SEC575: Mobile Device Security and Ethical Hacking
- Contents | Schedule | Additional Info
- Instructor: Joshua Wright
SEC575 provides a pretty comprehensive overview of different attack vectors and vulnerabilities in the mobile field. It covers many topics in enough depth to really get a foothold in the subject. I wish I had taken this course several years ago when first entering the mobile landscape. It would have saved me months of painful self-teaching, and is vastly more complete in many areas.
Jeremy Erickson, Sandia National LabsOnce again SANS has exceeded my expectations and successfully re-focused my view of threats and risks. I recommend this course because it is very enlightening.
Charles Allen, EM Solutions, Inc
Mobile phones and tablets have become essential to enterprise and government networks ranging from small organizations to Fortune 500 companies and large agencies. Often, mobile phone deployments grow organically, adopted by multitudes of end-users for convenient email access, as well as by managers and executives who need access to sensitive organizational resources from their favored personal mobile devices. In other cases, mobile phones and tablets have become critical systems for a wide variety of production applications from enterprise resource planning (ERP) to project management.
For all of its convenience, however, the ubiquitous use of mobile devices in the work place and beyond has brought new security risks. As reliance on these devices has grown exponentially, organizations have quickly recognized that mobile phones and tablets need greater security implementations than a simple screen protector and clever password. Whether an Apple iPhone or iPad, a Windows Phone, or an Android or BlackBerry phone or tablet, these devices have become hugely attractive and vulnerable targets for nefarious attackers. The use of such devices poses an array of new risks to organizations, including:
- Distributed sensitive data storage and access mechanisms
- Lack of consistent patch management and firmware updates
- High probability of the device being hacked, lost or stolen
Mobile code and apps are also introducing new avenues for malware and data leakage, exposing critical enterprise secrets, intellectual property, and personally identifiable information assets to attackers. To further complicate matters, today there simply are not enough people with the security skills needed to manage mobile phone and tablet deployments.
SEC575: Mobile Device Security and Ethical Hacking is designed to help organizations secure their mobile devices by equipping personnel with the knowledge to design, deploy, operate, and assess a well-managed and safe mobile environment. The course will help you build the critical skills to support your organization's secure deployment and use of mobile phones and tablets. You will learn how to capture and evaluate mobile device network activity, disassemble and analyze mobile code, recognize weaknesses in common mobile applications, and conduct full-scale mobile penetration tests.
You will gain hands-on experience in designing a secure mobile phone network for local and remote users and learn how to make critical decisions to support devices effectively and securely. You will also learn to analyze and evaluate mobile software threats, as well as understand how attackers exploit mobile phone weaknesses, so that you can test the security of your own deployment. With these skills, you will be a valued mobile device security analyst, fully able to guide your organization through the challenges of securely deploying mobile devices.
You Will Learn:
- How to capture and evaluate mobile application network activity
- How to decrypt and manipulate Apple iOS application behavior
- How to identify the steps taken by Android malware
- How to reverse-engineer and change Android applications in the Google Play Store
- How to conduct mobile device and mobile application penetration tests
| Course Contents | Instructors | Schedule |
|---|---|---|
| SEC575.1: Device Architecture and Common Mobile Threats | Joshua Wright |
Mon Apr 13th, 2015 9:00 AM - 5:00 PM |
OverviewThe first section of the course looks at the significant threats affecting mobile phone deployments and how organizations are being attacked through these systems. As a critical component of a secure deployment, we will examine the architectural and implementation differences between Android, Apple, BlackBerry and Windows Phone systems, including platform software defenses and application permission management. We will also look at the specific implementation details of popular platform features such as iBeacon, AirDrop, App Verification, and more. Hands-on exercises will be used to interact with mobile device emulator features, including low-level access to installed application services. We will also examine the critical considerations for platform management systems and how attackers evade or manipulate platform management controls. While we look at the positive side of mobile device management (MDM) systems, we also examine how attackers use MDM tools to manipulate a victim's mobile device and use it for their own malicious purposes. Finally, we will address the threats of mobile malware, including emerging malware threats and the increasingly complex and advanced trends in mobile device malware. CPE/CMU Credits: 6 TopicsMobile Problems and Opportunities
Mobile Devices and Infrastructure
Mobile Device Security Models
Mobile Device Lab Analysis Tools
Mobile Device Malware Threats
|
||
| SEC575.2: Mobile Platform Access and Application Analysis | Joshua Wright |
Tue Apr 14th, 2015 9:00 AM - 5:00 PM |
OverviewWith an understanding of the threats, architectural components and desired security methods, we can design incident response processes to mitigate the effect of common threat scenarios, including device loss. This section looks at building such a program while developing your own skills to analyze mobile device data and applications through rooting and jailbreaking, filesystem data analysis and network activity analysis techniques. CPE/CMU Credits: 6 TopicsMitigating the Impact of Devices Being Stolen
Unlocking, Rooting and Jailbreaking Mobile Devices
Mobile Phone Data Storage and Filesystem Architecture
Network Activity Monitoring
|
||
| SEC575.3: Mobile Application Reverse Engineering | Joshua Wright |
Wed Apr 15th, 2015 9:00 AM - 5:00 PM |
OverviewOne of the critical decisions you will need to make in supporting a mobile device deployment is whether to approve unique application requests from end-users in a corporate deployment. With some analysis skills, you will be able to evaluate these requests to determine the type of access and information disclosure threats they represent. This section will examine the techniques for reverse-engineering iOS and Android applications, obtaining source code for applications from public application stores. For Android applications, we will look at opportunities to change behavior as part of our analysis process by decompiling, manipulating and recompiling code, and by adding new code to existing applications without prior source code access. For iOS, we will extract critical application definition information available in all applications to examine and manipulate behavior through the Cycript tool. CPE/CMU Credits: 6 TopicsStatic Application Analysis
Automated Application Analysis Systems
Manipulating Application Behavior
|
||
| SEC575.4: Penetration Testing Mobile Devices, Part 1 | Joshua Wright |
Thu Apr 16th, 2015 9:00 AM - 5:00 PM |
OverviewAn essential component of developing a secure mobile phone deployment is to perform an ethical hacking assessment. Through ethical hacking and penetration testing, we examine the mobile devices and infrastructure from the perspective of an attacker, identifying and exploiting flaws that deliver unauthorized access to data or supporting networks. By identifying these flaws we can evaluate the mobile phone deployment risk to the organization with practical and useful risk metrics. CPE/CMU Credits: 6 TopicsFingerprinting Mobile Devices
Wireless Network Probe Mapping
Weak Wireless Attacks
Enterprise Wireless Security Attacks
|
||
| SEC575.5: Penetration Testing Mobile Devices, Part 2 | Joshua Wright |
Fri Apr 17th, 2015 9:00 AM - 5:00 PM |
OverviewContinuing our look at ethical hacking and penetration testing, we turn our focus to exploiting weaknesses on individual mobile devices including iPhones, iPads, Android phones and tablets, Windows Phones, and BlackBerry devices. We will also examine platform-specific application weaknesses and look at the growing use of web framework attacks. CPE/CMU Credits: 6 TopicsNetwork Manipulation Attacks
Mobile Application Attacks
Web Framework Attacks
Back-end Application Support Attacks
|
||
| SEC575.6: Capture the Flag | Joshua Wright |
Sat Apr 18th, 2015 9:00 AM - 5:00 PM |
OverviewOn the last day of class we will pull together all the concepts and technology we have covered during the week in a comprehensive Capture the Flag event. In this hands-on exercise, you will have the option to participate in multiple roles: designing a secure infrastructure for the deployment of mobile phones, monitoring network activity to identify attacks against mobile devices, extracting sensitive data from a compromised iPad, and attacking a variety of mobile phones and related network infrastructure components. During this mobile security event you will put into practice the skills you have learned in order to evaluate systems and defend against attackers, simulating the realistic environment you will be prepared to protect when you get back to the office. CPE/CMU Credits: 6 |
||
| Additional Information | ||
| Laptop Required | ||
|
Throughout the course, students will participate in hands-on lab exercises. Students must bring their own laptops to class that meet the requirements described below. Windows Students must bring a 64-bit Windows 8/8.1 or Windows 7 laptop to class, preferably running natively on the system hardware. It is possible to complete the lab exercises using a virtualized Windows installation; however, this will result in reduced performance when running device emulators within the virtualized Windows host. Administrative Access For several tools utilized in the course, students will be required to perform actions with administrative privileges. Students must have administrative access on their Windows host, including the ability to unload or disable security software such as anti-virus or firewall agents as necessary for the completion of lab exercises. Further, students should have knowledge of the local passwords required to manage their system, including local Administrator account passwords, and passwords necessary to make system BIOS configuration changes. VMware Students will use a virtualized Linux VMware guest for several lab exercises. VMware Workstation or VMware Player is recommended. Note that there is no cost associated with the use of VMware Player, which can be downloaded from the VMware website. VirtualBox and other virtualization tools are not supported at this time. Hardware Requirements Several of the software components used in the course are hardware intensive, requiring more system resources than what might be required otherwise for day-to-day use of a system. Please ensure your laptop meets the following minimum hardware requirements:
During the course, you will install numerous tools, and make several system changes. Some students may wish to bring a clean system that is not their everyday production system, or a dedicated Windows virtual machine that meets the minimum requirements for a system, to avoid any changes that may interfere with other system software. If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org. |
||
| Who Should Attend | ||
|
||
| Prerequisites | ||
Students should have familiarity with network penetration testing concepts, such as those taught in SEC504 or SEC560. |
||
| Other Courses People Have Taken | ||
Other Courses People Have TakenCourses that lead in to SEC575 Courses that are prerequisites for SEC575 Courses that are good follow-ups to SEC575 |
||
| What You Will Receive | ||
|
||
| You Will Be Able To | ||
|
||
| Hands-on Training | ||
|
||
| Press & Reviews | ||
"Cutting edge security material, well taught." - Donald Farrell, Kingsisle Entertainment Inc. "In the fast paced world of Bring Your Own Device (BYOD) and mobile device management, SEC575 is a must course for infosec managers." - Jude Meche, DSCC "SEC575 provides a pretty comprehensive overview of different attack vectors and vulnerabilities in the mobile field. It covers many topics in enough depth to really get a foothold in the subject. I wish I had taken this course several years ago when first entering the mobile landscape. It would have saved me months of painful self-teaching, and is vastly more complete in many areas." - Jeremy Erickson, Sandia National Labs SEC575 Mobile Device Security and Ethical Hacking Review by Matt Edmonson http://digitalforensicstips.com/2014/11/sans-sec575-mobile-device-security-and-ethical-hacking-review/ |
||
