Mobile 123'">

Post on 09-Jul-2015

154 views

Category:

Business

1 download

Embed Size (px)

DESCRIPTION

Mobile 123'">

TRANSCRIPT

<ul><li><p> , </p><p> 2012</p></li><li><p> _________________________________________________________________ __________________________________________ ____________________________________________________________ ________________________________________________ _________________________________ _________________________________ __________________ ________________________________________________________ ___________________________________________ __________________________________________ iOS _____________________ iOS ____________________________________ iOS ________________________________ iOS _________________ _______________________________________________________ SDK _____________________________________________________ PIE _______________________________________________ SSP _______________________________________________ ARC ______________________________________________ API _______________________________________________________________ SSL ______________________________________________ SQL- _________________________________________________________ Keychain ________________________________________________ XSS __________________________________________________________________ XXE __________________________________________________________________ __________________________________________ NSLog __________________________________________________ _______________________________________ ________________________________________________ ___________________________________________________ Android _________________ Android ________________________________ Android ____________________________ _______________________________________________________ AndroidManifest.xml ______________________________________________ , (IPC) ____________________________________ API _______________________________________________________________ HTTP- SSL __________________________________ SSL- __________________________________ ___________________________________ Broadcast- ________________ webView ____________________________________ _______________________________ XML _____________________________________ SQL- _________________________________________________________ ___________________________________________________ ___________________________________________________________________</p><p>123334456789</p><p>99</p><p>101010101010101111111111121212131415</p><p>151616</p><p>171717171818181919191920</p></li><li><p>-, -, , 24., , , 24, , , , , -, ,</p><p> , ,,-, ,-,,,,,,,</p><p>, ,,-,, , ,, ,- , .</p><p> Digital Security - - 2009-2011 ., . </p><p> , . , -, (Android iOS). </p><p> , , - , . - , (, ..). , (Android, iOS, Windows Phone, Symbian, BlackBerry ..) , , .</p><p> , : </p></li><li><p>, SSL 15% XSS 20%</p><p> SQLi 20% 22%</p><p> IMEI IMSI 45%</p><p> SQLi22%, SSL35% XXE-45% XSS70% 20% &gt;20% -</p><p> iOS</p><p> Android</p><p>82%</p><p> -10 iOS Android . 1 API , 1 . , 4 .</p><p> iOS -, , - .</p><p> - . .</p><p>-</p><p>10</p><p>-</p><p>24.</p><p>-</p><p> C-</p><p>10</p><p>10</p><p>10</p><p>6</p><p>6</p><p>4</p><p>4</p><p>4</p><p>3</p><p>3</p><p> 10</p><p>9</p><p>9</p><p>8</p><p>8</p><p>7</p><p>7</p><p>7</p><p>7</p><p>7</p><p> -</p><p>-</p><p>-</p></li><li><p>OC Android iOS - (Google Play App Store ). </p><p> Windows Phone , - (Windows Store) . Windows Phone - ( Windows Store 9). Windows Phone 8, , ( ) - Windows 8 , Windows Phone 8. </p><p> , : - .</p><p> :</p><p> SIM- SIM-, SIM Application Toolkit (STK);</p><p> Web- web-;</p><p> , - API, .</p><p> :</p><p> TCP/IP, HTTP;</p><p> SMS- SMS (Short Messaging Service). ;</p><p> USSD- USSD (Unstructured Supplementary Service Data). , SMS, ;</p><p> IVR- , IVR (Interactive Voice Response). .</p><p> , - API, , , . .</p></li><li><p> , . , . . , , - , , , : - ( ) , , , .</p><p> .</p><p> : , .</p><p> :</p><p>1. :</p><p> ( ); ; ; ; .</p><p>2. :</p><p> ( ); (Reverse Engineering):</p><p> ; ;</p><p> .</p></li><li><p>1. , . - .2. , , .3. , , . , Digital Security - - 2009-2011 . :</p><p> ; ; , , . </p><p> . , . </p><p>: , - , , . , Drive-by-Download. </p><p> , - , - , : .</p><p>: , - . : . , - Wi-Fi, -. - . SSL. , - .</p><p>: SSL. - SSL- . .</p><p> , jailbreak (iOS) root- (Android) . </p></li><li><p> ( ) . </p><p> , Digital Security.</p><p> , , API, . , , . </p><p> :</p><p> ; ; ; -.</p><p> . 01.01.2013.</p><p> . . ( ). , , .</p></li><li><p> .</p><p> iOS </p><p> Finance Business AppStore .</p><p>* 41, , .</p><p>* . , .</p><p> iOS</p><p>Faktura.ruUnreal MojoBank Soft SystemsExclusive Processing iDA MobileIntervale Compass PlusIdlineLICQulix Systems SMS Trac </p><p>543332211111111116*</p><p> 100 14 </p><p> 6 28</p><p>100 14 </p><p>6 28</p><p> iOS</p><p>, , , .</p><p>2012201120102009</p><p>40</p><p>12</p><p>4</p><p>, </p><p> SMS-</p><p>40 10</p><p>4 2</p><p>698 5</p><p> iOS</p><p>iOS Apple. - Apple: iPod, iPhone, iPad Apple TV. iOS Mac OS X. App Store.</p><p> Objective-C, -- . Objective-C Smalltalk.</p></li><li><p> .</p><p> iOS </p><p> Finance Business AppStore .</p><p>* 41, , .</p><p>* . , .</p><p> iOS</p><p>Faktura.ruUnreal MojoBank Soft SystemsExclusive Processing iDA MobileIntervale Compass PlusIdlineLICQulix Systems SMS Trac </p><p>543332211111111116*</p><p> 100 14 </p><p> 6 28</p><p>100 14 </p><p>6 28</p><p> iOS</p><p>, , , .</p><p>2012201120102009</p><p>40</p><p>12</p><p>4</p><p>, </p><p> SMS-</p><p>40 10</p><p>4 2</p><p>698 5</p></li><li><p> SDK</p><p> - , . , SDK 4.3 TLS 1.0, 29 , 5 . , - SDK, -. SDK .</p><p> PIE</p><p>PIE (Position Independent Executable) , - , , - . ASLR (Address Space Layout Randomization).</p><p> SSP</p><p>SSP (Stack Smashing Protection) , , - . - , .</p><p> ARC</p><p>ARC (Automatic Reference Counting) , - . - , , use-after-free double free.</p><p> SSL</p><p> SSL- , - . - App Store. - , . , .</p><p> API</p><p>20 20</p><p>16 24</p><p>29 11</p><p>26 14</p><p>SDK 6.0SDK 4.3</p><p>2 5 16 17</p><p>SDK 5.0S DK 5.1</p></li><li><p>SQL- </p><p> SQLite. - , , .</p><p> Keychain</p><p>Keychain iOS , .</p><p> keychain , - . , - .</p><p> jailbreak keychain . . . -, .</p><p>XSS </p><p> UIWebview ( WebKit) - . JavaScript-, .</p><p> , .</p><p>XXE</p><p>XXE (XML eXternal Entity) , (entities) XML-, .</p><p> , jailbreak, , jailbreak ( jailbreak sandbox ). , - . , .</p><p> . , , - , .</p><p>31 9</p><p>12 28</p><p>12 28</p><p>32 8</p><p>32 8</p></li><li><p> NSLog</p><p> NSLog . - .</p><p> - : , , . , - format string.</p><p> - , , . (, , PIN, ..), . iOS- , pasteboard.</p><p> iOS - . - , .</p><p> . - . , - , . , - .</p><p>Pasteboard</p><p>, . - pasteboard , . </p><p> , - , , , .</p><p> App Store .</p><p>7 33</p><p>11 29</p><p>28 12</p><p>28 12</p></li><li><p> :</p><p> ; ; jailbreak.</p><p> Objective-C , - . </p><p> jailbreak . , jailbreak . , -, jailbreak, , - . </p><p> - jailbreak. , - .