Monday, September 25 2017
since I always rant about how I don't like biometrics in smartphones some people have asked me to formulate what I actually would like to see to happen in this area.
My dislike for biometrics is that you cannot change your password anymore because your password is your finger, eye (iris), or face. That means you basically show you password to everybody. A good example of this is here: Politician's fingerprint 'cloned from photos' by hacker.
The second part of the problem is that many biometric systems can be easily bypassed, some face recognition systems even with a picture shown on a smartphone screen.
My main issue is that biometric systems can be bypassed by forcing the owner of the device to unlock it.
This can be done without leaving evidence, a funny example of this issue: 7-Year-Old Boy Uses Sleeping Dad's Finger To Unlock iPhone. Also see this interesting case: Court rules against man who was forced to fingerprint-unlock his phone.
The main argument I always hear is that people who wouldn't set a password (or use just a simple PIN) are using biometrics and therefore are more secure now with the help of biometrics. The kid from the previous story wasn't stopped by biometrics it was just as good as not having a password.
What would have stopped the kid from unlocking his dad's phone? A simple timeout! Basically what I want to see is a timeout for your biometrics. Once you entered your password you can unlock your phone using biometrics, after a specific amount of time you have to re-enter your password and cannot unlock the device using biometrics.
With a timeout of say 30 minutes to one hour you can prevent simple attacks while still being able to use the convenience of biometrics. Apple recently introduced the SOS mode that will also disable biometric authentication until you enter your password. I wish this was taken one step further and let you set a timeout.
I personally see biometrics on a smartphone as a pure convenience feature and treat it as a weak security feature. I only use it for ApplePay.
I think it is pretty bad to get people used to biometric authentication, Apple may get it right but other companies wont. Normal users can't determine this easily. Also how much did the additional hardware components cost to implement
fingerprint authentication or face recognition. FaceID doesn't use a normal camera so there are definitely additional
costs that you as the user have to pay for this convenience feature.
Face recognition in consumer products also gets people to accept this as
an normal everyday thing and thus helps the argument for face recognition being used in surveillance.
/rant
References:
Tuesday, August 22 2017
Conferences
toorcon san diego Aug 28th - Sep 3rd.
Dig Deep into FlexiSpy for Android by Kai Lu(@k3vinlusec).
HITB Singapore August 21-25.
The Original Elevat0r - History of a Private Jailbreak by Stefan Esser.
The Nightmare of Fragmentation: A Case Study of 200+ Vulnerabilities in Android Phones by BAI GUANGDONG and ZHANG QING.
Tencent Security Conference, August 30-31.
Pointer Authentication by Robert James Turner.
Finding iOS vulnerabilities in an easy way by Tiefel Wang and Hao Xu.
Bare-metal program tracing on ARM by Ralf-Philipp Weinmann.
44con 13-15 September London, UK.
Inside Android's SafetyNet Attestation: What it can and can't do lessons learned from a large scale deployment by Collin Mulliner.
BalCCon2k17 Novi Sad, Vojvodina, Serbia. September 15-17.
Mobile phone surveillance with BladeRF by Nikola Rasovic.
T2 October 26-27 Helsinki, Finland.
Breaking Tizen by Amihai Neiderman.
DeepSec Vienna 13-17 November.
Normal permissions in Android: An Audiovisual Deception by Constantinos Patsakis.
How secure are your VoLTE and VoWiFi calls? by Sreepriya Chalakkal.
Quick Conference Review
It was good to see everybody in Vegas, even better meeting new people. Especially some folks I wanted to meet
for a long time. I had a good time at WOOT, meeting old friends was especially good. Maybe it helped that it
was in the CanSecWest hotel. I link a few relevant papers below.
Stefan Esser is running a kickstarter for an iOS Kernel Exploitation Training Course for Development of a freely available online iOS kernel exploitation training course based on iOS 9.3.5 on 32 bit devices. If you are into iOS security you should support Stefan's project!
