Agenda. John Veldhuis, Sophos The playing field Threats Mobile Device Management. Pagina 2

Transcription

1 Mobile Security

2 Agenda John Veldhuis, Sophos The playing field Threats Mobile Device Management Pagina 2

3 The Changing Mobile World Powerful devices Access everywhere Mixed ownership User in charge

4 Powerful devices Music player Personal Calendar Internet Company Text messages Chat Photos File store Banking 4

5 Access everywhere In the office In the coffee shop Whilst travelling At home

6 Mixed ownership Employee-owned devices Corporate-owned devices Analysts forecast a shift in ownership over the next 3 to 5 years 6

7 The user as the administrator 59% 51% 76% Say employees circumvent or disengage security features such as password and key lock Have experienced data loss in the last 12 months due to insecure mobile devices Believe mobile devices put their organization at risk but many do not have the controls (39%) or enforceable policies (45%) to reduce this risk 7 Source: Ponemon Institue, Global Study on Mobility Risks, February 2012

8 Mobile threats From the outside:

9 Mobile threats From the inside:

10 Android Applications Significant growth Apps available Customer downloads

11 Android Security Evaluation Openness is the key factor to popularize Android!!! Key Characteristics of Android Android is free and open source Linux kernel crafted by Google Code written in Java, then compiled into Dalvik Dex-code Permission mechanism to control access Adding App in Google Play Market is simple Allow installation of non-market apps Corresponding Security Evaluation Custom ROM with malicious code Kernel bug exploited in Linux might be compiled and utilized in Android too Slow in security patch Easy to decompile and repackage No or less attention during installation Easily bypass via hacking a device Easy and anonymous Several large-scale attacks spreading in the Google Play during last few years Alternative markets in China and Russia are the main sources of malicious applications.

12 Number The Rise of Android Malware The monthly timeline of recorded Android malware nd Explosive Growth st Explosive Growth jan-11 feb-11 mrt-11 apr-11 mei-11 jun-11 jul-11 aug-11 sep-11 okt-11 nov-11 dec-11 jan-12 feb-12 mrt-12 apr-12 mei-12 jun-12 jul-12 Date

13 The Geographic Distribution of Android Malware

14 Android Malware Spyware; 144 mtan; 75 Andr/DroidRt; 383 Andr/NewyearL-B; 1003 Andr/Gmaster-A; 1454 Andr/KongFu; 1557 Andr/Kmin; 2751 Andr/Fake; 7878 Others; 4227 Andr/Boxer; 25637

15 Andr/Boxer & Andr/Fake : Premium SMS Trojans Andr/Boxer Andr/Fake Percentage in total 56.8% 17.5% Number of Premium SMS > Targeted Countries Other Functionalities Russia, Ukraine and Kazakhstan Determine premium number based on the Mobile Country Code Access website Russia Download and install applications Access website masquerade as a legit app

16 Andr/KongFu : Sophisticated & Multifunctional

17 Andr/FkToken-A - mtan mobile transaction authentication number sent by banks to authenticate online bank transactions. Catch SMS message Send SMS message Delete SMS message Contact remote sites to get list of info like attack s phone number and websites Also it looks like will download and install apk A trial sample detected as Andr/FkToken-A

18 The Intention of the Most Prevalent Malware Families The ultimate goal is money!!! Category Premium rate number SMS or Calling Information Stealing Command & Control mtan Theft Pay-Per-Click, Pay-Per-Install and Search Engine Poisoning Mean Send SMS to premium number and share revenue with Service providers or online SMS payment solution service Turn information into revenue by selling info to marketing companies I.E. setup a mobile spam botnet. (A viagra spam campaign from Android was discovered few months ago.) Still in experiment. May cause huge loss if only once is successful. Work with affiliated partner sites to share a small percentage of revenue

19 IT Security Challenges Stay compliant Optimize usability Protect data and devices Multiple Devices Multiple Platforms

20 More than just MDM Mobile Enterprise Management Mobile Device Management Manage and control devices Mobile Inventory Overview of all devices Mobile Application Management (MAM) Manage and control applications Mobile Security Anti-virus for mobile devices Collaboration Solutions Secure access to documents Deploy Manage Decommission Throughout the full device lifecycle

21 Using MDM to enforce security Not just relying on trust App Whitelisting Sophos Mobile Security Anti-malware app Sophos Mobile Control Mobile Device Management Enterprise App Store Make it compulsory Compliance Ensure it s installed

22 Control, secure, protect Sophos Mobile Control - Mobile Device Management On-premise or cloud-based solution to manage, control and protect mobile devices. Enable BYOD without the risks Sophos Mobile Security Anti-Virus for Android Scans for malicious data-stealing apps and provides loss and theft protection. Free download Protect devices from Android malware Sophos Mobile Encryption Mobile Data Protection Extends SafeGuard Encryption for Cloud Storage to mobile devices ios or Android Ensure persistent encryption

23 Communication protocols Network services: HTTPS APNS (Apple Push Notification Service) GCM (Google Cloud Messaging) BES (Blackberry Enterprise Server) SMS (Mobile network only)

24 Device identification All devices: International Mobile Equipment Identity (IMEI) Devices with SIM card International mobile subscriber identity (IMSI) Carrier network/sim operator/roaming model Specific to each platform: Model name/manufacturer Build/Version

25 Complete Architecture DMZ LAN HTTPS HTTPS HTTPS Reverse-Proxy SMC Server with EAS-Proxy HTTPS SMTP For SMC self service LDAP Sophos SMS distribution center Google GCM servers Apple Push Notification service Blackberry Enterprise server Exchange Active Directory

26 Vragen?