EHE-Chapter 9: Mobile Attacks

Zigbee protocol?

ZigBee protocol can transmit long-distance data through a mesh network. The specification handles applications with a low data rate of 250 Kbps, but its use increases battery life.

SS7

is a communication protocol that allows mobile users to exchange communication through another cellular network (especially when roaming).

HaLow

Wi-Fi HaLow, uses 900 MHz bands for extended-range Wi-Fi networks and supports Internet of Things (IoT) communication with higher data rates and wider coverage range than the previous standards.

Which of the following protocols allows mobile users to exchange communication through another cellular network while roaming?

SS7

zANTI application ?

is an android application that allows you to perform the following attacks:

• Create malicious Wi-Fi hotspot to capture victims to control and hijack their device traffic

• MITM and DoS attack

• View, modify, and redirect all HTTP requests and responses

• Redirect HTTPS to HTTP; redirect HTTP request to a particular IP or web page

• Insert HTML code into web pages

• Hijack sessions

• View and replace all images that are transmitted over the network

WinHex editor?

hexadecimal editor, used for computer forensics, data recovery, low-level data processing, and IT security.

Foremost program ?

Foremost is a forensic program to recover lost files based on their headers, footers, and internal data structures.

Autospy tool?

Autopsy is a digital forensics platform and graphical interface to The Sleuth Kit (TSK) and other digital forensics tools.

Joe targeted a coffee shop and wanted to sniff customers' credentials who were paying bills from their Android devices. To achieve this, he hosted a free Wi-Fi hotspot using an Android application that lured customers to connect to it. After the devices got connected to his network, Joe performed a MITM attack to hijack their sessions with banking portals and recorded credentials being entered to log in.

Which of the following tools has Joe employed in the above scenario?

zANTI

Simjacker

is a vulnerability associated with a SIM card’s S@T browser (SIMalliance Toolbox Browser),

SMiShing:

SMS phishing (also known as SMiShing) is a type of phishing fraud in which an attacker uses SMS to send text messages containing deceptive links of malicious websites or telephone numbers to a victim.

Framing

is an abnormality whereby a program, while writing data to a buffer, surfeits the intended limit and overwrites the adjacent memory.

Clickjacking

also known as a user interface redress attack, is a malicious technique used to trick web users into clicking something different from what they think they are clicking.

David, a professional hacker, was hired to attack mobile devices owned by an organization. He broadcasted a well-crafted text message with a malicious link to all the organization's mobile numbers to collect their personal and financial information.

Identify the type of attack performed by David in the above scenario.

sMISHing

Sam, a professional hacker, was assigned to attack Bluetooth-enabled devices at a coffee shop. He employed a process to compromise the Bluetooth devices that are set to discoverable mode, then sniffed sensitive data from targeted devices.

Which of the following types of attack has Sam initiated in the above scenario?

bluebugging

Bluebugging

Setting a mobile device’s Bluetooth connection to “open” or the “discovery” mode and turning on the automatic Wi-Fi connection capabilit

Bluesmacking

attack occurs when an attacker sends an oversized ping packet to a victim's device, causing a buffer overflow. This type of attack is similar to an Internet Control Message Protocol (ICMP) ping-of-death attack.

Bluesnarfing

is the theft of information from a wireless device through a Bluetooth connection, often between phones, desktops, laptops, PDAs, and other devices.

Agent smith attack

attacks are carried out by luring victims into downloading and installing malicious apps designed and published by attackers in the form of games, photo editors, or other attractive tools from third-party app stores such as 9Apps.

Which of the following types of attack involves replacing legitimate apps in a mobile device with malicious apps designed by a hacker and producing a large volume of advertisements on the target device to attain financial benefits?

agent smith attack

James, a software developer at an organization, handed over a fully developed mobile application to the testing team for validation. During validation, the testing team disabled the two-factor authentication implemented on it and forgot to enable it before deployment. This oversight allowed attackers to penetrate the server just by cracking users' credentials as the two-factor authentication was disabled on the application.

Identify the mobile security risk demonstrated in the above scenario.

M10—extraneous functionality

m5 code tampering

covers binary patching, local resource modification, method hooking, method swizzling, and dynamic memory modification.

m5- insufficent cryptography

cryptography to a sensitive information asset. However, cryptography is insufficient in some ways. This category covers issues in which cryptography is attempted but not performed correctly.

M10- extraneous functionality

Often, developers include hidden backdoor functionality or other internal development security controls that are not intended to be released into a production environment. For example, a developer may accidentally include a password as a comment in a hybrid app. Another example involves the disabling of two-factor authentication during testing.

m2- insecure data storage

Insecure data storage vulnerability arises when development teams assume that users and malware will not have access to a mobile device’s file system and subsequently to sensitive information in the device’s data stores. “Jailbreaking” or rooting a mobile device bypasses encryption protection mechanism.

Insecure authenication

This category captures notions of authenticating the end user or bad session management such as failing to identify the user when it is required, failure to maintain the user’s identity when it is required, weaknesses in session management.

improper platform usage

This category covers the misuse of a platform feature or the failure to use platform security controls. It includes Android intents, platform permissions, and the misuse of Touch ID, Keychain, or some other security control that is part of the mobile device’s OS.

Insecure data storage

Insecure data storage vulnerability arises when development teams assume that users and malware will not have access to a mobile device’s file system and subsequently to sensitive information in the device’s data stores. “Jailbreaking” or rooting a mobile device bypasses encryption protection mechanism.

code tampering

covers binary patching, local resource modification, method hooking, method swizzling, and dynamic memory modification.

reverse engineering

analysis of the final core binary to determine its source code, libraries, algorithms, and other assets. Software such as IDA Pro, Hopper, otool, and other binary inspection tools give the attacker insights into the inner workings of the application.

Walter, a professional hacker, was trying to exploit nascent vulnerabilities in a target mobile application. He utilized a technique to analyze the final core binary to determine its source code and libraries. Further, this analysis gave him insights into the inner workings of the application.

Identify the mobile risk exploited by Walter in the above scenario.

reverse engineering

SQL injection

is a technique used to take advantage of nonvalidated input vulnerabilities to pass SQL commands through a web application for execution by a backend database.

Brute force

Attackers adopt the trial-and-error approach to guess the valid input to a particular field. Applications that allow any number of input attempts are generally prone to brute-force attacks.

Cross site request forgery

CSRF attacks exploit web page vulnerabilities that allow an attacker to force an unsuspecting user’s browser to send unintended malicious requests.

In which of the following attacks do attackers exploit web page vulnerabilities to force an unsuspecting user’s browser to send unintended malicious requests?

cross site request forgery

user intiated code

is an activity that tricks the victim into installing malicious applications or clicking links that allow an attacker to install malicious code to exploit the user’s browser, cookies, and security permissions.

andriod rooting

Rooting allows Android users to attain privileged control (known as “root access”) within Android’s subsystem. Like jailbreaking, rooting can result in the exposure of sensitive data stored in the mobile device.

carrier loaded software

Pre-installed software or apps on devices may contain vulnerabilities that an attacker can exploit to perform malicious activities such as deleting, modifying, or stealing data on the device, eavesdropping on calls, and so on.

Extraneous functionality

Often, developers include hidden backdoor functionality or other internal development security controls that are not intended to be released into a production environment.

Jack, a network administrator in an organization, was assigned to identify the risks associated with the organization's confidential information by implementing a BYOD policy. Jack thoroughly examined and identified a potential exposure of all the corporate data.

Which of the following BYOD security risks is identified by Jack in the above scenario?

data leakage and endpoint

An organization has implemented BYOD policy that allows employees to bring their personal devices for business operations. One day, during lunchtime, Joseph, an employee, transferred project details to his colleague using freely available Wi-Fi. An attacker connected to the same Wi-Fi network sniffed the communication and gained access to the shared data.

Which of the following BYOD risk was demonstrated in the above scenario?

Sharing confidential data on unsecured network

David, a technical support team member, leveraged the BYOD policy and copied confidential data into his device. He immediately tried to forward it to the rival company using the company’s Wi-Fi network but failed to do so, as the company had enforced restrictions on sending corporate data to the outside network.

Which of the following BYOD risks was demonstrated in the above scenario?

disgruntled employees

Steven, an employee, was using his device for the company’s business operations. He stored family photos, videos, and business data in a single folder. When he was supposed to send business data to a client, he attached the entire folder and transferred it to the client without verifying the attached data.

Which of the following BYOD risks was demonstrated in the above scenario?

mix personal with private data

Which of the following solutions helps system administrators to deploy and manage software applications across all enterprise mobile devices to secure, monitor, manage, and support devices?

IBM MaaS360:

Which of the following tools helps users protect their mobile devices against cyber threats or mobile-based security issues?

lookout personal

Samson, a security professional, is assigned a task to monitor communication, detect threats, and secure all BYOD devices in the organization. He deployed a tool that provides comprehensive protection for iOS and Android devices against a mobile network, device, and application cyberattacks.

Which of the following tools was utilized by Samson to secure the BYOD devices?

Zimperium’s zIPS