A Practical Attack Against VDI Solutions
summary
A proof‑of‑concept shows a malicious mobile app using screen scraping and off‑the‑shelf RATs to capture VDI sessions, stealing credentials via clipboard exfiltration, injected input events, or keyboard hooks (JDWP and Xposed style API hooks) after easy privilege escalation. iOS can be attacked by installing a malicious configuration profile to add a root CA and perform SSL MITM. CheckPoint gateway telemetry across 90 enterprises finds a median of two targeted mobile RAT infections per site and ~10% on iOS.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 0:45About MDM
- 2:35Agenda
- 3:53Disclaimer
- 4:48Recap
- 5:54Enablement
- 6:40Device Loss DLP
- 7:20VDI Marketing
- 8:20VDI Architecture
- 9:20Niche Players
- 9:55Mobile Remote Access Trojan
- 11:02HighLevel Example
- 11:44Government Grade Malware
- 13:13Surveillance Tools
- 14:40Hacking Team
- 15:17Research
- 15:45MSpy
- 16:02How Much
- 16:40The Architecture
- 17:44Key Findings
- 18:56The Report
- 19:15The Real Threat
- 25:45Android
- 34:29MacKinnon
- 37:28Screen Recording
- 38:45Communication
- 40:06iOS Configuration Profiles
- 41:06Demo
- 44:23Summary
related talks
27mA Practical Attack Against VDI Solutions
48mMobile Security Attacks: A Glimpse from the Trenches
23mMalicious MDM: Fun with iOS MobileConfigs
37mEnterprise Apps: Bypassing the IOS Gatekeeper
35mPractical Mobile App Attacks By Example
21mWhen Attackers Go Mobile-First: What Developers Need to Know
58mUncovering OWASP’s Mobile Risks in iOS Apps
49mHow to Hack Your Own Mobile App