Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter...
Transcript of Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter...
![Page 1: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/1.jpg)
Security Through Obscurity... powered by Transport Layer Encryption!
Peter Frühwirt, SBA ResearchSebastian Schrittwieser, FH St. Pölten
![Page 2: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/2.jpg)
SSL != protection against protocol analysis
![Page 3: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/3.jpg)
SSL interception enables man-in-the-middle attacks
for protocol analysis purposes
![Page 4: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/4.jpg)
transport layer encryption cannot replace good protocol design!
![Page 5: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/5.jpg)
Certificates?
![Page 6: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/6.jpg)
http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c
![Page 7: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/7.jpg)
Quizduell
![Page 8: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/8.jpg)
highly popular in Austria
![Page 9: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/9.jpg)
highly popular in Austria
![Page 10: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/10.jpg)
![Page 11: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/11.jpg)
![Page 12: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/12.jpg)
Let’s play a round of Quizduell ;)
![Page 13: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/13.jpg)
Photoswap
![Page 14: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/14.jpg)
for=i=in={1..112711};=do=wget=.k=http://www.fototausch.app.de/images/$i.jpg;=done
![Page 15: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/15.jpg)
(iP)_ACF814E4E7914DECAA91DE3336F2C9D9-20140318062452.jpg
(WP)_WByn38Nd8wLfPoHQd3PzHbf2P9E_3d-20140318102034.jpg
357506057844677-20140318102050.jpg
hardware ID time stampphone type
IMEI
![Page 16: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/16.jpg)
(iP)_ACF814E4E7914DECAA91DE3336F2C9D9-20140318062452.jpg
(WP)_WByn38Nd8wLfPoHQd3PzHbf2P9E_3d-20140318102034.jpg
357506057844677-20140318102050.jpg
hardware ID time stampphone type
IMEI
![Page 17: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/17.jpg)
![Page 18: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/18.jpg)
download pictures
delete picture
![Page 19: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/19.jpg)
Countermeasures?
![Page 20: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/20.jpg)
Certificate Pinning
Verification if particular certificate is used
![Page 21: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/21.jpg)
![Page 22: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/22.jpg)
Reduced costs
Increased security
Less flexibility
![Page 23: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/23.jpg)
75 %
25 %
certificate pinningno certificate pinning
Facebook Messenger
Shazam
eBay
ÖBB Scotty
AntiVirus Security
Tango
Google Earth
LOVOO
Geizhals
Geizhals
Stocard
AutoScount24wetter.com
LogoQuizWhatsapp
Snapchat
Tinder
NavigonRuntastic
iMessage
Quizduell
AppStore
Viber
Hike
Rublys
Quizduell
![Page 24: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/24.jpg)
never ever trust the client (even if it’s your own client)!
server-side validation of every client request
(the 80’s called and want their advice back)
![Page 25: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/25.jpg)
secure side channel
establish a trusted second channel
![Page 26: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/26.jpg)
Conclusions
![Page 27: Security Through ObscuritySecurity Through Obscurity... powered by Transport Layer Encryption! Peter Frühwirt, SBA Research ... AntiVirus Security Tango Google Earth LOVOO Geizhals](https://reader033.fdocuments.in/reader033/viewer/2022053001/5f053e647e708231d411ff03/html5/thumbnails/27.jpg)
‣ Many smartphone applications implement insecure protocols
‣ These protocols are hidden behind transport encryption, which does not prevent protocol analysis
‣ Don’t rely on Security through Obscurity