Ralf is on point as usual:
Pictures of the month:
Links
BootStomp: On the Security of Bootloaders in Mobile Devices (paper)
Fixes in iOS 10.3.3
Reviewing the Security of ASoC Drivers in Android Kernel
Hacking Cell Phone Embedded Systems
Intercept, modify, repeat and attack Android's Binder transactions using Burp Suite
Seccomp filter in Android O
This source code was obtained by reversing a sample of SLocker. It's not the original source code
Trust Issues: Exploiting TrustZone TEEs
Universal Android SSL Pinning bypass with Frida
USING AN RTL-SDR AS A SIMPLE IMSI CATCHER
BROADPWN: REMOTELY COMPROMISING ANDROID AND IOS VIA A BUG IN BROADCOM'S WI-FI CHIPSETS
Surveillance: German police ready to hack WhatsApp messages
Google May Have Just Uncovered An Israeli Surveillance Start-Up Spying On Androids
Gas Pump Skimmer Sends Card Data Via Text
Defeating Samsung KNOX with zero privilege (slides)
Path of Least Resistance: Cellular Baseband to Application Processor Escalation on Mediatek Devices
Port(al) to the iOS Core
New Adventures in Spying 3G & 4G Users: Locate, Track, Monitor
Ghost Telephonist Link Hijack Exploitations in 4G
OnePlus 2 Lack of SBL1 Validation Broken Secure Boot
iOS 10.3.2 XPC Userland Jailbreak Exploit Tutorial - CVE-2017-7047 by Ian Beer (Video)
Samsung: Trustonic t-base TEE does not perform revocation of trustlets
A (hopefully) generic unpacker for packed Android apps
The original elevat0r jailbreak exploit explained
Tinker is a hot-fix solution library for Android, it supports dex, library and resources update without reinstall apk.
Shattered Trust: When Replacement Smartphone Components Attack (paper)
Patch iOS Apps, The Easy Way, Without Jailbreak
Android Banking Trojan misuses accessibility services
Get details and download apps from https://play.google.com by emulating an Android (Nexus 5X) device by default.
vTZ: Virtualizing ARM TrustZone (paper)
objection - runtime mobile exploration
Xposed for Nougat & abforce Submodule Explained, and Why It's Worth Waiting for rovo89's Full Release
A Linux kernel IPC firewall and logger for Android and Binder
White-Stingray: Evaluating IMSI Catchers Detection Applications (paper)
BootStomp: a bootloader vulnerability finder
iOS 11 has a 'cop button' to temporarily disable Touch ID
Simple tool to dynamically discover hidden fastboot OEM commands based on static knowledge
Blue Pill for your Phone
Android Instant Apps: Best practices for managing download size (who has played with instant apps yet?)
Decrypt the iOS SEP
How much does your phone know about you?
Identifying and Evading Android Protections
Breaking Mobile App Protection Mechanisms
Isolation of HALs in Android O
ANTIVIRUS FOR ANDROID HAS A LONG, LONG WAY TO GO
PoC CVE-2016-3935
PoC CVE-2016-6738
Fake Snapchat in Google Play Store
Next-generation Dex Compiler Now in Preview
Detecting Android Root Exploits by Learning from Root Providers (paper)
Downgrade Attack on TrustZone (paper)
Testing Biometric Authentication
shadow v2 public release
Android O security changes
Magisk Documentations
SonicSpy: Over a thousand spyware apps discovered, some in Google Play
SMS touch sends customer information and SMS messages over a cleartext network
ZIMPERIUM blog post that describes how the Zero Packet Inspection (ZPI) approach is trained
Using Hover to Compromise the Confidentiality of User Input
on Android (paper)
Various Scripts for Mobile Pen-testing with Frida
circuit board (PCB) schematics for 30-pin iPod serial debugging
SS7 Attacker Heaven turns into Riot: How to make Nation-State and Intelligence Attackers' lives much harder on mobile networks (slides)
Thursday, July 13 2017
Conferences
Black Hat USA Las Vegas, July 26-27.
ALL YOUR SMS & CONTACTS BELONG TO ADUPS & OTHERS by Angelos Stavrou, Azzedine Benameur, Ryan Johnson.
NEW ADVENTURES IN SPYING 3G AND 4G USERS: LOCATE, TRACK & MONITOR by Altaf Shaik, Andrew Martin, Jean-Pierre Seifert, Lucca Hirschi, Ravishankar Borgaonkar, Shinjo Park.
SS7 ATTACKER HEAVEN TURNS INTO RIOT: HOW TO MAKE NATION-STATE AND INTELLIGENCE ATTACKERS' LIVES MUCH HARDER ON MOBILE NETWORKS by Martin Kacer, Philippe Langlois.
FIGHTING TARGETED MALWARE IN THE MOBILE ECOSYSTEM by Andrew Blaich, Megan Ruthven.
GHOST TELEPHONIST LINK HIJACK EXPLOITATIONS IN 4G LTE CS FALLBACK by Haoqi Shan, Jun Li, Lin Huang, Qing Yang, Yuwei Zheng.
HONEY, I SHRUNK THE ATTACK SURFACE – ADVENTURES IN ANDROID SECURITY HARDENING by Nick Kralevich.
DEFEATING SAMSUNG KNOX WITH ZERO PRIVILEGE by Di Shen.
BLUE PILL FOR YOUR PHONE by Oleksandr Bazhaniuk, Yuriy Bulygin.
CLOAK & DAGGER: FROM TWO PERMISSIONS TO COMPLETE CONTROL OF THE UI FEEDBACK LOOP by Chenxiong Qian, Simon Pak Ho Chung, Wenke Lee, Yanick Fratantonio.
Defcon Las Vegas.
Jailbreaking Apple Watch by Max Bazaliy.
Inside the "Meet Desai" Attack: Defending Distributed Targets from Distributed Attacks by CINCVolFLT (Trey Forgety).
macOS/iOS Kernel Debugging and Heap Feng Shui by Min(Spark) Zheng & Xiangyu Liu.
Using GPS Spoofing to Control Time by David "Karit" Robinson.
Phone System Testing and Other Fun Tricks by "Snide" Owen.
Unboxing Android: Everything You Wanted To Know About Android Packers by Avi Bashan & Slava Makkaveev.
Ghost in the Droid: Possessing Android Applications with ParaSpectre by chaosdata.
Ghost Telephonist' Impersonates You Through LTE CSFB by Yuwei Zheng & Lin Huang.
Bypassing Android Password Manager Apps Without Root by Stephan Huber & Siegfried Rasthofer.
Man in the NFC by Haoqi Shan & Jian Yuan.
USENIX Workshop on Offensive Technologies (WOOT) Vancouver Canada, 14-15 August.
Shattered Trust: When Replacement Smartphone Components Attack by Omer Shwartz, Amir Cohen, Asaf Shabtai, and Yossi Oren.
White-Stingray: Evaluating IMSI Catchers Detection Applications by Shinjo Park and Altaf Shaik, Ravishankar Borgaonkar, Andrew Marti, Jean-Pierre Seifert.
fastboot oem vuln by Roee Hay.
Black Hat and Defcon have a really good number of mobile related talks this year.
It was a busy month and July will be even busier. I'll be at GSMA DSG, Black Hat and Defcon July and Usenix WOOT in mid August
Picture of month:
There is a lot happening in the Android boot loader world at the moment. I guess this is what happens when the devices get more and more locked down - people go after the root of trust.
Links:
Tuesday, June 06 2017
Conferences
Black Hat USA July 26-27 Las Vegas.
'GHOST TELEPHONIST' LINK HIJACK EXPLOITATIONS IN 4G LTE CS FALLBACK by Haoqi Shan, Jun Li, Lin Huang, Qing Yang, Yuwei Zheng.
ALL YOUR SMS & CONTACTS BELONG TO ADUPS & OTHERS by Angelos Stavrou, Azzedine Benameur, Ryan Johnson.
BROADPWN: REMOTELY COMPROMISING ANDROID AND IOS VIA A BUG IN BROADCOM'S WI-FI CHIPSETS by Nitay Artenstein.
CLOAK & DAGGER: FROM TWO PERMISSIONS TO COMPLETE CONTROL OF THE UI FEEDBACK LOOP by Chenxiong Qian, Simon Pak Ho Chung, Wenke Lee, Yanick Fratantonio.
DEFEATING SAMSUNG KNOX WITH ZERO PRIVILEGE by Di Shen.
FIGHTING TARGETED MALWARE IN THE MOBILE ECOSYSTEM by Andrew Blaich, Megan Ruthven.
HONEY, I SHRUNK THE ATTACK SURFACE – ADVENTURES IN ANDROID SECURITY HARDENING by Nick Kralevich.
NEW ADVENTURES IN SPYING 3G AND 4G USERS: LOCATE, TRACK & MONITOR
by Altaf Shaik, Andrew Martin, Jean-Pierre Seifert, Lucca Hirschi, Ravishankar Borgaonkar, Shinjo Park.
SONIC GUN TO SMART DEVICES: YOUR DEVICES LOSE CONTROL UNDER ULTRASOUND/SOUND
by Aimin Pan, Bo Yang, Shangyuan LI, Wang Kang, Zhengbo Wang.
SS7 ATTACKER HEAVEN TURNS INTO RIOT: HOW TO MAKE NATION-STATE AND INTELLIGENCE ATTACKERS' LIVES MUCH HARDER ON MOBILE NETWORKS by Martin Kacer, Philippe Langlois.
THE FUTURE OF APPLEPWN - HOW TO SAVE YOUR MONEY by Timur Yunusov.
(Black Hat has a very strong mobile security line up this year.)
Defcon July 27-30 Las Vegas.
Man in the NFC by Haoqi Shan & Jian Yuan.
(speaker selection not final)
MOSEC June, Shanghai added a bunch of talks (all mobile security related, obviously).
Recon June 16-18 Montreal, Canada.
FreeCalypso: a fully liberated GSM baseband by Mychaela Falconia.
Hacking Cell Phone Embedded Systems by Keegan Ryan.
This took a long time again. It gets harder and harder do to this since this stuff is not directly what I do on
a day to day basis currently.
The Qualcomm Mobile Security summit was excellent again! Fantastic talks and again I met a bunch of people I mostly knew from email and/or twitter or haven't seen in quite some time. This conference still is unparalleled!
I had a minute to play with the BlackBerry KeyOne and it feels like a super solid device. The screen is bigger then I thought it would be and this makes the device almost too big for my taste - but this is hard to say from playing with it for just a minute.
So iOS will finally support NDEF tags.
This talk is really interesting for anybody interested in mobile application security. This is not about mobile app reverse engineering but about app, backend, phone infrastructure interaction.
Pictures of the month:
Links
Tuesday, March 28 2017
Conferences
Qualcomm Mobile Security Summit 2017 San Diego, May. All talks are on mobile security - super strong lineup!
AppSec EU May 11-12, Belfast.
How to steal mobile wallet? - Mobile contactless payments apps attack and defense. Fixing Mobile AppSec: The OWASP Mobile Project.
MOSEC June Shanghai.
Pwning Apple Watch. (program not complete yet!)
OffensiveCon is a new security conference in Berlin Germany focused on Offense. No details yet but they chose the right location for sure.
For everybody who didn't make it to the Android Security Symposium, they recorded the talks and the videos are available: here.
Google published a blog post and a detailed
report on Android Security in 2016. The report covers everything from patching and update stats to high impact vulnerabilities. People posted a lot of summaries but you should really read it yourself if
you work with Android.
Google pulls March security update for Nexus 6, after it breaks SafetyNet and Android Pay. This was pretty interesting, not the fact that they broke SafetyNet but that they broke it for their own devices (Nexus). This happened to some really small manufacturer before and if you have an idea of how SN works on the backend - it is clear what happened.
Links
Tuesday, March 07 2017
Conferences
Black Hat ASIA Singapore March 28-31.
FRIED APPLES: JAILBREAK DIY by Alex Hude, Max Bazaliy, Vlad Putin.
ANTI-PLUGIN: DON'T LET YOUR APP PLAY AS AN ANDROID PLUGIN by Cong Zheng, Tongbo Luo, Xin Ouyang, Zhi Xu.
REMOTELY COMPROMISING IOS VIA WI-FI AND ESCAPING THE SANDBOX by Marco Grassi.
3G/4G INTRANET SCANNING AND ITS APPLICATION ON THE WORMHOLE VULNERABILITY by Guangdong Bai, Zhang Qing.
MOBILE-TELEPHONY THREATS IN ASIA by Lion Gu, Marco Balduzzi, Payas Gupta.
MASHABLE: MOBILE APPLICATIONS OF SECRET HANDSHAKES OVER BLUETOOTH LE by Yan Michalevsky.
CanSecWest Vancouver Canada, March 15-17.
Qidan He : Pwning Nexus of Every Pixel: Chain of Bugs demystified.
Logic Bug Hunting in Chrome on Android by Georgi Hershey & Robert Miller.
Zer0Con Seoul, Korea April 13-14.
Ian Beer : Through the mach portal.
OsmoCon (Osmocom Conference) 2017 is the first technical conference for Osmocom users, operators and developers! April 21, Berlin. All about Osmocom!
HITB Amsterdam April 13-14.
FEMTOCELL HACKING: FROM ZERO TO ZERO DAY by JeongHoon Shin.
CAN'T TOUCH THIS: CLONING ANY ANDROID HCE CONTACTLESS CARD by Slawomir Jasek.
EXTRACTING ALL YOUR SECRETS: VULNERABILITIES IN ANDROID PASSWORD MANAGERS by Stephan Huber, Steven Artz, Siegfried Rasthofer.
HUNTING FOR VULNERABILITIES IN SIGNAL by Markus Vervier.
Opcde Dubai, UAE April 26-27.
Practical attacks against Digital Wallet by Loic Falletta.
I took a way too long break again. So many things happen in the world of mobile security every week. I really wish I had more time for this.
I also have a bunch of small things I need to put on this blog but I think they are too specific for the news and will likely get their own posts.
Some news from MWC (I didn't attend):
First the BlackBerry KEYone a new
Android-based phone with a physical keyboard. Other then the BB Priv the KEYone's keyboard is fix and doesn't slide. Movable parts
are really not a good idea, they break way too fast. In my opinion this device looks super solid and likely will be supported longer
than the average flagship phone from other manufacturers (data on this would be awesome).
Nokia released 3 new Android phones the 3 (MTK), 5 (QCOM) and 6 (QCOM). The phones seem to run Android N without
any modifications or vendor crap. Very low price (230Euro for the 6). The bottom of their website specifically says: You get an experience that's focused and clutter-free, and we'll make sure you keep getting regular updates, so you'll always stay on top of features and security.
that is what you should expect in 2017.
The Android Devices Security Patch Status page is an awesome
resource to determine if a specific device from a specific vendor has been patched and when the patch was released. From the page: This list is Prepared to Serve as a Quick reference to identify which Device is being actively maintained by the Vendor.. This is super useful, thanks!
MOSEC mobile security conference in June in Shanghai. This seems to be the 3rd year of the conference.
There is no schedule yet.
The story of the day Vault 7: CIA Hacking Tools Revealed. Vault 7: CIA Hacking Tools Revealed : iOS Exploit list. Yes, the CIA
uses n-day exploits! The Android exploits.
They talk about Android, Defcon, and backdooring your repo? ;-)
Pic of the month:
Links
Tuesday, December 13 2016
Conferences
33c3 Hamburg, Germany 27-30 December.
Downgrading iOS: From past to present by tihmstar. A look into the Mobile Messaging Black Box by Roland Schilling and Frieder Steinmetz. Dissecting modern (3G/4G) cellular modems by
LaForge and holger. Geoloation methods in mobile networks by Erik.
Shmoocon Washington D.C. January.
A Context-Aware Kernel IPC Firewall for Android - David Wu, Sergey Bratus.
Black Hat ASIA March 2017. FRIED APPLES: JAILBREAK DIY by Alex Hude and Max Bazaliy.
MASHABLE: MOBILE APPLICATIONS OF SECRET HANDSHAKES OVER BLUETOOTH LE by Yan Michalevsky.
REMOTELY COMPROMISING IOS VIA WI-FI AND ESCAPING THE SANDBOX by Marco Grassi.
I had to skip the November update due to a long overdue vacation. Playing with iOS webviews also did cost some time.
Writing this blog becomes more and more time consuming since for some parts I would rather spent time on
research than writing about other peoples research. Will see next year if I continue doing this or not. I'm doing
this since January 2009 so it has been a few years.
New Conference:
Samsung confirms it will render the US Note 7 useless with next update since the owners don't seem to care to return the phones
to Samsung even tho they would get a replacement device. This is kind of hilarious.
Browser based iOS 9.3.x jailbreak (64bit only) it has been a while.
Chinese company installed secret backdoor on hundreds of thousands of phones
Recently the topic of SMS 2FA came up again. While I agree that SMS is not the most secure version of 2FA it is far far better
then not providing any 2FA mechanism for your service.
Links