan Grünberger and Josef Langer NFC University of Applied Sciences Upper Austria 5 th International Workshop
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure that
Comparing Application Security Tools
Comparing Application Security Tools Defcon 15-8/3/2007 Eddie Lee Fortify Software Agenda Intro to experiment Methodology to reproduce experiment on your own Results from my experiment Conclusions Introduction
Running Head: AWARENESS OF BYOD SECURITY CONCERNS 1. Awareness of BYOD Security Concerns. Benjamin Tillett-Wakeley. East Carolina University
Running Head: AWARENESS OF BYOD SECURITY CONCERNS 1 Awareness of BYOD Security Concerns Benjamin Tillett-Wakeley East Carolina University AWARENESS OF BYOD SECURITY CONCERNS 2 Abstract This paper will
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望 Agenda Information Security Trends Year 2014 in Review Outlook for 2015 Advice to the Public Hong Kong Computer Emergency Response Team Coordination
Using a Malicious Proxy to Pilfer Data & Wreak Havoc. Edward J. Zaborowski ed@thezees.net
Using a Malicious Proxy to Pilfer Data & Wreak Havoc Edward J. Zaborowski ed@thezees.net Abstract...3 Malicious Web Proxy...3 Becoming the Proxy...3 ARP Spoofing...3 Static Configuration...3 Web Proxy
Business through Mobile Phone initiated Near Field Communication
Business through Mobile Phone initiated Near Field Communication Josef Noll 1, Juan Carlos Lopez Calvet, Telenor R&D,, N-1331 Fornebu josef@unik.no, juan.calvet@telenor.com 1 from 1.6.2005 Prof. stip.
Phishing Activity Trends Report June, 2006
Phishing Activity Trends Report, 26 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account
GlobalSign Malware Monitoring
GLOBALSIGN WHITE PAPER GlobalSign Malware Monitoring Protecting your website from distributing hidden malware GLOBALSIGN WHITE PAPER www.globalsign.com CONTENTS Introduction... 2 Malware Monitoring...
Cloud Storage Security
Cloud Storage Security Sven Vowé Fraunhofer Institute for Secure Information Technology (SIT) Darmstadt, Germany SIT is a member of CASED (Center for Advanced Security Research Darmstadt) Cloud Storage
Malware & Botnets. Botnets
- 2 - Malware & Botnets The Internet is a powerful and useful tool, but in the same way that you shouldn t drive without buckling your seat belt or ride a bike without a helmet, you shouldn t venture online
Monitoring mobile communication network, how does it work? How to prevent such thing about that?
Monitoring mobile communication network, how does it work? How to prevent such thing about that? 潘 維 亞 周 明 哲 劉 子 揚 (P78017058) (P48027049) (N96011156) 1 Contents How mobile communications work Why monitoring?
Internet Banking Attacks. Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz
Internet Banking Attacks Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz Contents Agenda Internet banking today The most common attack vectors The possible countermeasures What protection
Relay Attacks in EMV Contactless Cards with Android OTS Devices
Relay Attacks in EMV Contactless Cards with Android OTS Devices José Vila, Ricardo J. Rodríguez pvtolkien@gmail.com, rj.rodriguez@unileon.es All wrongs reversed Computer Science and Research Institute
Web Application Security
E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary
Protection for Mac and Linux computers: genuine need or nice to have?
Protection for Mac and Linux computers: genuine need or nice to have? The current risk to computers running non-windows platforms is small but growing. As Mac and Linux computers become more prevalent
Current Threat Scenario and Recent Attack Trends
Current Threat Scenario and Recent Attack Trends Anil Sagar Additional Director Indian Computer Emergency Response Team (CERT-In) Objectives Current Cyber space Nature of cyberspace and associated risks
NFC Test Challenges for Mobile Device Developers Presented by: Miguel Angel Guijarro miguel-angel_guijarro@agilent.com
NFC Test Challenges for Mobile Device Developers Presented by: Miguel Angel Guijarro miguel-angel_guijarro@agilent.com 1 Outlook About NFC Developing a NFC Device Test Challenges Test Solutions Q&A 2 What
Security in Near Field Communication (NFC)
Security in Near Field Communication (NFC) Strengths and Weaknesses Ernst Haselsteiner and Klemens Breitfuß Philips Semiconductors Mikronweg 1, 8101 Gratkorn, Austria ernst.haselsteiner@philips.com klemens.breitfuss@philips.com
Smart Card APDU Analysis
Smart Card APDU Analysis Black Hat Briefings 2008 Las Vegas Ivan "e1" Buetler ivan.buetler@csnc.ch Compass Security AG - Switzerland Compass Security AG Glärnischstrasse 7 Postfach 1628 CH-8640 Rapperswil
NFC Mobile Handset High Level Requirements V2
NFC Mobile Handset High Level Requirements V2 Release 2.0 Date : 28/09/2011 Reference: 110928 - AFSCM TECH - LIVBL - NFC Mobile Handset High Level Requirements - v2.0.doc AFSCM NFC Mobile Handset High
Frequently Asked Questions
Frequently Asked Questions NFC for Consumers What is NFC? Near Field Communication (NFC) is a short-range wireless connectivity technology standard designed for intuitive, simple, and safe communication
Cloud Services Prevent Zero-day and Targeted Attacks
Cloud Services Prevent Zero-day and Targeted Attacks WOULD YOU OPEN THIS ATTACHMENT? 2 TARGETED ATTACKS BEGIN WITH ZERO-DAY EXPLOITS Duqu Worm Causing Collateral Damage in a Silent Cyber-War Worm exploiting
10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)
1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction
Phishing Activity Trends
Phishing Activity Trends Report for the Month of, 27 Summarization of Report Findings The number of phishing reports received by the (APWG) came to 23,61 in, a drop of over 6, from January s previous record
Practical tips for a. Safe Christmas
Practical tips for a Safe Christmas CONTENTS 1. Online shopping 2 2. Online games 4 3. Instant messaging and mail 5 4. Practical tips for a safe digital Christmas 6 The Christmas holidays normally see
CYBERSECURITY INESTIGATION AND ANALYSIS
CYBERSECURITY INESTIGATION AND ANALYSIS The New Crime of the Digital Age The Internet is not just the hotspot of all things digital and technical. Because of the conveniences of the Internet and its accessibility,
CYBERCRIMINAL IN BRAZIL SHARES MOBILE CREDIT CARD STORE APP
CYBERCRIMINAL IN BRAZIL SHARES MOBILE CREDIT CARD STORE APP August 2014 RSA agents recently traced a threat actor advertising a mobile credit card store application. The cybercriminal shared the information
How Attackers are Targeting Your Mobile Devices. Wade Williamson
How Attackers are Targeting Your Mobile Devices Wade Williamson Today s Agenda Brief overview of mobile computing today Understanding the risks Analysis of recently discovered malware Protections and best
Post-Access Cyber Defense
Post-Access Cyber Defense Dr. Vipin Swarup Chief Scientist, Cyber Security The MITRE Corporation November 2015 Approved for Public Release; Distribution Unlimited. 15-3647. 2 Cyber Security Technical Center
Analysis of advanced issues in mobile security in android operating system
Available online atwww.scholarsresearchlibrary.com Archives of Applied Science Research, 2015, 7 (2):34-38 (http://scholarsresearchlibrary.com/archive.html) ISSN 0975-508X CODEN (USA) AASRC9 Analysis of
Tahoe Tech Group serves as your technology partner with a focus on providing cost effective and long term solutions.
Tahoe Tech Group LLC Cyber Security Briefing Truckee Donner Chamber of Commerce March 6, 2015 Tahoe Tech Group serves as your technology partner with a focus on providing cost effective and long term solutions.
The Mobile Malware Problem
The Mobile Malware Problem Eddy Willems Security Evangelist G Data Security Labs Director Security Industry Relationships - EICAR eddy.willems@gdata.de Introduction Security Evangelist at G Data: Privately
This session was presented by Jim Stickley of TraceSecurity on Wednesday, October 23 rd at the Cyber Security Summit.
The hidden risks of mobile applications This session was presented by Jim Stickley of TraceSecurity on Wednesday, October 23 rd at the Cyber Security Summit. To learn more about TraceSecurity visit www.tracesecurity.com
Learn Ethical Hacking, Become a Pentester
Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,
NFC Testing. Near Field Communication Research Lab Hagenberg. Gerald Madlmayr. NFC Research Lab, Hagenberg. E-Smart 2008, Sophia Antipolis
NFC Testing Gerald Madlmayr NFC, E-Smart 2008, Sophia Antipolis 1 NFC Research Topics Software: Contactless Applications and Infrastructure Hardware: Testing & Interoperability Security Usability Founded
Mobile Device Security: What s Coming Next?
