For  Enterprise
Attacking	  BYOD	  Enterprise	  Mobile	  Security	  Solutions

Vincent	  TanSenior	  Security	  Consultant	  whoami• Sunny Singapore• Senior Security Consultant @ Vantage Point Security• 4+ years hacking stuff professionally, specializing inmobile & exotic stuff

2

Agenda1. iOS Applications in General
2. What is BYOD? Why BYOD? Who uses BYOD?
3. Security Features of BYOD Solutions
4. Good Technology
5. iOS Jailbreaks / Attack Vectors
6. Local & Network Attacks against Good EMS•Story of Alice & Bob

3

iOS Applications• > 1.4m Applications1 in iOS App Store• ~10% in Business Category• 35% of Enterprises have an Enterprise App Store2• Simple vs Complex Functionality• Mobile application capabilities have not caught up with device capabilities• Maybe 10% of apps have advanced functionality• MDM, Soft Tokens, Payment Applications, HomeKit.

1	  http://www.zdnet.com/article/ios-­‐versus-­‐android-­‐apple-­‐app-­‐store-­‐versus-­‐google-­‐play-­‐here-­‐comes-­‐the-­‐next-­‐battle-­‐in-­‐the-­‐app-­‐wars/

2 https://go.apperian.com/rs/300-­‐EOJ-­‐215/images/Apperian%202016%20Executive%20Enterprise%20Mobility%20Report_FINAL_20160216.pdf?aliId=16373787

4

BYOD
• BYOD?
• What and Why?

5

BYOD

https://www.apperian.com/resources/2016-­‐executive-­‐enterprise-­‐mobility-­‐report/

6

BYOD
• BYOD?
• What and Why?

• BYOD Adoption• 74% using or adopting BYOD
• Governments• Enterprise Mobile Security• MAM (Mobile Application Management)• MIM (Mobile Information Management)• MDM (Mobile Device Management)
http://www.zdnet.com/article/research-­‐74-­‐percent-­‐using-­‐or-­‐adopting-­‐byod/
7

Protection Claims“prevent employees from opening files in unsecured apps,backing up business data to personal cloud-based services, orcopying and pasting business ...”
“Detect OS tampering and other policy
violations”“…remotely lock or wipe the device.”“Protect mobile apps and servers frombeing hacked…”

8

Enterprise Mobile Security Features
JailbreakDevice	  PINJB	  Detection
Container
Container

Application	  VPNApp	  Wipe	  /	  LockContainer	   Container	  Password Encryption
9

Good Technology• Acquired by Blackberry in Nov 2015
• Top 5 EMS Solution Providers

10Good Technology• Acquired by Blackberry in Nov 2015
• Top 5 EMS Solution Providers• GFE received CC EAL4+ in 2013 and GD solution in 2016
• GD platform used as a foundation to the GCS to replace GFE• GD platform allows developers to create and distribute apps that
integrates with the GD services framework

12GFE vs GCS
Good	  For	  Enterprise(GFE)
Email✔

Good	  Collaboration	  Suite	  (GCS)
Good	  WorkMDM✔

✔

Local	  File	  Storage Only

Good	  Share	  – Access	  enterprise	  file	  share

Instant	  Messaging✖

Good	  Connect

Intranet	  Access✖

Good	  AccessCloud	  Deployment✖

✔

Integrated	  MAM✖

✔

Common	  Platform✖

✔

File	  Share

13

iOS Jailbreaks
iOS	  Versions

7.0
–
7.0.6

7.1
–
7.1.2

8.0
–
8.1

8.0
–
8.3

8.1.3
–
8.4

9.0–
9.0.2

9.1
–
9.3.3b

10bJail	  Broken?

evasi0n7

Pangu

Pangu8TaiG

TaiG

Pangu9Pangu

Not	  Public• Check out Stefan Esser’s talk on “iOS 678
Security - A Study In Fail”

14What about root?
• Non-Jailbroken Devices?
• Resign via developer certificate• But apps will need to be reactivated•

Physical Access• DROPOUTJEEP (think NSA, GCHQ)• Lost Devices / Stolen Devices•

Remote Attacks• Jailbreakme.com v1 / 2 / 3• State sponsored / Corporate Espionage

1	  http://www.tripwire.com/state-­‐of-­‐security/vulnerability-­‐management/creating-­‐iphone-­‐rootkits-­‐and-­‐like-­‐the-­‐nsas-­‐dropout-­‐jeep/
2https://blog.fortinet.com/post/ios-­‐malware-­‐does-­‐exist

15

Attack Vector• Not normal pen testing…
•

Not just setting proxy and using Burp

• I’m not attacking the application• Changing the environment in which the application runs.
• Not new. API Hooking and DLL Injections on Windows.
LD_PRELOAD on Linux. I’m just doing it on iOS.

16

Swizzler• How do I change the Environment?
• Built an App… More precisely a Dynamic Library (aka tweak)• DYLD_INSERT_LIBRARIES=Swizzler• Loads itself before an application starts• Control all functionalities of an application

17

iOS Security Architecture

Swizzler
Substrate18

Swizzler

19

Swizzler

20

Swizzler

21

Swizzler

22

What else can you control?

23

Jailbreak
Jailbreak	  Detection

Container

App	  DLP

Device	  PIN

AppContainer	  Password

Local & Network Attacks Against Good EMS

25

Local Attacks

28

JailbreakDevice	  PINJB	  Detection
Container
Container

Jailbreak Detection
App	  
Wipe	  /	  Lock
Container	   Container	  Password Encryption
29

JailbreakDevice	  PINJB	  Detection
Container
Container

App	  
Wipe	  /	  LockContainer	   Container	  Password Encryption✔ Device	  PIN
✔ Jailbreak✔ Jailbreak	  Detection✖ Container	  Password✖ Container	  Encryption✖ App	  Wipe	  /	  Lock31

Blacklist of Files
FILE *file	  =	  fopen("/Applications/Cydia.app",	  "r");if	  (file)	  {fclose(file);
return	  JAILBROKEN;}

FILE *replaced_fopen (const char	  *filename,	  constchar	  *mode)	  {if	  (blockPath(filename))	  {errno =	  ENOENT;
return	  NULL;}}

file	  =	  fopen("/usr/bin/ssh",	  "r");if	  (file)	  {fclose(file);
return	  JAILBROKEN;}

bool blockPath(const char	  *fpath)	  {…
NSArray *denyPatterns =	  [[NSArray alloc]	  initWithObjects:	  	  	  	  	  	  	  	  @"Cydia",	  	  	  	  	  	  	  	  @"lib/apt",	  	  	  	  	  	  	  	  @"/private/var/lib/apt",	  	  	  	  	  	  	  	  @"/var/lib/apt",	  	  	  	  	  	  	  	  @"/var/tmp/cydia.log",	  	  	  	  	  	  	  	  @"/etc/apt/",	  	  	  	  	  	  	  	  @"/var/cache/apt”
….
}

32

Prohibited Functionsint pid =	  fork();if(pid>=0){
return JAILBROKEN;}

pid_t replaced_fork(void){	  	  	  	  if	  (disableJBDectection())	  {return	  -­‐1;	  	  	  	  }pid_t ret	  =	  orig_fork();
return	  ret;}

33

Jailbreak Detection• Jailbreak Detection Methods• Blacklist of files• Directories• Symbolic Links• Prohibited Commands• File System• URL Handles• Kernel Parameters & many more ...
34

Jailbreak / Policy Implementation
GT::GeneralUtilityClass::constructStringList (GT::GeneralUtilityClass::tamper_detection_method_t,	  std::vector<std::string,	  std::allocator<std::string>	  >	  )35

Jailbreak / Policy Implementation• GD::GDSecureStorage::handleWrongPwd• GD::GDSecureStorage::wipeDevice• GD::PolicyProcessor::processLockAction• GD::GDLibStartupLayer::checkPartialCompliance• GD::PolicyComplianceChecker::checkComplianceUnlocked• GD::PolicyComplianceChecker::checkComplianceLocked

36

JailbreakDevice	  PINJB	  Detection
Container
Container

Password Bruteforce
App	  
Wipe	  /	  Lock
Container	   Container	  Password Encryption
37

JailbreakDevice	  PINJB	  Detection
Container
Container

App	  Wipe	  /	  Lock
Container	   Container	  Password Encryption✔ Device	  PIN✔ Jailbreak✔ Jailbreak	  Detection✔ Container	  Password✖ Container	  Encryption✖ App	  Wipe	  /	  Lock

39

JailbreakDevice	  PINJB	  Detection
Container
Container

Disable App Lock
&Device Wipe

App	  Wipe	  /	  Lock
Container	   Container	  Password Encryption

40

JailbreakDevice	  PINJB	  Detection
Container
Container

App	  Wipe	  /	  Lock
Container	   Container	  Password Encryption✔ Device	  PIN✔ Jailbreak✔ Jailbreak	  Detection✔ Container	  Password✖ Container	  Encryption✔ App	  Wipe	  /	  Lock

42

JailbreakDevice	  PINJB	  Detection
Container
Container

Containerization
App	  
Wipe	  /	  Lock
Container	   Container	  Password Encryption
43

JailbreakDevice	  PINJB	  Detection
Container
Container

App	  Wipe	  /	  Lock
Container	   Container	  Password Encryption✔ Device	  PIN
✔ Jailbreak✔ Jailbreak	  Detection✔ Container	  Password✔ Container	  Encryption✔ App	  Wipe	  /	  Lock

45

Network Attacks

47

JailbreakDevice	  PINJB	  Detection
Container
Container

Application	  VPNApp	  Wipe	  /	  LockContainer	   Container	  Password Encryption
48

Application VPN

49

GD Network50

GD Network Communications
Two methods of communication with the enterprise application server,
1. GDHttpRequest
2. Native URL Loading (NSURL, NSMutableURL, etc.)

51

52

GDHttpRequest•

Part of the GD SDK••#import <GDNETiOS.h>Easy to enable proxy••[GDHttpRequest enableHttpProxy:ip withPort:port];[GDHttpRequest disablePeerVerification];

53

Native URL Loading• Enabled via GDURLLoadingSystem Class•[GDURLLoadingSystem enableSecureCommunication]• Enabled by default• Proxying traffic is harder• Doesn’t obey iOS network proxy settings• Swizzle [NSURLConnection initWithRequest]

54

Hooking the NetworkSSL	  over	  TCP3.	  HTTP(S)	  Traffic

55

Does everything suck?
• Local device access is important, but remote attacks possible.
•

https://www.youtube.com/watch?v=STIHO2XOOiM• Employee Education.
•Be careful of USB chargers. BadUSB.

• Intranet == Internet• Additional security checks on apps

57

Take Aways!
• Think outside the box to break the box!
• BYOD Policy helps to a certain extent, but such attacks will always
be possible.
• Do not blindly trust what the vendors sell you.
• https://github.com/vtky/Swizzler

58Thank You!

vincent.vtky@outlook.com
https://www.linkedin.com/in/vincenttky@vincent_tky

59