Mobile Security Attacks: A Glimpse from the Trenches
summary
Live tests show 10% of networks at some point perform active traffic manipulation and users have a 23% chance to hit one within a month; a public map (maps.sky.com) logs ~100,000 incidents. Researchers build a working demo website that delivers malicious configuration profiles to iOS devices, installs a proxy/VPN plus a root cert, and successfully intercepts/decrypts app and mail traffic, captures keystrokes and session tokens. Other specifics: the iOS “goto fail” SSL bug lingered 17 months, Heartbleed hit ~50M Android devices, and ~92% of users accept invalid cert warnings.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:54A Holistic Outlook on Mobile Security
- 3:21The Physical Layer
- 5:14Real World Incident Statistics
- 7:49Network Based Attacks
- 8:22Implementation-Based Vulnerabilities
- 10:47Gotofail - The Code
- 14:44Design-Based Vulnerabilities (Generic)
- 20:55IOS Security Model
- 22:26Configuration Profiles
- 22:41Demo: Participation Instructions
- 29:49Malicious Profiles
- 31:33Design-Based Vulnerabilities (Mobile)
- 33:24App Level Security & Privacy
- 33:55App Level Vulnerabilities
- 36:22Certificate Pinning
- 38:04HRH - Attack Flow
- 40:41Google's Focus on Malware
- 42:12The Maliciously Vulnerable App
- 43:13Summary
related talks
39mMobile App Security
21mWhen Attackers Go Mobile-First: What Developers Need to Know
52mWhere, how, and why is SSL traffic on mobile getting intercepted?
48mA Practical Attack Against VDI Solutions
27miOS Attack Vectors and how to protect your app
47mSecurity Threats & Mitigations for iOS Developers
27mA Practical Attack Against VDI Solutions
58mUncovering OWASP’s Mobile Risks in iOS Apps