</p></li><li><p>40 10</p><p>2 4</p><p>7110 4</p><p>Faktura.ruUnreal MojoBank Soft SystemsExclusive ProcessingiDA MobileIntervale</p><p>54433322</p><p>LICQulix Systems</p><p>11111117*</p><p> Android</p></li><li><p> Android</p><p>. 16</p><p>Android - Google, Samsung, HTC, LG, Sony .. Android C Linux. Google Play Store.</p><p> Java, Dalvik . -, C.</p><p>40 10</p><p>2 4</p><p>7110 4</p><p>Faktura.ruUnreal MojoBank Soft SystemsExclusive ProcessingiDA MobileIntervale</p><p>54433322</p><p>LICQulix Systems</p><p>11111117*</p></li><li><p> AndroidManifest.xml</p><p> AndroidManifest.xml , , .</p><p> , - , API-. , WRITE_EXTERNAL_STORAGE SD-. Android - SD-: . , - SD-.</p><p> , , . </p><p>android.permission.INTERNETandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.READ_PHONE_STATEandroid.permission.CALL_PHONEandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.RECEIVE_SMSandroid.permission.READ_CONTACTSandroid.permission.ACCESS_MOCK_LOCATIONandroid.permission.VIBRATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.SEND_SMSandroid.permission.ACCESS_GPSandroid.permission.CHANGE_CONFIGURATIONandroid.permission.CAMERAandroid.permission.CONTROL_LOCATION_UPDATESandroid.permission.READ_SMSandroid.permission.WRITE_CONTACTSandroid.permission.ACCESS_LOCATION_EXTRA_COMMANDSandroid.permission.CHANGE_WIFI_STATEandroid.permission.READ_LOGSandroid.permission.WRITE_SMSandroid.permission.BROADCAST_STICKYandroid.permission.GET_TASKSandroid.permission.WRITE_SETTINGS</p><p>40352723211716131276655533332221111</p><p>14 20 6</p><p> , , ( , SMS-, ).</p></li><li><p>, (IPC)</p><p> - . -. , -.</p><p> HTTP- SSL</p><p> SSL-. - http://, HTTP, .</p><p> , - .</p><p> SSL-</p><p> SSL- , - . , - , SSL- , , . SSL- .</p><p> , - .</p><p> API</p><p>23 17 53 15 7 2</p><p>28 12</p><p>34 6</p></li><li><p> - , IMEI IMSI. , - . , IMEI IMSI , .</p><p> , .</p><p> Broadcast- </p><p> Android . . - , .</p><p> .</p><p> webView </p><p> webView. HTML-, . , JavaScript, Flash . , HTTP XSS - JavaScript-. JavaScript, - .</p><p> JavaScript, , . - . - XSS . webView JavaScript .</p><p> - .</p><p>22 18</p><p>29 11</p><p>3317</p><p>4 2 17</p></li><li><p> Android , - , . - .</p><p> .</p><p> XML</p><p> XML External Entities. - XXE -.</p><p> - .</p><p>SQL-</p><p> Android SQLite. ContentProvider. - SQL- - , , - . </p><p> / .</p><p> , , . </p><p> Android , - . </p><p> .</p><p> root- . - root- . root- .</p><p>38 2</p><p>39 1</p><p>32 8</p></li><li><p> . </p><p> , , . Android. </p><p> , . - , - . -.</p><p> , , , , . , .</p><p> , . . - . OWASP Top 10 Mobile Risks.</p><p> . .</p><p> , MDM- .. - , . , -. , , -.</p><p> . - . , --.</p><p>:</p><p>1. ;</p><p>2. ;</p><p>3. ;</p><p>4. ;</p><p>5. , ;</p><p>6. ;</p><p>7. .</p></li><li><p>OOO </p><p>, 115054. , . , .57, .6.: +7 (495) 223-07-86</p><p>info@dsec.rusales@dsec.ru</p><p>Digital Security -, , -, PCI PA-DSS, , , SCADA, ERP- - .</p><p> , , Digital Security .</p><p> Digital Security Research Group, -, Oracle, SAP, 1C . 2007 . Digital Security Research Group - - , - . , - Digital Security Research Group - , IBM, VMware, SAP, Oracle .</p><p>Digital Security SAP ERPScan - SAP.</p><p> Digital Security Research Group OWASP-EAS - - , BlackHat HacklnTheBox.</p><p> 2009 Digital Security PCI DSS Russia, 2011 ZeroNights.</p><p> , 197183. -, . , .37.: +7 (812) 703-15-47</p><p>www.dsec.ruwww.erpscan.ru</p><p> iOS iOS SDK PIE SSP ARC</p><p> API SSLSQL- KeychainXSS XXE NSLog </p><p> Android Android AndroidManifest.xml , (IPC)</p><p> API HTTP- SSL SSL- Broadcast- webView XMLSQL-</p></li></ul>

Recommended

View more >