SEC575: Mobile Device Security and Ethical Hacking
Cutting edge security material, well taught.
Once again SANS has exceeded my expectations and successfully re-focused my view of threats and risks. I recommend this course because it is very enlightening.
Now covering BlackBerry 10, Apple iOS 7, and Android 4.4 KitKat devices
Mobile phones and tablets have become essential to enterprise and government networks, from small organizations to Fortune 500 companies and large-scale agencies. Often, mobile phone deployments grow organically, adopted by multitudes of end-users for convenient email access as well as managers and executives who need access to sensitive organizational resources from their favored personal mobile devices. In other cases, mobile phones and tablets have become critical systems for a wide variety of production applications from ERP to project management. With increased reliance on these devices, organizations are quickly recognizing that mobile phones and tablets need greater security implementations than a simple screen protector and clever password.
The security risks of mobile phone and tablet device use in the workplace
Whether the device is an Apple iPhone or iPad, a Windows Phone, an Android or BlackBerry phone or tablet, the ubiquitous mobile device has become a hugely attractive and vulnerable target for nefarious attackers. The use of mobile devices introduces a vast array of new risks to organizations, including:
- Distributed sensitive data storage and access mechanisms
- Lack of consistent patch management and firmware updates
- The high probability of device loss or theft, and more.
Mobile code and apps are also introducing new avenues for malware and data leakage, exposing critical enterprise secrets, intellectual property, and personally identifiable information assets to attackers. To further complicate matters, today there simply are not enough people with the security skills needed to manage mobile phone and tablet deployments.
From mobile device security policy development, to design and deployment, and more
This course was designed to help organizations struggling with mobile device security by equipping personnel with the skills needed to design, deploy, operate, and assess a well-managed secure mobile environment. From evaluating the network activity generated by mobile applications to mobile code analysis, from exploiting the weaknesses in common mobile applications to conducting a full-scale mobile penetration test, this course will help you build the critical skills necessary to support the secure deployment and use of mobile phones and tablets in your organization.
You will gain hands-on experience in designing a secure mobile phone network for local and remote users and learn how to make critical decisions to support devices effectively and securely. You will also be able to analyze and evaluate mobile software threats, and learn how attackers exploit mobile phone weaknesses so you can test the security of your own deployment. With these skills, you will be a valued mobile device security analyst, fully able to guide your organization through the challenges of securely deploying mobile devices.
SEC575.1: Architecture and Management
Mon Sep 8th, 2014
9:00 AM - 5:00 PM
The first part of the course looks at the significant threats affecting mobile phone deployments and how organizations are being attacked through these systems. As a critical component of a secure deployment, we'll examine the architectural and implementation differences between Android, Apple, BlackBerry, and Windows Phone systems including platform software defenses, and application permission management. We'll also look at the specific implementation details of popular platform features such as iBeacon, AirDrop, App Verification and more. We'll apply hands-on exercises to interact with mobile device emulator features including low-level access to installed application services.
We'll also examine the critical considerations for platform management systems and how attackers evade or manipulate platform management controls. While we look at the positive side of mobile device management (MDM) systems, we'll also look at the evil side of malicious policies and how attackers can use MDM tools to manipulate victim mobile devices. Finally we'll address the threats of mobile malware including emerging malware threats and the increasingly complex and advanced trends in mobile device malware.
CPE/CMU Credits: 6
Mobile Problems and Opportunities
- Challenges and opportunities for secure mobile phone deployments
- Weaknesses in mobile phones
- Exploit tools and attacks against mobile phones and tablets
Mobile Devices and Infrastructure
- BlackBerry network and platform architecture
- iOS security features and weaknesses
- Analysis of iOS features including iBeacon and AirDrop
- Google Play Marketplace and third-party application stores
- Windows Phone architecture and development platforms
- Benefits and weaknesses of container-based MDM solutions
Mobile Device Security Models
- Privilege and access models on multiple platforms
- Device encryption support and threats
- Emerging changes in platform security from Android and Apple
Mobile Device Lab Analysis Tools
- Using iOS, Android, BlackBerry and Windows Phone emulators
- Android mobile application analysis with Android Debug Bridge (ADB) tools
- Uploading, downloading, and installing applications with ADB
- Application testing with the iOS Simulator
Mobile Device Malware Threats
- Trends and popularity of mobile device malware
- Mobile malware Command & Control (C&C) architecture
- Efficiency of Android "ransomware" malware threats
- Value and effectiveness of Android anti-malware platforms
SEC575.2: Security Controls and Platform Access
Tue Sep 9th, 2014
9:00 AM - 5:00 PM
With an understanding of the threats, architectural components and desired security methods, we can design incident response processes to mitigate the effective of common threat scenarios including device loss. We will look at building such a program, while building our own skills at analyzing mobile device data and applications through rooting and jailbreaking, filesystem data analysis, and network activity analysis techniques.
CPE/CMU Credits: 6
Mitigating Stolen Devices
- Bypassing iOS and Android passcode locks
- Decrypting iOS keychain credentials
- Accessing mobile device backup data
- Creating a lost device reporting program
- Leveraging remote device wipe strategies
Unlocking, Rooting, Jailbreaking Mobile Devices
- Goals of unlocking
- JailBreaking iOS
- Unlocking Windows Phone
- Rooting Android
- BlackBerry platform restrictions
Mobile Phone Data Storage and Filesystem Architecture
- Data stored on mobile devices
- Mobile device filesystem structure
- Decoding sensitive data from database files on iOS, Android
- Extracting data from Android backups
- Using filesystem artifacts for location disclosure attacks beyond GPS coordinates
Network Activity Monitoring
- Mobile application network capture and data extraction
- Capturing iOS network traffic through OS X systems
- Transparent network proxying for data capture
- Encrypted data capture manipulation
- Extracting files and sensitive content from network captures
- Recovering sensitive data from popular cloud storage providers
SEC575.3: Application Analysis
Wed Sep 10th, 2014
9:00 AM - 5:00 PM
One of the critical decisions you will need to make in supporting a mobile device deployment is to approve or disapprove of unique application requests from end-users in a corporate device deployment. With some analysis skills, we can evaluate applications to determine the type of access and information disclosure threats they represent
We'll examine the techniques for reverse-engineering iOS and Android applications, obtaining source code for applications from public app stores. For Android applications we'll look at opportunities to change the behavior of applications as part of our analysis process by decompiling, manipulating, and recompiling code, and adding new code to existing applications without prior source code access. For iOS we'll extract critical app definition information available in all apps to examine and manipulate app behavior through the Cycript tool.
CPE/CMU Credits: 6
Static Application Analysis
- Reverse engineering iOS binaries in Objective-C and ARM instructions
- Reverse engineering Android binaries in Java and Dalvik Bytecode
- Evaluating mobile malware threats through source code analysis
- Defeating Apple FairPlay encryption for application binary access
- Combining source code and behavior analysis for effective app penetration testing
- Overcoming anti-decompilation techniques in defensive code
Automated Application Analysis Systems
- iOS application vulnerability analysis with iAuditor
- Structured iOS application header analysis
- Tracing iOS application behavior and API use with Snoop-it
- Effective Android application analysis with Androwarn
- Android application interaction and Intent manipulation with Drozer
Manipulating App Behavior
- Runtime iOS application manipulation with Cycript
- iOS method swizzling
- Android application manipulation with Apktool
- Reading and modifying Dalvik Bytecode
- Adding Android application functionality, from Java to Dalvik Bytecode
SEC575.4: Penetration Testing Mobile Part 1
Thu Sep 11th, 2014
9:00 AM - 5:00 PM
An essential component of developing a secure mobile phone deployment is to perform an ethical hacking assessment. Through ethical hacking or penetration testing, we examine the mobile devices and infrastructure from the perspective of an attacker, identifying and exploiting flaws that delivery unauthorized access to data or supporting networks. Through the identification of these flaws we can evaluate the mobile phone deployment risk to the organization with practical, useful risk metrics.
