Mobile Hacking & Security

Duration

3 days

Overview

This course is designed to give you the skills you need to understand the security strengths and weaknesses in Apple iOS, Android, and wearable devices including Apple Watch and Android Wear. With these skills, you will evaluate the security weaknesses of built-in and third party applications. You'll learn how to bypass platform encryption, and how to manipulate Android apps to circumvent obfuscation techniques. You'll leverage automated and manual mobile application analysis tools to identify deficiencies in mobile app network traffic, file system storage, and inter-app communication channels. You'll safely work with mobile malware samples to understand the data exposure and access threats affecting Android and iOS devices, and you'll exploit lost or stolen devices to harvest sensitive mobile application data

Course Objectives

• Use jailbreak tools for Apple iOS and Android systems
• Conduct an analysis of iOS and Android file system data to plunder compromised devices and extract sensitive mobile device use information
• Analyze Apple iOS and Android applications with reverse-engineering tools
• Change the functionality of Android and iOS apps to defeat anti-jailbreaking or circumvent in-app purchase requirements
• Conduct an automated security assessment of mobile applications
• Use wireless network analysis tools to identify and exploit wireless networks used by mobile devices
• Intercept and manipulate mobile device network activity
• Leverage mobile-device-specific exploit frameworks to gain unauthorized access to target devices
• Manipulate the behavior of mobile applications to bypass security restrictions

Course Outline

Device Architecture and Common Mobile Threats

• Mobile Problems and Opportunities
• Challenges and opportunities for secure mobile phone deployments
• Weaknesses in mobile devices
• Exploiting weaknesses in mobile apps: bank account hijacking exercise
• Mobile Device Platform Analysis
• iOS and Android permission management models
• Code signing weaknesses on Android
• Inter-app communication channels on iOS
• Android app execution: Android Runtime vs. Android Dalvik virtual machine
• Android Nougat security benefits
• Wearable Platforms
• Application isolation and data sharing for Apple Watch
• Network connectivity and Android Wear apps
• Data exfiltration in WatchOS
• Weaknesses in wearable device authentication controls
• Deficiencies in Android Wear and storage encryption
• Mobile Device Lab Analysis Tools
• Using iOS and Android emulators
• Android mobile application analysis with Android Debug Bridge (ADB) tools
• Uploading, downloading and installing applications with ADB
• Application testing with the iOS Simulator
• Mobile Device Malware Threats
• Trends and popularity of mobile device malware
• Mobile malware command and control architecture
• Efficiency of Android ransomware malware threats
• Analysis of iOS malware targeting non-jailbroken devices
• Hands-on analysis of Android malware
• Mobile malware defenses: what works, and what doesn't

Mobile Platform Access and Application Analysis

• Unlocking, Rooting and Jailbreaking Mobile Devices
• Legal issues with rooting and jailbreaking
• Jailbreaking iOS
• Android root access through unlocked bootloaders
• Root exploits for Android
• Debugging and rooting Android Wear devices
• Using a rooted or jailbroken device effectively: tools you must have!
• Mobile Phone Data Storage and File System Architecture
• Data stored on mobile devices
• Mobile device file system structure
• Decoding sensitive data from database files on iOS and Android
• Extracting data from Android backups
• Using file system artifacts for location disclosure attacks beyond GPS coordinates
• Hands-on attacks against password management apps
• Network Activity Monitoring
• Mobile application network capture and data extraction
• Capturing iOS cellular/4G network traffic
• Transparent network proxying for data capture
• Encrypted data capture manipulation
• Extracting files and sensitive content from network captures
• Recovering sensitive data from popular cloud storage providers
• Static Application Analysis
• Retrieving iOS and Android apps for reverse engineering analysis
• Decompiling Android applications including Android Wear
• Circumventing iOS app encryption with Dumpdecrypted and Rasticrac
• Header analysis and Objective-C disassembly
• Accelerating iOS disassembly: Hopper and IDA Pro
• Swift iOS apps and reverse engineering tools

Mobile Application Reverse Engineering

• Automated Application Analysis Systems
• iOS application vulnerability analysis with Needle
• Structured iOS application header analysis
• Tracing iOS application behavior and API use
• Effective Android application analysis with Androwarn
• Android application interaction and Intent manipulation with Drozer
• Extracting secrets with KeychainDumper
• Reverse Engineering Obfuscated Applications
• Identifying obfuscation techniques
• Decompiling obfuscated applications
• Effective reconstructed code annotation with Android Studio
• Decrypting obfuscated content with Simplify
• Application Report Cards
• Step-by-step recommendations for application analysis
• Tools and techniques for mobile platform vulnerability identification and evaluation
• Recommended libraries and code examples for developers
• Detailed recommendations for jailbreak detection, certificate pinning, and application integrity verification
• Android and iOS critical data storage: keychain and key store recommendations

Penetration Testing Mobile Devices, Part 1

• Manipulating Application Behavior
• Runtime iOS application manipulation with Cycript
• iOS method swizzling
• Android application manipulation with Apktool
• Reading and modifying Dalvik bytecode
• Adding Android application functionality, from Java to Dalvik bytecode
• Using Mobile Device Remote Access Trojans
• Building RAT tools for mobile device attacks
• Hiding RATs in legitimate Android apps
• Customizing RATs to evade anti-virus tools
• Effective deployment tactics for RAT phishing attacks
• Wireless Network Probe Mapping
• Monitoring network probing activity
• Visualizing network discovery and search
• Wireless anonymity attacks
• Leveraging iOS and Android wireless network scanning characteristics
• Weak Wireless Attacks
• Wireless network scanning and assessment
• Exploiting weak wireless infrastructure
• Monitoring mobile device network scanning
• Exploiting "Google WiFi" and iPad or iPhone captive portal detection
• Secure network impersonation
• Enterprise Wireless Security Attacks
• Certificate impersonation and mobile devices
• Manipulating enterprise wireless authentication
• RADIUS server impersonation attacks
• Network Manipulation Attacks
• Using man-in-the-middle tools against mobile devices
• Sniffing, modifying, and dropping packets as MitM
• Mobile application data injection attacks
• Sidejacking Attacks
• Identifying mobile applications vulnerable to sidejacking
• Using sidejacking effectively in a penetration test
• Hands-on exploitation of popular mobile applications

Mobile Application Reverse Engineering

• Automated Application Analysis Systems
• iOS application vulnerability analysis with Needle
• Structured iOS application header analysis
• Tracing iOS application behavior and API use
• Effective Android application analysis with Androwarn
• Android application interaction and Intent manipulation with Drozer
• Extracting secrets with KeychainDumper
• Reverse Engineering Obfuscated Applications
• Identifying obfuscation techniques
• Decompiling obfuscated applications
• Effective reconstructed code annotation with Android Studio
• Decrypting obfuscated content with Simplify
• Application Report Cards
• Step-by-step recommendations for application analysis
• Tools and techniques for mobile platform vulnerability identification and evaluation
• Recommended libraries and code examples for developers
• Detailed recommendations for jailbreak detection, certificate pinning, and application integrity verification
• Android and iOS critical data storage: keychain and key store recommendations

Penetration Testing Mobile Devices, Part 1

• Manipulating Application Behavior
• Runtime iOS application manipulation with Cycript
• iOS method swizzling
• Android application manipulation with Apktool
• Reading and modifying Dalvik bytecode
• Adding Android application functionality, from Java to Dalvik bytecode
• Using Mobile Device Remote Access Trojans
• Building RAT tools for mobile device attacks
• Hiding RATs in legitimate Android apps
• Customizing RATs to evade anti-virus tools
• Effective deployment tactics for RAT phishing attacks
• Wireless Network Probe Mapping
• Monitoring network probing activity
• Visualizing network discovery and search
• Wireless anonymity attacks
• Leveraging iOS and Android wireless network scanning characteristics
• Weak Wireless Attacks
• Wireless network scanning and assessment
• Exploiting weak wireless infrastructure
• Monitoring mobile device network scanning
• Exploiting "Google WiFi" and iPad or iPhone captive portal detection
• Secure network impersonation
• Enterprise Wireless Security Attacks
• Certificate impersonation and mobile devices
• Manipulating enterprise wireless authentication
• RADIUS server impersonation attacks
• Network Manipulation Attacks
• Using man-in-the-middle tools against mobile devices
• Sniffing, modifying, and dropping packets as MitM
• Mobile application data injection attacks
• Sidejacking Attacks
• Identifying mobile applications vulnerable to sidejacking
• Using sidejacking effectively in a penetration test
• Hands-on exploitation of popular mobile applications

Penetration Testing Mobile Devices, Part 2

• SSL/TLS Attacks
• Exploiting HTTPS transactions with MitM attacks
• Core pen test technique: TLS impersonation and iOS Mail.app for password harvesting
• Integrating MitM tools with Burp Suite for effective HTTP manipulation attacks
• Client Side Injection (CSI) Attacks
• Android webView and JavaScript injection for remote code execution
• Harvesting session cookies through Android browser vulnerabilities with Metasploit
• Using the Spec.js library for mobile browser vulnerability detection and exploit delivery
• Web Framework Attacks
• Site impersonation attacks
• Application cross-site scripting exploits
• Remote browser manipulation and control
• Data leakage detection and analysis
• Hands-on attacks: mobile banking app transaction manipulation
• Back-end Application Support Attacks
• Exploiting SQL injection in mobile application frameworks
• Leveraging client-side injection attacks
• Getting end-to-end control of mobile application server resources

Programme scope, delivery arrangements and suitability are confirmed during enquiry.