BH Mobile Security Summit
June 16-18, 2015
ExCeL London | London, UK
Black Hat USA
August 1-6, 2015
Mandalay Bay | Las Vegas, NV
Black Hat Europe
November 10-13, 2015
Amsterdam RAI | The Netherlands
5/13/2014
01:00 PM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Black Hat USA 2014: Mobile PenTesting

The computers we carry in our pockets are as powerful as desktop PCs of only a few years ago, and we trust them with more and more critical information. But mobile devices have a plethora of their own security issues that threaten to disrupt this pocket-based computing utopia, which is where mobile penetration testing comes in.

AppSec Labs will be offering two different courses, covering the two major mobile operating systems. Over two days, both Android Application Hacking - PenTesting Mobile Apps and iOS Application Hacking - PenTesting Mobile Apps will get you up to speed on penetration testing of apps for each platform in question. Both cover broad topics like traffic analysis and manipulation, insecure data storage, hacking application packages, and analyzing runtime analysis -- but the hows, if not the whys, will vary based on your OS of interest. (If you just can't choose, the Android course is running twice, so you could take both!)

The OWASP Mobile Security Project aims to help developers create secure mobile applications, with a focus on, not just end-user apps, but the server-side infrastructure apps communicate with, as well as cloud platform-specific features. Now the project's leads are spinning their mobile security expertise into a two-day pentesting Training called Advanced Mobile Penetration Testing with OWASP MobiSec. If you're down for some intense, lab-driven learning about techniques, tools, and methodologies for testing iOS, Android, and web-based applications, then there’s a seat for you in this training.

Ready to register? Early-bird rates are available until June 2. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3157
Published: 2015-07-02
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVE-2015-3443
Published: 2015-07-02
Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.

CVE-2015-4228
Published: 2015-07-02
Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages, aka Bug ID CSCur13999.

CVE-2015-4233
Published: 2015-07-02
SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu54037.

CVE-2015-4238
Published: 2015-07-02
The SNMP implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4(7) and 8.6(1.2) allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests during a time of high network traffic, aka Bug ID CSCul02601.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report