Mobile App Security (Angry Birds Hacked My Phone)

76 Pages·2012·8.31 MB·English

Mobile App Security (Angry Birds Hacked My
Phone)
Start Time: 9 am US Pacific / 12 noon US Eastern / 5 pm London Time
#ISSAWebConf
Mobile App Security (Angry
Birds Hacked My Phone)
Welcome Conference Moderator

David Cruz
ISSA Central Florida Chapter Secretary

#ISSAWebConf

Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 2
Speaker Introduction
• Michael Raggo
Director, MobileIron Security Labs
• David Jevans
Vice President of Mobile Security, Proofpoint
• Jeff Stapleton
Information Security Architect, X9F4 Cryptographic
Protocol and Application Security Workgroup
• Ralph Spencer Poore, PCIP, CFE, CISA, CISSP, CHS-
III
Director of Emerging Standards, PCI Security
Standards Council
To ask a question:
Type in your question in the Chat area of your screen.
You may need to click on the double arrows to open this function.

#ISSAWebConf

Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 3
Mobile App Security (Angry
Birds Hacked My Phone)

Michael Raggo
Director, MobileIron Security Labs
To ask a question:
Type in your question in the Chat area of your screen.
You may need to click on the double arrows to open this function.

#ISSAWebConf

Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 4
#whoami

Mike Raggo
• Director of Security Research, MobileIron
• Managed MobileIron Security Labs (MISL)
• CISSP, NSA-IAM, CCSI, SCSA, ACE, CSI
• Author of “Data Hiding” & “Mobile Data Loss
Threats & Countermeasures”
• Member PCI Mobile Task Force and BITS/FSISAC
Financial Services international roundtable
focused on mobile security
• Speaker at BITS, Black Hat, DEF CON, OWASP,
and SANS

Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 5
Hackers know mobile is different
Network edge has blurred
New generation operating
systems are sandboxed
Server
Users
Users are low-hanging fruit
Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 6
The mind of the mobile hacker
Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 7
Evolution of operating system
architecture
Traditional Windows iOS / Android / Windows 10
1
Logon Win32 API UI components Classes/utilities
Session manager NTDLL.DLL Graphics Audio Video
User mode User mode
2
Kernel mode Kernel mode
Win32K.sys Graphics drivers System utilities
Management
primitives
3
HAL Printer drivers Kernel
1 From open file system to application sandboxing (security, no app conflicts, no “DLL hell”)
2 From unprotected to protected OS kernel (stability, ease of update, ease of patching)
3 From untrusted to trusted management primitives (simplicity, consistency)
Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 8
Mobile Threat Landscape
Smartwatches, Wearables, IoT
Email, contacts, calendar, SMS,
camera, and more…
User data leakage
Malware and Risky Apps
Copy/paste, screenshot, open-in
Data exfiltration
App
Unprotected Networks
Rogue Access Points, MiTM
User
Jailbreak / Root Hotspot
Device opened to vulnerabilities
leading to data exposure
Device Network
Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 9
Hackers look to the app
Mobile App Security (Angry Birds Hacked My Phone) 02/23/2016 10