CPE/CMU Credits: 6
Fingerprinting mobile devices
- Passive analysis
- Active scanning
- Application inspection
Wireless Network Probe Mapping
- Monitoring network probing activity
- Visualizing network discovery and search
- Wireless anonymity attacks
Weak Wireless Attacks
- Wireless network scanning and assessment
- Exploiting weak wireless infrastructure
- Monitoring mobile device network scanning
- Exploiting "attwifi" and iPad or iPhone captive portal detection
- Secure network impersonation
Enterprise Wireless Security Attacks
- Certificate impersonation and mobile devices
- Manipulating enterprise wireless authentication
- RADIUS server impersonation attacks
SEC575.5: Penetration Testing Mobile Part 2
Fri Sep 12th, 2014
9:00 AM - 5:00 PM
Continuing our look at ethical hacking or penetration testing, we turn our focus to exploiting weaknesses on individual mobile devices including iPhones, iPads, Android phones and tablets, Windows Phones and BlackBerry devices. We'll also examine platform-specific application weaknesses and look at the growing use of web framework attacks.
CPE/CMU Credits: 6
Network Manipulation Attacks
- Leveraging man-in-the-middle tools against mobile devices
- SSL certificate manipulation and bypass attacks
- Effective SSL penetration testing techniques
Mobile Application Attacks
- Exploiting mobile application authentication vulnerabilities
- Manipulating mobile application network activity
- Applying web attacks to thin mobile applications
- Exploiting common application flaws on Android, iOS platforms
Web Framework Attacks
- Site impersonation attacks
- Application cross-site scripting exploit
- Remote browser manipulation and control
- Data leakage detection and analysis
Back-end Application Support Attacks
- Exploiting SQL injection in mobile application frameworks
- Leveraging client side injection attacks
- Getting end-to-end control of mobile application server resources
SEC575.6: Hands-on Mobile Security Event
Sat Sep 13th, 2014
9:00 AM - 5:00 PM
On the last day of class we'll pull in all the concepts and technology we've covered in the week for a comprehensive Capture the Flag (CTF) event. In the CTF event, you'll have the option to participate in multiple roles, designing a secure infrastructure for the deployment of mobile phones, monitoring network activity to identify attacks against mobile devices, extracting sensitive data from a compromised iPad and attacking a variety of mobile phones and related network infrastructure components.
In the CTF you'll use the skills you've built to practically evaluate systems and defend against attackers, simulating the realistic environment you'll be prepared to protect when you get back to the office.
CPE/CMU Credits: 6
Throughout the course, students will participate in hands-on lab exercises. Students must bring their own laptops to class that meet the requirements described below.
Students must bring a Windows 8/8.1, Windows 7, or Windows Vista laptop to class, preferably running natively on the system hardware. It is possible to complete the lab exercises using a virtualized Windows installation; however, this will result in reduced performance when running device emulators within the virtualized Windows host.
For several tools utilized in the course, students will be required to perform actions with administrative privileges. Students must have administrative access on their Windows host, including the ability to unload or disable security software such as anti-virus or firewall agents as necessary for the completion of lab exercises. Further, students should have knowledge of the local passwords required to manage their system, including local Administrator account passwords, and passwords necessary to make system BIOS configuration changes.
Students will use a virtualized MobiSec Linux VMware guest for several lab exercises. VMware Workstation or VMware Player is recommended. Note that there is no cost associated with the use of VMware Player, which can be downloaded from the VMware website.
While some students successfully use VMware Fusion for the exercises, the relative instability of VMware Fusion may introduce delays in exercise preparation, preventing the timely completion of lab exercises. VirtualBox and other virtualization tools are not supported at this time.
Several of the software components used in the course are hardware intensive, requiring more system resources than what might be required otherwise for day-to-day use of a system. Please ensure your laptop meets the following minimum hardware requirements:
- Minimum 2 GB RAM, 4 GB recommended
- Ethernet (RJ45) network interface; students will not be able to complete lab exercises without an Ethernet interface, either built-in or through a USB adapter.