Mobile Device Security: What s Coming Next? By James Lyne, Director of Technology Strategy The mobile device revolution is quite possibly the most significant change in computing since we shifted from
DDoS Attacks: The Latest Threat to Availability. Dr. Bill Highleyman Managing Editor Availability Digest
DDoS Attacks: The Latest Threat to Availability Dr. Bill Highleyman Managing Editor Availability Digest The Anatomy of a DDoS Attack Sombers Associates, Inc. 2013 2 What is a Distributed Denial of Service
Protecting against Mobile Attacks
2014-APR-17 Protecting against Mobile Attacks Frankie Wong Security Analyst, HKCERT 1 Image source: http://www.techweekeurope.co.uk/news/mobile-malware-record-mcafee-125537 2 Agenda Attacks moving to mobile
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
Loyalty Systems over Near Field Communication (NFC)
Loyalty Systems over Near Field Communication (NFC) Diogo Simões IST - Technical University of Lisbon Av. Prof. Cavaco Silva Tagus Park 2780-990 Porto Salvo, Portugal diogo.simoes@tagus.ist.utl.pt Abstract.
Mobile Commerce. Deepankar Roy, Ph.D. National Institute of Bank Management, Pune, India
Mobile Commerce Deepankar Roy, Ph.D. National Institute of Bank Management, Pune, India Outline What is mobile commerce? What are the different ways through which mobile commerce happens? Mobile Commerce
Detailed Description about course module wise:
Detailed Description about course module wise: Module 1: Basics of Networking and Major Protocols 1.1 Networks and its Types. 1.2 Network Topologies 1.3 Major Protocols and their Functions 1.4 OSI Reference
Future of Mobile App Security. Vincent Sritapan Program Manager Cyber Security Division Science and Technology Directorate
Future of Mobile App Security Vincent Sritapan Program Manager Cyber Security Division Science and Technology Directorate Do You Know What Your Apps Are Doing? Spying Microphone & camera surveillance $
Your Mobile Phone as a Ticket (NFC)
Your Mobile Phone as a Ticket (NFC) Francisco Maria van Uden Chaves IST - Technical University of Lisbon Av. Prof. Cavaco Silva Tagus Park 2780-990 Porto Salvo, Portugal francisco.chaves@ist.utl.pt Abstract.
Application Security from IBM Karl Snider, Market Segment Manager March 2012
Application Security from IBM Karl Snider, Market Segment Manager March 2012 1 2012 IBM Corporation Helping Solve Customer Challenges Application Security Finding Application Vulnerabilities GlassBox scanning
The Security Risks of Mobile Payment Applications Using Near-Field Communication
Erasmus University Rotterdam Economics & Informatics Erasmus School of Economics Master Thesis The Security Risks of Mobile Payment Applications Using Near-Field Communication Author: Raymond Vermaas Studentnumber
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Spammer and Hacker, Two Old Friends
Spammer and Hacker, Two Old Friends Pedram Hayati, Vidyasagar Potdar Digital Ecosystem and Business Intelligence Institute Curtin University of Technology Perth, WA, Australia pedram.hayati@postgard.curtin.edu.au,
Tespok Kenya icsirt: Enterprise Cyber Threat Attack Targets Report
Tespok Kenya icsirt: Enterprise Cyber Threat Attack Targets Report About this Report This report was compiled and published by the Tespok icsirt in partnership with the Serianu Cyber Threat Intelligence
Internet Security. For Home Users
Internet Security For Home Users Basic Attacks Malware Social Engineering Password Guessing Physical Theft Improper Disposal Malware Malicious software Computer programs designed to break into and create
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
Easy To Use PDDOS. :Burner Phone DDOS 2 Dollars a day:70 Calls a Min Weston Hecker Security Expert
A1 Easy To Use PDDOS :Burner Phone DDOS 2 Dollars a day:70 Calls a Min Weston Hecker Security Expert Systems Network Analyst/Penetrations Tester/President Of Computer Security Association Of North Dakota
INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION
INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION Prepared for the NRC Fuel Cycle Cyber Security Threat Conference Presented by: Jon Chugg, Ken Rohde Organization(s): INL Date: May 30, 2013 Disclaimer
Online Payments Threats
July 3, 2012 Introduction...2 Tested Products...2 Used Configuration...3 Real Malware Inspiration...3 Total Scores Chart...4 Conclusion...4 About matousec.com...4 Detailed Descriptions of Tests...5 Detailed
Almost 400 million people 1 fall victim to cybercrime every year.
400,000000 Almost 400 million people 1 fall victim to cybercrime every year. A common way for criminals to attack people is via websites, unfortunately this includes legitimate sites that have been hacked
Using Free Tools To Test Web Application Security
Using Free Tools To Test Web Application Security Speaker Biography Matt Neely, CISSP, CTGA, GCIH, and GCWN Manager of the Profiling Team at SecureState Areas of expertise: wireless, penetration testing,
NACCU 2013. Migrating to Contactless: 2013 1
NACCU 2013 Migrating to Contactless: 2013 1 AGENDA The demise of cards has been predicted for many years. When will this really happen? This presentation by two card industry experts will cover the rise