DOCSLIB.ORG

Lookout: Securing Mobility

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Lookout: Securing Mobility Lookout: Securing Mobility Tim LeMaster | John Cuddehe August 2018 "The views expressed in this presentation are those of the author(s) and do not necessarily reflect the official policy or position of the Air Force, the Department of Defense, or the U.S. Government." Your users are going mobile. Starbucks is your fall-back Wi-Fi. Your mobile device is a gold mine for hackers ENTERPRISE EMAIL ENTERPRISE APPS SaaS, Custom Apps CREDENTIALS PHOTO ALBUM Stored, Soft Tokens Whiteboard Screenshots, IDs ENTERPRISE NETWORK SENSORS VPN, WiFi GPS, Microphone, Camera How are you protecting your corporate data? APPS DEVICE NETWORK WEB & CONTENT Selected, purchased, Selected, purchased, LAN / corporate Wi-Fi Filtered at and managed by and managed by VPN when traveling organizational organization organization perimeter - On device firewalls - Anti-Virus - Administered by IT - perimeter firewall - Secure Web Gateways - DLP - Managed by SCCM - TIC PC - Vulnerability scanning - OS version control - OS integrity monitoring - Behavioral monitoring Selected, purchased, Organizational issued, Always on cellular Often unfiltered and managed by user* some BYOD User selected Wi-Fi - Partially managed using MDM MOBILE Lookout 2017 | Confidential and Proprietary MOBILE VECTORS RISK MATRIX APPS DEVICE NETWORK WEB & CONTENT THREATS - Spyware & - Privilege escalation - Man-in-the-middle - Phishing surveillanceware - Remote jailbreak/root - Fake cell towers - Drive-by-download - Trojans - Spoofed WiFi APs - Malicious websites & - Other malicious apps - Root CA installation files COMPONENTS OF RISK OF COMPONENTS SOFTWARE VULNERABILITIES - Out-of-date apps - Out-of-date OS - Network hardware - Malformed content that - Vulnerable SDKs - Dead-end hardware vulnerabilities triggers OS or app - Poor coding practices - Vulnerable pre-installed - Protocol stack vulnerabilities apps vulnerabilities BEHAVIOR & CONFIGURATIONS - Apps that leak data - User initiated - Proxies, VPNs, root-CAs - Opening attachments - Apps that breach org jailbreak/root - Auto-joining and visiting links to security policy - No pin code/password* unencrypted networks potentially unsafe - Apps that breach - USB debugging content regulatory compliance Lookout 2017 | Confidential and Proprietary Select Android Threats Discovered Over The Last 12 Months April 2017 May 2017 December 2017 January 2018 January 2018 February 2018 June 2018 Monero Igexin AppInsite PickBitPocket skyGoFree Pallas Cryptomining Sonvpay Malware that spies Android apps were on victims through Mobile malware that Apps in Play that Android based mAPT Drive-by Sophisticated “re-packaged” to otherwise benign opens tunnels through pretended to be used in Dark Caracal cryptomining Android spyware secretly sign up for apps by enterprise firewalls. Bitcoin wallet apps. global espionage campaign targeting created by an Italian premium paid downloading Sleeps while app is in Tricks users into campaign against millions of Android company for services in the malicious plugins. use to evade sending the military personnel, users leveraging targeted surveillance. background. Some Over 500 apps detection. Up to 1 attacker’s wallet enterprises, forced redirects and apps are in Play. available on Google million downloads. address, not their journalists, trojanized apps. Play used the Igexin own, to the payer. universities, and ad SDK. activists. 746 Lookout-discovered threats in the Google Play Store (2017) 50 out of 1000 devices encounter app-based threats 100 in 1000 devices encounter a phishing URL every year 5 in 1000 enterprise devices have been rooted = Discovered by Lookout in Play Store and subsequently removed by Google. iOS Security Highlights (2016 - 2018) August 2016 September 2016 November 2016 March 2017 Jan 2018 June 2018 Trident Vulnerabilities* Dribble – app that Fake retail apps in Scareware Repackaged or iOS 11.3.1 Jailbreak Lookout discovered jailbreaks iPhone App Store demanding ransom modified “++” apps three zero-day vulnerabilities, one in Lookout discovered the Fraudsters were able to Lookout discovered a Sideloaded repackaged iOS jailbreaks are always Safari and two in the iOS Dribble