Advanced Social Network and Mobile Attack

Nipon Nachin, Consulting Manager

ITIL Expert, CISSP, GIAC GFCA, CISA, CISM, CSSLP, AMBCI, IRCA ISMS, ITSMS, BCMS Provisional Auditor, SSCP, Security+

Prathan Phongthiproek, Red-Team Manager

eCPPT, E|CSA, C|EH, CIW Security Analyst, CPTS, CWNP, CWSP, Security+, ITIL-F

ACIS Professional Center

Social Network

Source: 2008 CSI Computer Crime & Security Survey2

RSS feed

Social Network Threats

Source: 2008 CSI Computer Crime & Security Survey3

1) Malware Spam

2) Drive-By-Download

3) Malicious Applications

4) Session Hijacking

Malware Spam

Source: 2008 CSI Computer Crime & Security Survey4

1) Osama execution video scam

2) Enable dislike button

3) Top 10 profile spies

Malware Spam

Source: 2008 CSI Computer Crime & Security Survey5

Drive-By-Download

Source: 2008 CSI Computer Crime & Security Survey6

1) Malicious URL Shorten

2) Internet Explorer / Mozilla Firefox / Safari / Chrome Vulnerabilities

3) Web Browsers Toolbar

4) Adobe products vulnerabilities; **Flash, PDF, Etc

5) ActiveX and Java Applets

Drive-By-Download

Source: 2008 CSI Computer Crime & Security Survey7

Drive-By-Download

Source: 2008 CSI Computer Crime & Security Survey8

Victim

(4) Download exploit

(1) Client visit the landing page

(2) Redirect to get exploit

(3) Redirect to get exploit

Drive-By-Download

Source: 2008 CSI Computer Crime & Security Survey9

Spyware

Viruses

Worms

Trojans

Potentially

unwanted

applications

Adware

Unwanted/

offensive

content

Phishing

Drive-By-Download

Source: 2008 CSI Computer Crime & Security Survey1

0

Malicious Facebook Applications

Source: 2008 CSI Computer Crime & Security Survey

Malicious Facebook Applications

Source: 2008 CSI Computer Crime & Security Survey

Malicious Facebook Applications

Source: 2008 CSI Computer Crime & Security Survey

Sessions Hijacking

Source: 2008 CSI Computer Crime & Security Survey

Sessions Hijacking with Firesheep

Source: 2008 CSI Computer Crime & Security Survey

1) For now, Unable to attack Facebook **Have to Modify source code

2) Only support over HTTP

- Hotmail, Twitter, Facebook, Etc

3) Sniff on-the-Fly (Wifi Hotspot)

4) Over Network, Have to ARP poisoning

Sessions Hijacking

Source: 2008 CSI Computer Crime & Security Survey

Sessions Hijacking Over HTTPS

Source: 2008 CSI Computer Crime & Security Survey

1) Using SSLStrip for kill SSL sessions

2) Rouge Access point or Arp poisoning on the wire

Sessions Hijacking Over HTTPS

Mobile Threats

Source: 2008 CSI Computer Crime & Security Survey1

9

BlackBerry

Mobile Safari Still Vulnerable To Pwn2Own Exploit

Mobile Web Browsers

Common problem: bad security UX

Android Content Provider File Disclosure

Google Latitude Zero Day Attack

Google Latitude Zero Day Attack

Google Latitude Zero Day Attack - Example

https://www.google.com/accounts/ServiceLoginAuth?Username=morphuesor@gmail.com&password=xxxxxx&s=sss=&xxx=dddddd

Google Latitude Zero Day Attack on iPhone

Google Latitude Zero Day Attack

FlexiSPY BlackBerry Spy Phone

FlexiSPY Apple iPhone Spyphone

Spyphone – ดักฟังการสนทนา

31

28th – 29th June 2011, Grand Millennium Sukhumvit, Bangkok

Copyright © 2009 TISA and its respective author(Thailand Information Security Association)

Please contact : varapong@acisonline.net

http://www.TISA.or.th