- Core 2 Duo or comparable processor minimum
- 30 GB free hard disk space
- DVD drive (not a CD drive)
- Minimum screen resolution 1024x768, larger screen resolution will reduce scrolling in for several applications and a more pleasant end-user experience
During the course, you will install numerous tools, and make several system changes. Some students may wish to bring a clean system that is not their everyday production system, or a dedicated Windows virtual machine that meets the minimum requirements for a system, to avoid any changes that may interfere with other system software.
If you have additional questions about the laptop specifications, please contact email@example.com.
Who Should Attend
- Penetration testers
- Ethical hackers
- Auditors who need to build deeper technical skills
- Security personnel whose job involves assessing, deploying or securing mobile phones and tablets
- Network and system administrators supporting mobile phones and tablets
You Will Be Able To
- Develop effective policies to control employee-owned (Bring Your Own Device, BYOD) and enterprise-owned mobile devices including the enforcement of effective passcode policies and permitted application
- Utilize jailbreak tools for Apple iOS and Android systems such as redsn0w, Absinthe
- Conduct an analysis of iOS and Android filesystem data using SqliteSpy, Plist Editor, and AXMLPrinter to plunder compromised devices and extract sensitive mobile device use information such as the SMS history, browser history, GPS history, and user dictionary keywords
- Analyze Apple iOS and Android applications with reverse engineering tools including class-dump, JD-GUI, dex-translator, and apktool to identify malware and information leakage threats in mobile applications
- Conduct an automated security assessment of mobile applications using iAuditor, Cycript, Mo- bileSubstrate, TaintDroid, and DroidBox to identify security flaws in mobile applications
- Use wireless network analysis tools to identify and exploit wireless networks, crack WEP and WPA/ WPA2 access points, bypass enterprise wireless network authentication requirements, and harvest user credentials
- Intercept and manipulate mobile device network activity using Burp to manipulate the actions taken by a user in an application and to deliver mobile device exploits to vulnerable devices
Press & Reviews
"The SEC575 material is very good. Continuing to associate material with potential impact to organization is key." - Eugene Melendez, PwC
"SEC575 gave me a good insight into the tools and techniques used to assess device Security." - Ben Duff, QA
"In the fast paced world of BYOD and mobile device management, SEC575 is a must course for info Sec managers." - Jude Meche, DSCC
"SEC575 provides a pretty comprehensive overview of different attack vectors and vulnerabilities in the mobile field. It covers many topics in enough depth to really get a foothold in the subject. I wish I had taken this course several years ago when first entering the mobile landscape. It would have saved me months of painful self-teaching, and is vastly more complete in many areas." - Jeremy Erickson, Sandia National Labs
I'm not sure exactly when it happened, but laptops and PC's have become legacy computing devices, replaced with mobile phones and tablets. Just when I thought we were getting a much better handle on the security of Windows, Mac and other Unix systems, there is an explosion of new devices wanting to join our networks that simply do not have the same security controls that we rely on in modern, secure networks.
Even with their weaknesses, mobile phones are here to stay and more and more we're being called on to support them. Some organizations try to drag their feet on allowing mobile phones, but that ultimately contributes to the problem: if we don't address security, the threats continue to grow uncontrolled and unmonitored.
Fortunately, we can securely deploy, manage, and monitor mobile phones and tablets inside our organizations through policy and careful network deployment and monitoring. We need to build some essential skills in analyzing the risks of data leakage in mobile code and the applications our end-users want to run from app store, and we need to ethically hack our networks to identify the real threat and exposure of mobile phone weaknesses.
I wrote this course to help people build their skills in all these areas, focusing on the topics and concepts that are most important and immediately useful. Every organization should have an analyst who has the skills for mobile phone security analysis and deployment. By taking this course, you'll become an even more valued part of your organization, and we'll have lots of geeky fun in the process.