Rise of the Machines

Talk on security risks of Android and opportunities for improvement with IoT

Transcript

1. Rise of the Machines Terminating Inherent Android Insecurity
2. ! Cred ! Android Ecosystem Today ! Why Look At Security Concerns for Android in IoT Now? ! History’s Lessons From Embedded Systems ! Android’s Security Missteps ! Rx For Android And IoT Overview 2
3. ! 1st mobile app stores, mobile JVMs, OHA + Android ! Security and embedded systems for US gov orgs ! Software engineer to startup founder/CEO ! Now VP/GM Mobile @ Rapid7 Giri_Sreenivas@rapid7.com @giri_sreenivas Cred 3
4. ! Most of my career has been spent working on various embedded systems •  Airborne Laser Program – Beam Control / Fire Control Systems •  Wireless Sensor Networks - DARPA’s Network Embedded Sensor Technologies (NEST) •  Trusted Computing – NSA High Assurance Platform •  Mobile – platforms, applications, security ! IoT is more than just adding IP connectivity to embedded devices ! Key pillars required for exponential growth in usage and acceptance •  Security •  Trustworthiness Why I Care About Android and the Internet of Things 4
5. Android Ecosystem Today 5
6. Q2 Global Mobile OS Share 6
7. Android By The Numbers Today 7
8. Android Platform Diversity 8
9. Five Years Of Android – Version History 9
10. ! Top 7 Mobile Threats •  Lost/Stolen Devices And Terminated Employees •  Jailbroken/Rooted Devices •  Trojans + Malware •  User Behavior With Apps •  Promiscuous Apps •  Phishing •  Man In The Middle ! 130 Android-specific CVEs Android Security Risks 10
11. Why Now? 11
12. ! Android is the most popular 3rd party OS for embedded systems development ! 28% of embedded developers will evaluate Android for their next project ! Unexpectedly, Android has become more broadly applicable for embedded systems with KitKat release •  Optimized for lower memory devices Why Worry About Android for IoT Now? 12
13. It’s All About The Apps 13
14. Apps In The Wild – Smartwatches 14
15. Apps In The Wild – Fridge 15
16. Apps In The Wild – TV 16
17. Apps In The Wild – Telematics 17
18. ! No appreciable value from apps •  Sometimes you won’t know until you try ! BOM Cost •  ARM SoC, RAM, I/O, Display ! Realtime needs •  Medical devices, safety systems When Android for IoT may not make sense 18
19. Embedded Systems Security Issues 19
20. ! Research by HD Moore, leader of Rapid7 Labs and founder of Metasploit ! Uncovered numerous security issues in embedded systems that can help us from repeating history ! Project Sonar •  http://miniurl.org/sonar Learning From The Past
21. ! Embedded RTOS that powers hundreds of millions of devices ! In 2010, HD scanned the Internet and found 250,000 vulnerable devices (310,000 in 2013) ! VxWorks Debug Service running on port 17185 ! Consequences •  Disable login security •  Read, write exec memory •  Reboot devices •  Scan memory for sensitive data ! Apple’s AirPort with an earlier firmware version was vulnerable VxWorks
22. ! HD scanned the Internet for responses to a standard UPnP discovery request for 5 months in 2012 and 81 million unique IPs responded ! 23 million were vulnerable to a single remote code execution flaw ! 1500+ vendors informed about 6900+ affected products ! 4 UPnP libraries responsible for 73% of devices ! Outdated/vulnerable libraries primarily responsible for security risk UPnP – Universal Plug and Play 22
23. ! Internet Census 2012 - http://internetcensus2012.bitbucket.org/ ! 1.2 million embedded Linux devices found vulnerable to simple credential login via telnet (e.g.: root:root, admin:admin, etc) ! 420,000 were used in a botnet to propagate scan ! Still think it’s a good idea to connect all devices to the Internet? Embedded Linux Botnets 23
24. Intermediate Recap 24
25. ! Android’s winning mobile and is poised to be a major platform for IoT ! Rapid pace of evolution in 5 years for Android ! Apps have played a critical role in bridging the last mile of UX and it is starting to take off for various embedded systems ! We’ve seen critical and widespread security mistakes with embedded systems on the WAN Intermediate Recap
26. ! It’s been 5 years since the G1 launched ! Thousands of device models have been sold across hundreds of carriers ! The biggest carriers have rigorous testing processes that adds months to the release and update cycles This Can’t Be Happening With Android… Right? 26
27. Android Security Missteps 27
28. ! T-Mobile G1 launched a root shell at boot and mirrored all user input to the shell ! “r-e-b-o-o-t” and the phone would reboot itself ! Trivial rooting Shell with root access, no pw needed
29. ! By obtaining the android.permission.INTERNET permission, apps could connect to a local port and capture data logged by an internal HTC app (HtcLoggers.apk) ! Data revealed by this logger captured sensitive personal information and device state ! Affected several device models, millions of devices in the wild Information Exfiltration 29
30. ! ZTE Score M shipped with root shell backdoor ! Bring the magic •  Hardcoded password (ztex1609523) ! Poof! Trivial rooting Shell with root with easy password 30
31. ! T-Mobile G2 shipped with a unique carrier customization – “Quick Keys” ! A version of the APK signed with the default debug cert from the SDK made it onto the master image ! An app published to Google Play with the same package name and cert would have hijacked system permissions Leaking System Privileges 31
32. ! Impacted 99% of Android devices ! Allowed for surreptitious insertion of malicious code into applications by bypassing application signing verification ! Numerous and inconsistent package verification implementations in the Android platform Master Key Vulnerability 32
33. ! Nexus devices vulnerable to flash SMS DOS attacks that render the device unusuable ! Not a traditional IP-targeted attack SMS DOS Attack 33
34. ! Commercialization of embedded systems is hard •  Hardware and software evolve quickly, in parallel ! Default/dummy configurations speed up dev/test/commercialization process but creep into the final product and create security holes ! Great paper by NCSU Android researcher Xuxian Jiang •  The Impact of Vendor Customizations on Android Security •  http://www.cs.ncsu.edu/faculty/jiang/pubs/CCS13.pdf ! Sometimes it’s ok to make mistakes if there’s an easy way to fix them Common Threads 34
35. Rx for Android and IoT 35
36. ! Atul Gawande, The Checklist Manifesto •  Significantly improved outcomes in various healthcare situations with simple checklists ! Checklists to prevent past security mistakes ! Before enabling a device with Android for IoT, go beyond the business case •  How do you patch when vulnerabilities are inevitably discovered? If you can’t patch it, you can’t secure it •  What’s at stake? ! Before shipping •  Pentest your devices! •  Ship an update methodology you can follow through on The Power of Checklists
37. Thanks! Giri Sreenivas, VP/GM Mobile at Rapid7 Giri_Sreenivas@rapid7.com @giri_sreenivas 37