Mobile products security in 2018

Presented @ ITEM-2018, 25 Mar 2018

Talk covers security aspects, basic checklist based on OWASP Mobile Security Testing checklist and links to consider

Transcript

1. ITEM 2018, 24-25 MARCH, KYIV, UKRAINE MOBILE PRODUCTS SECURITY IN 2018 by Petro Korienev Mobile Team Lead @ Sigma Software
2. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE IF YOU CAN’T SEE SLIDES, FOLLOW
 ←this QR …and let’s start
3. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE About @me: - Do mobile applications for $$$ - empower teams - CARE ABOUT: - Users - quality - security - performance South Africa, in the wild,
 slightly north of Antarctica
4. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE SECURITY FAILURES CASES
5. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Case 1:
 Data compromised from mobile API by installing root CERTificate
6. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE DATA EASILY REVERSIBLE BY CHARLES
7. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Case 2:
 SENSITIVE KEY LEAKED FROM CODEBASE
8. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE SOMETIMES NO nEED TO LEAK A KEY
9. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE PUBLIC_BUCKETS.count > 8000
10. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Case 3:
 Watch your logs
11. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE WHEN YOU LOG SENSITIVE DATA
12. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE AVERAGE COST of data breach for us company in 2017 is $3.5M …and probability to experience it during upcoming 2 years is 27%
13. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE SO WHAT?
14. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE MOBILE
 SECURITY 
 CHECKLIST
 
 
 by owasp
15. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Example checklist group
16. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE TAG cloud might be…
17. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE - DATA in motion - DATA in use - data at rest - Remote code execution - …
18. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE DATA in motion
19. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE MAIN POINTS - Use only secure versions (’s’ suffix) - Don’t (blindly) trust in networking protocol - Whitelist and pin certificates if possible - Don’t pass sensitive data unencrypted
20. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE UX - p24 NOT UX - another APP
21. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE PROBABLY, aWESOME UX
22. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE DATA in USE
23. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE MAIN POINTS - Use root (jailbreak) detection techniques - Use debugging prevention - Wipe sensitive data from memory and keep it off screen unless explicitly asked by user - Limit possible exploit sources
24. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE DATA AT REST
25. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE MAIN POINTS - Disk is shared dangerous resource - Sensitive data should never go plain - Your app should not compromise your user, even if his/her device was stolen
26. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE FEW PRACTICAL ADVICES - Watch your logs. Use your own logs instead of shared system log - Don’t use cookies - Use encryption provided by system/library - Don’t roll your own crypto
27. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE BUG SCORE
 Crypto 17% : 83% developer
28. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Remote code execution
29. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE MAIN POINTS - Don’t use WebView - Vulnerabilities can be close to unbelievable
30. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE SECURITY IN
 DEVELOPMENT PROCESS
31. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE MAIN POINTS - awareness " alerts & monitoring - ACLs - No secrets, keys etc. in code - All configuration activities should be recorded
32. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE MAIN POINTS - check your dependencies for vulnerabilities - be kind to your mates - be open to feedback
33. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Info leaked through 
 online communication You never know Brute Force IRL Lack of fishing
 protection Social treats something you never control
34. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE - Security is value 
 - EDUCATE security
 - think security from start
35. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Do THAT F***ing checklist, seriously
36. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Links & references - 1 - OWASP Mobile security checklist - OWASP Mobile security testing guide book - AWS Public writeable buckets study - Ponemon institute brief data breach cost - Ponemon institute security research - White source software
37. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Links & references - 2 - MIT Research on crypto bug source - Trident vulnerabilities for iOS - FlyUIA data breach - Felix Krause blogs on security topics - GDPR for developers - Crypto bugs MIT study
38. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE Links & references - 3 - Charles Proxy - iExplorer - Java decompilers - Hopper - AWS Key Nuker
39. PETRO KORIENEV, “MOBILE PRODUCTS SECURITY IN 2018”
 @ ITEM 2018, 24-25 MARCH, KYIV, UKRAINE soxjke@gmail.com
 petro.korienev@sigma.software PERFORMANCE TESTING IN SWIFT Interested? check my upcoming trainings or get in touch https://www.facebook.com/soxjke https://www.linkedin.com/in/petro-korienev MOBILE PRODUCTS SECURITY ESSENTIALS
40. ITEM 2018, 24-25 MARCH, KYIV, UKRAINE THANK YOU
 FOR YOUR TIME Now, don’t hesitate to ask