How Mobile Malware Bypasses Secure Containers

34
How Mobile Malware Bypasses Secure Containers

description

How does mobile malware bypass secure containers, wrappers and MDM?

Transcript of How Mobile Malware Bypasses Secure Containers

Page 1: How Mobile Malware Bypasses Secure Containers

How Mobile Malware Bypasses Secure Containers

Page 2: How Mobile Malware Bypasses Secure Containers

The Mobile Application Sandbox Security Model

Page 3: How Mobile Malware Bypasses Secure Containers

The Mobile Applicaton SandBox Security Model

Page 4: How Mobile Malware Bypasses Secure Containers

The Mobile Applicaton SandBox Security Model

Storage

Page 5: How Mobile Malware Bypasses Secure Containers

The Mobile Applicaton SandBox Security Model

Memory

Page 6: How Mobile Malware Bypasses Secure Containers

The Mobile Applicaton SandBox Security Model

Device Functionalities (GPS,Network, SMS)

Page 7: How Mobile Malware Bypasses Secure Containers

The Mobile Applicaton SandBox Security Model

Storage

Memory

Device Functionalities (GPS,Network, SMS)

Page 8: How Mobile Malware Bypasses Secure Containers

The Mobile Applicaton SandBox Security Model

Storage

Memory

Device Functionalities (GPS,Network, SMS)

Page 9: How Mobile Malware Bypasses Secure Containers

Secure Containers and Wrappers

Page 10: How Mobile Malware Bypasses Secure Containers

Secure Containers

Memory

Device Functionalities (GPS,Network, SMS)

Storage

Page 11: How Mobile Malware Bypasses Secure Containers

Secure Containers

Memory

Device Functionalities (GPS,Network, SMS)

Storage

Page 12: How Mobile Malware Bypasses Secure Containers

Wrappers

Memory

Device Functionalities (GPS,Network, SMS)

Storage

Page 13: How Mobile Malware Bypasses Secure Containers

How Mobile Malware Breaks Secure Containers

Page 14: How Mobile Malware Bypasses Secure Containers

Attack Overview

Memory

Device Functionalities (GPS,Network, SMS)

Storage

] [ ] [

Page 15: How Mobile Malware Bypasses Secure Containers

Attack Overview

Memory

Device Functionalities (GPS,Network, SMS)

Storage

] [ ] [

Page 16: How Mobile Malware Bypasses Secure Containers

Attack Overview

Memory

Device Functionalities (GPS,Network, SMS)

Storage

] [ ] [

Page 17: How Mobile Malware Bypasses Secure Containers

Attack Overview

Memory

Device Functionalities (GPS,Network, SMS)

Storage

] [ ] [

Page 18: How Mobile Malware Bypasses Secure Containers

Step-by-Step

Page 19: How Mobile Malware Bypasses Secure Containers

Step 1: Infection of the Device/ Android

Page 20: How Mobile Malware Bypasses Secure Containers

Step 1: Infecting the Device with Malware/ iOS

Page 21: How Mobile Malware Bypasses Secure Containers

Step 2: Installing a Backdoor Android/“Rooting”

Administrative Every process can run as an administrative (root)

user if it is able to trigger a vulnerability in the OS

Vulnerability Each Android device had/ has a vulnerability Exploit Detection mechanisms don’t look at apps that

exploit the vulnerability

] [ ] [

Page 22: How Mobile Malware Bypasses Secure Containers

Step 2: Installing a Backdoor Android/iOS/ “Jailbreaking”

Community

Jailbroken

xCon

] [ ] [

Page 23: How Mobile Malware Bypasses Secure Containers

Step 3: Bypassing Containerization

Memory

Device Functionalities (GPS,Network, SMS)

Storage

] [ ] [

Page 24: How Mobile Malware Bypasses Secure Containers

Step 3: Bypassing Containerization

Memory

Device Functionalities (GPS,Network, SMS)

Storage

] [ ] [

Page 25: How Mobile Malware Bypasses Secure Containers

There’s More... Android

Page 26: How Mobile Malware Bypasses Secure Containers

Alternative Keyboards

Page 27: How Mobile Malware Bypasses Secure Containers

Alternative Keyboards

HELLO WORLD

Page 28: How Mobile Malware Bypasses Secure Containers

Alternative Keyboards

HELLO WORLD

Page 29: How Mobile Malware Bypasses Secure Containers

Mitigating the Threat with Lacoon

Mobile Security

Page 30: How Mobile Malware Bypasses Secure Containers

Behavioral-Based Malware Detection

Virtual execution

Cloud-based virtual execution of applications and payloads to detect exploits

Page 31: How Mobile Malware Bypasses Secure Containers

Behavioral-Based Malware Detection

Virtual execution

Identification

Cloud-based virtual execution of applications and payloads to detect exploits

Identification of malicious behaviors within the applications (such as keyloggers and screencaptures)

Page 32: How Mobile Malware Bypasses Secure Containers

Behavioral-Based Malware Detection

Virtual execution

Identification

Detection

Cloud-based virtual execution of applications and payloads to detect exploits

Identification of malicious behaviors within the applications (such as keyloggers and screencaptures)

Detection and blocking of C&C activity when mobile malware attempts to exfiltrate information from the device

Page 33: How Mobile Malware Bypasses Secure Containers

Behavioral-Based Malware Detection

Virtual execution

Identification

Detection

Blocking of drive-by attacks

Cloud-based virtual execution of applications and payloads to detect exploits

Identification of malicious behaviors within the applications (such as keyloggers and screencaptures)

Detection and blocking of C&C activity when mobile malware attempts to exfiltrate information from the device

Blocking of drive-by attacks, including exploits of unpatched Web browser vulnerabilities and Jailbreaking attempts

Page 34: How Mobile Malware Bypasses Secure Containers

Thank You.

Contact us:

[email protected]


Google App Engine Java security sandbox bypasses

Google App Engine Java security sandbox bypasses

PSB RF bypasses + PSB TFB electronics A. Blas PSB-LIU meeting04 Jun 2015 1 Executive summary: Components for the PSB rf-bypasses will be installed (Joao.

PSB RF bypasses + PSB TFB electronics A. Blas PSB-LIU meeting04 Jun 2015 1 Executive summary: Components for the PSB rf-bypasses will be installed (Joao.

BYPASSES, SANITARY SEWER OVERFLOWS COMBINED SEWER ...

BYPASSES, SANITARY SEWER OVERFLOWS COMBINED SEWER ...

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

New Digital Opportunity. - Cisco · (now part of Cisco)1 15% of C2 bypasses Web ports 80 & 443 millions of unique malware samples submitted to sandbox over 6 months Cisco AMP Threat

New Digital Opportunity. - Cisco · (now part of Cisco)1 15% of C2 bypasses Web ports 80 & 443 millions of unique malware samples submitted to sandbox over 6 months Cisco AMP Threat

Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

eIF2α phosphorylation bypasses premature senescence caused ... · AGING, December 2013, Vol 5 N 12 eIF2α phosphorylation bypasses premature senescence caused by oxidative stress

eIF2α phosphorylation bypasses premature senescence caused ... · AGING, December 2013, Vol 5 N 12 eIF2α phosphorylation bypasses premature senescence caused by oxidative stress

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Bypasses for a Billion: improving availability for all HASA 2013 Conference FINAL.pdf · Bypasses for a Billion: improving healthcare ... spend very low … % of GDP 17.9 9.7 ...

Bypasses for a Billion: improving availability for all HASA 2013 Conference FINAL.pdf · Bypasses for a Billion: improving healthcare ... spend very low … % of GDP 17.9 9.7 ...

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

COMBATTING ADVANCED MALWARE THREATS IN EMAIL · Advanced malware and advanced persistent threats (APT) are frequently used as terms to describe malicious code that bypasses traditional

COMBATTING ADVANCED MALWARE THREATS IN EMAIL · Advanced malware and advanced persistent threats (APT) are frequently used as terms to describe malicious code that bypasses traditional

MEMORANDUM1 Screening of Jackson and Five Corners' Bypasses › wp-content › uploads › ... · MEMORANDUM1 2 . 3 . Screening of Jackson and Five Corners' Bypasses . PREPARED FOR:

MEMORANDUM1 Screening of Jackson and Five Corners' Bypasses › wp-content › uploads › ... · MEMORANDUM1 2 . 3 . Screening of Jackson and Five Corners' Bypasses . PREPARED FOR:

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Construction of 2 Bypasses at Kelambakkam and Thiruporur …tnrdc.com/wp-content/uploads/2017/12/Bid_Document.pdf · 2017. 12. 6. · Construction of 2 Bypasses at Kelambakkam and

Construction of 2 Bypasses at Kelambakkam and Thiruporur …tnrdc.com/wp-content/uploads/2017/12/Bid_Document.pdf · 2017. 12. 6. · Construction of 2 Bypasses at Kelambakkam and

Abusing Access Tokens for UAC Bypasses James Forshaw ... · Reading your way around UAC Abusing Access Tokens for UAC Bypasses James Forshaw @tiraniddo

Abusing Access Tokens for UAC Bypasses James Forshaw ... · Reading your way around UAC Abusing Access Tokens for UAC Bypasses James Forshaw @tiraniddo

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

PAD: Pills, stents & bypasses. - CHRC Wheatcroft Presentation including ARS.pdf · PAD: Pills, stents & bypasses.! (Pick one and then keep walking)" Dr Mark Wheatcroft" Vascular Surgeon"

PAD: Pills, stents & bypasses. - CHRC Wheatcroft Presentation including ARS.pdf · PAD: Pills, stents & bypasses.! (Pick one and then keep walking)" Dr Mark Wheatcroft" Vascular Surgeon"