client that can get fake retail apps into scareware campaign on or modified apps, such being sought and worth kernel. Exploited by jailbreak your iPhone, on the App Store. Victims iOS where attackers as a lot of money. Apple attackers to silently apple store. It appears were subject to ID and blocked use of Safari Facebook++,Instagram+ closes them quickly when implant Pegasus that the app had been in sensitive data theft, until the victim paid the , YouTube++, and public. surveillanceware. the App Store since July including credit card and attacker money in the Line++. These modified 30th home address details. In form of an iTunes Gift apps can often include media reports, including Card. unknown or unvetted Pegasus Good Morning America, code, which has not Surveillanceware* Lookout researchers passed Apple’s review provided advice to users. and could potentially be The most sophisticated malicious. attack we’ve seen on any endpoint. A full take of data off the iOS device and device’s 8 in 1000 devices encountered a man-in-the-middle threat surroundings. 110 in 1000 devices encountered a sideloaded app 29, on average, vulnerabilities disclosed each iOS update* * Looking at all updates between iOS 9 and iOS 11 = Discovered by Lookout. Kill Chain over Phishing Link 9 Many Major Threats Start With Phishing Pegasus (August 25th 2016) Chrysaor (April 23rd 2017) ViperRat (February 16th 2017) Frozen Cell (OCtober 5th 2017) SpyWallerV2 (January 10th 2018) TropiCTrooper (November 16th 2017) JadeRAT (OCtober 20th 2017) SoniCSpy (August 10th 2017) Dark CaraCal/Pallas (January 18th 2018) Desert Storm (April 16th 2018) Stealth Mango/Tangelo (May 15th 2018) • Stealth Mango & Tangelo • Threat Overview • Country of origin : Pakistan • Threat actor : Members of the Pakistani military (Op C Major / Transparent Tribe) • Platforms targeted: iOS, Android, Windows • Attack vector : social engineering, physical access • Targets (Primary) • Pakistan officials & citizens • Afghanistan officials & citizens • Other regional people from Balochistan and nearby cities • Targets (inadvertent) • U.S. officials and civilians • Australian and British Diplomats • NATO members • Iranian officials and civilians Phishing message sent through Facebook Messenger. 12 Stealth Mango Capabilities •Records phone calls & environment audio •Takes screenshots, captures keystrokes •Retrieves –contacts lists, SMS Messages, calendar events, browsing history, installed apps, device information –Videos, Images, and Audio Files on ext storage •Tracks device via GPS •Very configurable - record more or less data •Tries to upload databases of popular apps –Facebook, Skype, Instagram, Instagram, Tinder, WhatsApp, etc. Stealth Mango Data Exfiltration Analysis of the EXIF metadata contained in stolen images found that many contained information identifying the phone’s make and model on which they were taken. While this doesn’t definitely mean victims were using these makes and models, it is interesting to note that the majority are from iPhones. Breakdown of the media types of exfiltrated content. Stealth Mango Data Exfiltration - Samples A redacted snippet of the original photo taken of exfiltrated image from the U.S. Central Command Afghan Assistant Minister of Defense. Exfiltrated content was found to contain military photos including a series of The full detailed report is available from images from an event with military attendees from numerous countries https://blog.lookout.com/stealth-mango including U.S. Army personnel. How Do We Address the Threat? Gartner Market Guide for Mobile Threat Defense Solutions Mobile malware is on the rise “The signs are clear that mobile threats can no longer be ignored.” “By 2019, mobile malware will amount to one-third of total malware reported in standard tests, up from 7.5% today." The Gartner document is available upon request from Lookout. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Source: Gartner Market Guide for Mobile Threat Defense Solutions, Dionisio Zumerle and John Girard, August 2017 Lookout Mobile Endpoint Security - How It Works INCIDENT RESPONSE SECURITY POLICY LOOKOUT SECURITY CLOUD LOOKOUT CONSOLE Organizational Data CONDITIONAL ACCESS X ! X Lookout MES Solution Capability Features 1. Malware and vulnerability Detection • Automated analysis using Machine Learning • Data exfiltration • Sideload detection 2. Risky/Non-compliant application visibility • Insecure data handling • Policy enforcement / Blacklisting • Enterprise application upload • SSL strip/downgrade 3. MITM detection • Certificate validation • Root/Jailbreak detection - Fingerprint analysis 4. OS Analysis • iOS version, ASPL visibility and policy • USB debug mode 5. Device configuration risk • Device encryption enabled • Inspect all outbound URLs 6. Phishing Protection • Regardless of source 7. API support • SIEM connectors, MDM integration Our massive global device network allows us to apply big data
Load more

Recommended publications
  • New Advanced Persistent Threat (APT) Dark Caracal
    New Advanced Persistent Threat (APT) Dark Caracal Alex Tarter and Gurbir Singh Thales Cyber & Consulting Threats, Persistent Threats and Advanced Persistent Threats. If someone out there really wants your data, they will eventually get it. An Advance Persistent Threat is Advanced (employ leading edge cyber techniques and technologies), Persistent (additional resources financial or personnel as required) Threat that keeps hammering away in the background quietly acquiring data without the owners knowledge. What is an Advance Persistent Threat? An advance persistent threat is a sophisticated cyber activity supported by a nation state to compromise a high value target. Attacks of this nature are stealthy, can persist for months or years and are discovered long after the compromise has taken place if at all, Discovery of Dark Caracal A report published on 18th January 2018 announced the discovery of an Advanced Persistent Threat (APT) conducting Cyber Espionage on a global scale since at least 2012. An extensive investigation by the security company Lookout and the civil rights organisation – the Electronic Frontier Foundation (EFF) have identified a command and control infrastructure used to generate test and distribute malware. This group targets both windows and mobile Android platforms. The sophisticated malware has targeted thousands of mobile devices belonging to journalists, military personnel, lawyers, activists and educational institutions. Overtime it has extracted hundreds of gigabytes of private data including sms messages, call records, audio recordings and photos from user devices in at least 21 countries including Europe and North America. Social Engineering and Spear-Phishing techniques were used to acquire the targets. Dark Caracal servers hosted phishing sites, which look like login portals for familiar services such as Twitter, Google and Facebook.
    [Show full text]
  • The Dark Caracal
    Security Now! Transcript of Episode #647 Page 1 of 29 Transcript of Episode #647 The Dark Caracal Description: This week's news continues to be dominated by the industry-shaking Meltdown and Spectre vulnerabilities. We will catch up with what's new there, then discuss the Net Neutrality violation detection apps that are starting to appear; a new app and browser plugin from the search privacy provider DuckDuckGo; a bit of welcome news from Apple's Tim Cook about their planned response to the iPhone battery-life and performance debacle; a bit of errata; and some feedback from our terrific listeners. Then we take a look into a state-level, state-sponsored, worldwide, decade-long cyberespionage campaign which the EFF and Lookout Security have dubbed "Dark Caracal." High quality (64 kbps) mp3 audio file URL: http://media.GRC.com/sn/SN-647.mp3 Quarter size (16 kbps) mp3 audio file URL: http://media.GRC.com/sn/sn-647-lq.mp3 SHOW TEASE: It's time for Security Now!. Steve Gibson is here. And as always, lots of security news. We'll be talking about it all, including a security threat pinpointed by Lookout Security and the Electronic Frontier Foundation. Out of Lebanon, the Dark Caracal. It's all coming up next on Security Now!. Leo Laporte: This is Security Now! with Steve Gibson, Episode 647, recorded Tuesday, January 23rd, 2018: The Dark Caracal. It's time for Security Now!, the show where we cover your privacy, your security, your deep-rooted insecurities with this guy right here, Steve Gibson. Steve Gibson: And if you don't have them at the beginning of the podcast..
    [Show full text]
  • Nation-State Espionage: Hunting Multi-Platform Apts on a Global Scale
    #RSAC SESSION ID: MBS-F01 NATION-STATE ESPIONAGE: HUNTING MULTI-PLATFORM APTS ON A GLOBAL SCALE Eva Galperin Michael Flossman Director of Cybersecurity Head of Threat Intelligence Electronic Frontier Foundation Lookout @evacide @terminalrift Overview #RSAC Talk Overview 1. Background 2. Mobile Components 3. Desktop Components 4. Data Exfiltration 5. Infrastructure and Identities 6. Building 3F6 7. Conclusions and Updates 2 #RSAC BACKGROUND Previous Research #RSAC 4 Who was it? #RSAC 5 Who was it? #RSAC 6 #RSAC MOBILE COMPONENTS Pallas & FinFisher Pallas – Trojanized Apps #RSAC Secure messaging • Threema, Signal, WhatsApp, Primo, Plus Messenger Privacy / Connectivity • Orbot, Psiphon Miscellaneous • Flash Player, Google Play Push Most are fully functional 8 Pallas - Capabilities #RSAC • Take photos with front or back camera • Retrieve device metadata • Intercept incoming text messages and exfiltrate • Retrieve text messages • Retrieve latitude / longitude from GPS • Retrieve information about all accounts • Silently record audio with device microphone • Send an SMS to an attacker specified number • Retrieve contacts, call logs, attacker specified files • Retrieve messages and any corresponding decryption keys from messaging apps • Scan and retrieve nearby WIFI access points • Retrieve a list of installed packages • Delete attacker specified files and directories • Download and install additional apps 9 Attack Vectors #RSAC Phishing messages Phishing messages Physical access Facebook group WhatsApp Phishing server Watering hole server tweetsfb.com
    [Show full text]
  • 5 Mobile Security Assumptions
    #1: Jailbroken Phones Are Safe Jailbreaking mobile devices is still common, despite the practice being frowned upon by manufacturers. But there’s more to risk than just Apple’s ire. Don't set out on your digital transformation To jailbreakjourney a mobile alone. device is to free it of the manufacturer’s constraints, opening up opportunities to customise – which is why it’s still an alluring past time for individuals and organisations. Unfortunately, jailbreaking also puts users at great risk in the following ways: Get in touch to find out how we can help • Passwordsyou every and other step secure of information the way. become vulnerable • Dubious applications are able to talk to each other • Apple push notifications (APNs) are faked, leading users to assume their device is secure • Malware has access to the devices root, spreading an infection rapidly In short, it’s worth thinking twice before trading security for a chance to customise your device. KeyRaider Back in November 2015, users of jailbroken iPhones became victims of the jailbreak malware called KeyRaider – which stole 225,000 Apple IDs, as well as thousands of certificates, receipts, and private keys Source: Palo Alto Research Centre #2: Public App Stores Are Safe You’re downloading an application via a public app store, so it’s all safe, right? …Right? WithDon't so many appsset on out the market, on yourit shouldn’t digital be a surprise transformation to find out that some of them are suspectjourney when it comes alone. to how secure they are, and yet we put a lot of trust into the app vetting process.
    [Show full text]
  • Read Our Submission to the European Court of Human Rights
    In the European Court of Human Rights Application No. 46259/16 BETWEEN:- Privacy International and others Applicant v. the United Kingdom Respondent Government THIRD-PARTY INTERVENTION ARTICLE 19: Global Campaign for Free Expression and The Electronic Frontier Foundation I. Introduction 1. This third-party intervention is submitted on behalf of ARTICLE 19: Global Campaign for Free Expression (ARTICLE 19) and the Electronic Frontier Foundation (EFF, jointly Interveners). 2. ARTICLE 19 is an independent human rights organisation that works around the world to protect and promote the right to freedom of expression and the right to freedom of information. ARTICLE 19 monitors threats to freedom of expression in different regions of the world, as well as national and global trends and develops long-term strategies to address them and advocates for the implementation of the highest standards of freedom of expression, nationally and globally. 3. The Electronic Frontier Foundation is a non-profit legal and policy organization that safeguards freedom of expression and privacy in the digital world. EFF regularly files amicus curiae or intervener briefs in court cases of consequence regarding freedom of expression. Drawing on the expertise of its attorneys and staff technologists, EFF’s briefs seek to educate courts about Internet technologies and the broader consequences of laws and decisions affecting those technologies. 4. The Interveners welcome the opportunity to intervene as third parties in this case, by the leave of the President of the Court, which was granted on 15 July 2019 pursuant to Rule 44 (3) of the Rules of Court. These submissions do not address the facts or merits of the applicant’s case.
    [Show full text]
  • Pocket Spies. Advanced Persistent Espionage Campaigns Go Mobile
    .SIAK-Journal – Zeitschrift für Polizeiwissenschaft und polizeiliche Praxis Braganca, Maschenka Pocket Spies. Advanced Persistent Espionage Campaigns Go Mobile SIAK-Journal − Zeitschrift für Polizeiwissenschaft und polizeiliche Praxis (3/2018), 19-29. doi: 10.7396/2018_3_B Um auf diesen Artikel als Quelle zu verweisen, verwenden Sie bitte folgende Angaben: Braganca, Maschenka (2018). Pocket Spies. Advanced Persistent Espionage Campaigns Go Mobile, SIAK-Journal − Zeitschrift für Polizeiwissenschaft und polizeiliche Praxis (3), 19-29, Online: http://dx.doi.org/10.7396/2018_3_B. © Bundesministerium für Inneres – Sicherheitsakademie / Verlag NWV, 2018 Hinweis: Die gedruckte Ausgabe des Artikels ist in der Print-Version des SIAK-Journals im Verlag NWV (http://nwv.at) erschienen. Online publiziert: 12/2018 3/2018 .SIAK- JOURNAL Pocket Spies Advanced Persistent Espionage Campaigns Go Mobile Mobile advanced persistent threat (APT) campaigns are simply the natural evolution of an attack type. It was just a matter of time before attackers would focus on exploiting a device that is so critical to our digital life. Threat actors always try to be ahead of the game, and advancements in tactics, techniques and procedures (TTPs) used shouldn’t come as a surprise. While we notice massive changes in the way malware is written, developed and new techniques pioneered that help leave infiltration unnoticed (hardware embedded malware or fileless malware, etc.), little attention has been paid to the mobile front, although it certainly is the one electronic device no one can function without. Over the past year, we have been observing how attackers use a device that is so ubiquitous in everyone’s daily life, together with the sophistication of serious malware authors that Maschenka Braganca, Sr.
    [Show full text]
  • Threat Group Cards: a Threat Actor Encyclopedia
    THREAT GROUP CARDS: A THREAT ACTOR ENCYCLOPEDIA Compiled by ThaiCERT a member of the Electronic Transactions Development Agency TLP:WHITE Version 1.01 (19 June 2019) Threat Group Cards: A Threat Actor Encyclopedia Contents Introduction ............................................................................................................................................................................ 8 Approach ........................................................................................................................................................................... 8 Legal Notice ...................................................................................................................................................................... 9 Acknowledgements .......................................................................................................................................................... 9 Advanced Persistent Threat (APT) Groups .................................................................................................................... 10 Anchor Panda, APT 14 .................................................................................................................................................. 11 Allanite ............................................................................................................................................................................. 12 APT 3, Gothic Panda, Buckeye ...................................................................................................................................
    [Show full text]