Black Hat Europe
November 10-13, 2015
Amsterdam RAI | The Netherlands
BH Executive Summit
December 8-10, 2015
Omni Montelucia | Scottsdale, AZ
Black Hat Asia
March 29 - April 1, 2016
Marina Bay Sands | Singapore
01:00 PM
Black Hat Staff
Black Hat Staff
Event Updates

Black Hat USA 2014: Pockets, Exploited

Back when smartphones and mobile apps were new and novel, people showed off the latest tricks their devices could perform, leading to the cliche "There's an app for that." Today's trio of Black Hat Briefing trio highlights explore the latest mobile-device attack research, leading us to think a far more relevant catchphrase would be "There's an exploit for that."

Smartphones took the concept of carrier control to a whole new level, but service providers' influence over these devices goes even deeper than most would imagine. In Cellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol, Mathew Solnik and Marc Blanchou walk you through their extensive reverse engineering of baseband- and application-space code and over-the-air protocols. Their proof of concept shows how the flaws they've uncovered can pose real threats to end users, not the least of which is OTA code execution over all major cellular networks and operating systems.

Mobile Point-of-Sale (mPOS) systems allow small businesses and drug dealers to accept credit card payments using a smartphone. You won't be surprised to hear that mobile security experts Nils and Jon Butler have discovered a series of mPOS vulnerabilities that give them code execution through a variety of vectors. Come to their Briefing, Mission mPOSsible, to hear all about the weaknesses of current mPOS solutions and see live attack demos, including a malicious credit card that drops a remote root shell on the unsuspecting system.

Despite Google Play's relative lack of malware, aggressive ad libs leak a lot of user privacy information, which allows for some very targeted attacks. Sidewinder Targeted Attack Against Android in the Golden Age of Ad Libs delves into one such practical case in point, which uses ad libs to intercept location information, opening the door to targeting specific areas (say, a CEO's office). The attacker can invoke common Android services to take photos, read the clipboard, call numbers, and more, opening the door to yet more attacks. Google knows, but the fragmented nature of the Android ecosystem means millions of users remain vulnerable to such "Sidewinder" attacks.

Sound fun? Good. We think so, too. Regular registration ends July 26. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio