Exactly the Same, but Different

Transcription

1 Exactly the Same, but Different 1 Shayne Champion, CISSP, CISA, GSEC, ABCP Program Manager GO Cyber Security TVA v1.0

2 Agenda Define Mobile Device Security o o Similarities Differences Things you Should be Doing 2

3 Mobile Device Security There is no question that mobile security will eventually equal if not surpass PC security as a threat to IT departments. Denise Culver, Heavy Reading Mobile Networks Insider 3

4 Mobile Device vs. Computers: SIMILARITIES 4

5 Definitions: Level Setting Com put er [kuhm-pyoo-ter] : An electronic device designed to accept data, perform prescribed mathematical and logical operations at high speed, and display the results of these operations. Mo bile De vice [moh-buhl dih-vahys] : A portable, wireless computing device that is small enough to be used while held in the hand; a hand-held. 5 Source:

6 6

7 NEWS FLASH: Mobile Devices ARE Computers!!! and we can do something about that, can t we? 7 Sources:

8 Same Kind of Different Same kind of security controls you *should* use anyway: Encryption NAC DLP AV / Malware Inventory Management Controlled Admin Privileges Port & Service Management 8

9 Similarity: Order of Magnitude Risk from an OSI perspective: Most risk shifting to applications Lower-level layers becoming relatively more tame 9 Source:

10 Define: Metadata Metadata : Data that defines or describes another piece of data. Metadata may reveal more about you, your organization, or your devices than you realize. Many devices, such as your computer, camera, or smart phone, automatically embed metadata in any digital files they create. 10 Source:

11 Metadata Some examples of metadata include: File creation date and time The address or geographic location where the file was created Your name, organization s name, and computer s name or IP address The names of any contributors to the document or their comments Type of camera you are using and its settings when the photo was taken Type of audio or video recording device you are using and its settings when a recording was taken Make, model, and service provider of your smart phone 11 Source:

12 Metadata Solutions Metadata Tools: Document Inspector : EXIF Metadata Explanation: Free Metadata Extraction Tool: or Disabling Geo-location for Smartphone Cameras 12 Source:

13 Unsecured WAP Sidejack Math * ( + )= Sidejacking - A well-known Wi-Fi hotspot attack that takes advantage of websites that don t use SSL/TLS encryption correctly by pirating the legitimate user s cookies and using those in the attacker s session (session hijacking) 13 Firesheep A Mozilla Firefox plug-in that automates session hijacking attacks over unsecured Wi-Fi networks. The packet sniffer analyzes traffic between a Wi-Fi router and a person s laptop or smartphone and captures the session cookie ("point-and-click" sidejacking) Source:

14 Mobile Device vs. Computers: DIFFERENCES 14

15 Risk Remediation Mobile Device risks are the same as many of the risks we already face everyday. For example 15 Source:

16 Difference 1: BYOD How do you handle user-owned devices? Applications Data Ownership Encryption SANS Survey: 16 NetworkWorld BYOD Survey: 65.3% necessary tools not in place 46.2% increased end user productivity 5.7% said it lead to breech, while 66.7% said no 47.2% increased end users' ability to work from home Source: SANS Mobility / BYOD Security Survey March

17 Difference 2: SMS SMS: Short Messaging Service, or text messages Common Vulnerabilities: 1) SMS of Death 2) Midnight Raid Business Card Attack 3) SMS Tokens 4) Smishing Attacks 17 Source:

18 SANS Survey: Platform Support 18 Source: SANS Mobility / BYOD Security Survey March 2012

19 SANS Survey: Platform Support 19 Source: SANS Mobility / BYOD Security Survey March 2012

20 Difference 3: Hardware / Carrier Each platform even within the same OS have unique characteristics, default settings, and/or vulnerabilities: PIN settings Service Carrier Like default passwords on routers or admin accounts iphone / ipad batteries Scope: Android Fragmentation 281+ different products 850,000 daily activations 300,000,000+ total devices 20 Sources:

21 Hardware / Carrier: PIN Codes Ten numbers represent 15% of all cell phone pass codes 21 Sources: Rooney, Ben (15 June 2011). "Once Again, 1234 Is Not A Good Password". The Wall Street Journal. Retrieved 8 July

22 Hardware / Carrier: PIN Codes Ten numbers represent 15% of all cell phone pass codes: 1) ) ) ) ) ) 5683 (spells 'LOVE') 7) ) ) ) 1998 Other popular choices include Year of birth & Year of graduation (social triangulation!). 22 Sources: Rooney, Ben (15 June 2011). "Once Again, 1234 Is Not A Good Password". The Wall Street Journal. Retrieved 8 July

23 PIN Code >>> Data Loss CASE STUDY: VERIZON WIRELESS Corporate Support Web Page How do I access my Voice Mail to retrieve messages? To access your Voice Mail, press "*VM" (*86), then "SEND." Follow the prompts to enter your password and retrieve your messages. If you press "*VM" (*86) and hear your own or a system greeting, press the # key to interrupt the greeting and follow the prompts to enter your password and retrieve your messages. 23 Source: and Optional Services/faq_voice_mail.html

24 Difference 4: Caller ID / ANI ANI : Automatic Number Identification (NAC for cell phones) Masquerading as the target cell number, threat actors may be able to steal unsecured data. Possible vectors include: VXML Social Engineering Orange Box Spoofing 24 Sources:

25 Social Engineering: Telco Social Hack Scenario: You pick up the phone, at the dial tone call AT&T Automated Operator: "AT&T,toplaceacall "Enter AT&T Automated Operator: "ThankyouforusingAT&T"<RING> Telus: ThisistheTelusoperator,Lisaspeaking.(or, ThisistheTelusoperator,whatnumberareyou callingfrom?) You: HiLisa,ThisistheTelustechnician,youshould seeananifailureonyourscreen,i'mcallingfrom [number to spoof] Ineedyoutoplaceatestcallto [number to call] Telus: ThankyoufromTelus 25 Source:

26 Threat Actors The APT in action 26 Source:

27 Application Vulnerabilities Native to many mobile OS (smart phone & tablet) Mobile Device Management (MDM) Default Permissions may be invasive e.g., Apple log file stores all visited geo-locations Open Web Application Security Consortium (OWASP) Application security is the next big trend in penetration testing which means it s already the big trend for hackers. Joe McCray, Strategic Security LLC 27 Source:

28 Lessons Learned Top 5 from the 2012 SANS Mobile Device Security Summit 1) Jailbreaking & Rooting is BAD for mobile device security 2) The OWASP Mobile Top 10 is going to be just as important 3) Mobile Threats are an evolving, moving target; security teams have to be quick to adapt to new mobile technology 4) Mobile Device Management (MDM) solutions are a requirement for any deployment 28 5) Apple ios devices are preferred over Android in the enterprise Source:

29 Things You Should Be Doing For many professionals, the mobile phone has become a mobile office. Mike Jones, Symantec 29

30 Control Starts at the Policy 30 Source: SANS Mobility / BYOD Security Survey March 2012

31 Mobile Policy Best Practices o o o Think from a threat controls perspective: Consider capabilities of mobile devices and apps in your environment Identify threat vectors & mitigate Identify non-technically enforceable controls and address with administrative policies & awareness Assess how mobile devices are already managed Use existing policies as a guideline Consider how to test successful control implementation 31 Source: SANS Mobility / BYOD Security Survey March 2012

32 2012 Top 5 Mobile Security Threats 1) Geolocation exploits 2) Excessive Permissions 3) Mobile Application Vulnerabilities 4) Unsecure Wi-Fi 5) Lost and Stolen Devices 32 Source:

33 Mobile Risk Management Tools 33 Source: SANS Mobility / BYOD Security Survey March 2012

34 Protecting the Mobile Executive Considerations for your Mobile Policy / Best Practices: USER EDUCATION Physical Security Fear Public Wireless Use Conference WAPs Corporate VPNs Leave it at Home Clean Loaner Devices Prepaid Cellular devices Blank SIM cards * + Google Voice 2G = No E! Don t Blab 34 Source:

35 Its About the Basics Verizon Business 2011 Data Breach Investigations Report (DBIR) Analysis of 2011 attacks determined that: 83% were targets of opportunity 92% were not highly difficult 95% were avoidable through simple or intermediate controls 35 Source:

36 SANS Top 20 Controls (v 3.1) 36 1: Inventory of Authorized and Unauthorized Devices 2: Inventory of Authorized and Unauthorized Software 3: Secure Configurations for Hardware and Software on Laptops, Workstations, & Servers 4: Continuous Vulnerability Assessment & Remediation 5: Malware Defenses 6: Application Software Security 7: Wireless Device Control 8: Data Recovery Capability 9: Security Skills Assessment and Appropriate Training to Fill Gaps 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches 11: Limitation and Control of Network Ports, Protocols, and Services 12: Controlled Use of Administrative Privileges 13: Boundary Defense 14: Maintenance, Monitoring, and Analysis of Security Audit Logs 15: Controlled Access Based on the Need to Know 16: Account Monitoring and Control 17: Data Loss Prevention 18: Incident Response Capability 19: Secure Network Engineering 20: Penetration Tests and Red Team Exercises

37 Summary Mobile Devices vs. Computers o o Similarities (yes Forrest, they are computers) Differences SMS Native Metadata Hardware / Carrier Issues (PINs, etc) Sidejacking Application Vulnerabilities 37 o o o o Things you Should be Doing Policies User Education Protect the Execs SANS Top 20 <-> Top 5 Mobile

38 38 Questions

39 New Mobile Security Tools Bleeding Edge Mobile Security Solutions 39

40 New Mobile Security Tools Can you hear me NOW, punk?!? 40

41 New Mobile Security Tools Android Security If you need to ask, you don t need to know. Really. 41 Source:

42 New Mobile Security Tools Sometimes Simple Security = Great Solutions 42

43 New Mobile Security Tools Hot from the UK: Less Mobile = Harder to Steal 43

44 New Mobile Security Tools Old School Tech 44

45 New Mobile Security Tools Keeping ahead of the Technology Curve 45 Source: