Owasp App Sec Ireland Windows Phone 7 Security

  • View
    1.272

  • Download
    0

Embed Size (px)

DESCRIPTION

 

Text of Owasp App Sec Ireland Windows Phone 7 Security

  • 1. David RookWindows Phone 7 SecurityOWASP AppSec IrelandFriday, 7 September 2012
  • 2. if (slide == introduction) System.out.println("Im David Rook"); Application Security Lead, Realex Payments, Dublin CISSP, CISA, GCIH and many other acronyms Security Ninja (@securityninja) Speaker at developer and security conferences Microsoft Developer Security MVP SC Magazine Information Security Rising Star 2012 Developed and released Agnitio and the WPAAFriday, 7 September 2012
  • 3. Agenda Smartphones and apps - big numbers, little security? Windows Phone 7 introduction Windows Phone 7 platform security Windows Phone 7 application securityFriday, 7 September 2012
  • 4. Mobile device sales 2011 472 million Smartphones 31% Mobile 69% 1.3 billionSource: http://www.gartner.com/it/page.jsp?id=1924314 Friday, 7 September 2012
  • 5. Smartphone OS market share 2011 Microsoft 2% RIM 9% Symbian 12% Android 51% iOS 24%Source: http://www.gartner.com/it/page.jsp?id=2120015 Friday, 7 September 2012
  • 6. Smartphone OS market share 2011 Microsoft has 1.9% of the smartphone market share Smaller market share than something called BadaFriday, 7 September 2012
  • 7. Smartphone OS market share 2011Friday, 7 September 2012
  • 8. Smartphone OS market share 2011 Microsoft has 1.9% of the smartphone market share Smaller market share than something called Bada Should I even continue with this talk about Windows Phone 7? Similar approach to Android with many devices availableFriday, 7 September 2012
  • 9. Smartphone OS market share 2011Friday, 7 September 2012
  • 10. Smartphone OS market share 2011 Microsoft has 1.9% of the smartphone market share Smaller market share than something called Bada Should I even continue with this talk about Windows Phone 7? Similar approach to Android with many devices available IDC predict that they will have 20% market share by 2015Friday, 7 September 2012
  • 11. Smartphone OS market share 2011Friday, 7 September 2012
  • 12. Smartphone OS market share 2011 Microsoft has 1.9% of the smartphone market share Smaller market share than something called Bada Should I even continue with this talk about Windows Phone 7? Similar approach to Android with many devices available IDC predict that it will have 20% market share by 2015 20% is unlikely but its market share will increase in my opinionFriday, 7 September 2012
  • 13. Smartphone OS market share 2011Friday, 7 September 2012
  • 14. Windows Phone 7 Introduction The smartphone from Microsoft First released in late 2010 with 7 updates since then Based on Windows Embedded Compact v6 and v7 Minimum tough but fair hardware requirements Apps only available via the Windows Phone Marketplace Specifically aimed at the consumer market not enterpriseFriday, 7 September 2012
  • 15. Windows Phone 7 IntroductionFriday, 7 September 2012
  • 16. Windows Phone 7 Introduction .NET Compact Framework Version of the .NET framework for resource constrained devices Some of the same classes and some mobile specific ones Compiler translates your code into Intermediate Language Apps are JIT compiled and executed by the .NET CLR Only managed .NET code allowed in your apps*Friday, 7 September 2012
  • 17. Windows Phone 7 Introduction privatevoidbutton1_Click(objectsender,RoutedEventArgse) { MessageBox.Show("HelloOWASPAppSecIreland!"); } C# Compiler Managed Module .NET CLRFriday, 7 September 2012
  • 18. Windows Phone 7 Introduction Windows Phone 7 Kernel Architecture 32bit OS that runs inside a 4GB virtual address space 2GB allocated to the kernel and 2GB to process executing That isnt quite true, the process executing only gets 1GB 1GB is for components commonly mapped into all processesFriday, 7 September 2012
  • 19. Windows Phone 7 Introduction Windows Phone 7 Kernel Architecture APPLICATIONSSpace User TELSHELL.EXE UDEVICES.EXE SERVICESD.EXE CPROG.EXE COREDLL/WINSOCK/COMMCRL/WININET kCoreDLL.DLL KERNEL.DLLKernelSpace FILESYS.DLL Device.DLL GWES Network OAL.EXE FSDMGR.DLL Drivers HardwareFriday, 7 September 2012
  • 20. Windows Phone 7 Introduction Process Code Process Space 2GB User DLLs Memory Mapped Files GWES Kernel Space Drivers 2GB File System KernelFriday, 7 September 2012
  • 21. Windows Phone 7 Introduction Shared System Heap 256MB processes across all Common RAM Backed Mapfiles 256MB Process Memory Shared User DLLs 2GB 512MB Private to process each Process Space 1GB per processFriday, 7 September 2012
  • 22. Windows Phone 7 Platform Security Windows Phone 7 Security Model Chambers concept to enforce app isolation and least privilege The chambers provide a security boundary to restrict the apps Four chambers and apps run in one of them Three chambers have fixed permission sets The fourth chamber is capabilities basedFriday, 7 September 2012
  • 23. Windows Phone 7 Platform Security Trusted Computing Base (TCB) Elevated Rights Fixed permissions Chamber (ERC) Standard Rights Chamber (SRC) Least Privileged Capabilities based Chamber (LPC)Friday, 7 September 2012
  • 24. Windows Phone 7 Platform Security Trusted Computing Base (TCB) The kernel and kernel-mode drivers run in the TCB chamber Allows processes to have unrestricted access to most resources The TCB chamber can mo