A Practical Attack Against VDI Solutions
summary
A proof‑of‑concept shows a malicious app and remote‑access trojans can silently extract VDI credentials and screen content: demo uses MSpy and Emotet‑style MRATs to keylog and screen‑record, uses JDWP debugging and Cydia‑substrate hooks to read client memory, and a crafted iOS configuration profile to MITM VDI traffic. Study of 3,200 corporate gateways (600k Android endpoints) finds ~4,500 Android and ~3,200 iOS hits, and a 50% infection rate for gateways with ≥2,000 devices, so the attacks reliably work.
AI-written summary · about
chapters (14)
- 0:00Start
- 1:48What Is Vdi Vi Virtual Desktop Infrastructure
- 3:19Example of How the Vdi Architecture Works
- 3:56Major Vdi Players
- 4:10Threats to Mobile Vdi Solutions
- 7:55Accessor Malware
- 14:49Russian Malware
- 15:41Grabbing Credentials Locally
- 16:13Privilege Elevation Vulnerability
- 18:13Screen Scraping
- 19:07Screen Recording
- 19:57Threat against Ios
- 22:40Conclusion
- 23:41Mobile Security Strategy
related talks
48mA Practical Attack Against VDI Solutions
48mMobile Security Attacks: A Glimpse from the Trenches
37mEnterprise Apps: Bypassing the IOS Gatekeeper
23mMalicious MDM: Fun with iOS MobileConfigs
48mMobile Device Mismanagement
21mWhen Attackers Go Mobile-First: What Developers Need to Know
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks