Risk
12/12/2012
01:55 AM
50%
50%

Top Mobile Vulnerabilities And Exploits Of 2012

Spoofing, banking attacks, authentication flaws, and more top the list of 2012's biggest mobile security headaches

While many security prognosticators had tried to predict previous years as the "year of mobile exploits," 2012 was one of the first that actually seemed to live up to expectations. Security researchers found new vulnerabilities, developed new proof-of-concepts, and found exploits in the wild, too. Here are some of the year's highlights.

Twitter SMS Spoofing
Security researcher Jonathan Rudenberg last week demonstrated the types of risks that can crop up from fast-access social media apps when he showed how an attacker could post messages or alter the account settings of a Twitter user as long as he knew the mobile number tied to that user's account and the user had not set a PIN number for the account. Since the PIN code is not a feature available to U.S. users, and because Rudenberg felt he'd been brushed off by the Twitter security team since he disclosed the SMS spoofing vulnerability to it in August, he decided to go public with the flaw. He'd found similar vulnerabilities in Facebook and the Venmo payment network, as well, but those sites took care of the bug.

[Which applications and vendor dominated the vulnerability and exploit headlines in 2012? See The Vulnerability 'Usual Suspects' Of 2012.]

Dirty USSD
In September, researcher Ravi Borgaonkar went public with a vulnerability he disclosed to Android-powered handset manufacturers earlier in the year that would allow hackers to remotely reset and wipe phones running versions earlier than Android 4.1.x (Jelly Bean). A potential attack would use the Android dialer functionality to execute special Unstructured Supplementary Service Data (USSD) codes that are normally used by a carrier to send commands to the phone operator network. Using an NFC attack or an attack through a malicious URL or QR code, attackers could exploit the vulnerability remotely without user permission. Initially the vulnerability was demonstrated on only Samsung phones, but researchers found they could replicate the vulnerability across all handsets running early Android versions. Numerous anti-malware companies came out with apps to protect against the flaw, but another simple workaround would also be to use a different dialer than the default provided by the operating system.

Android SSL/TLS Woes
A study published in October by a team of security researchers in Germany found that 8 percent of Android apps could be vulnerable to man-in-the-middle attacks due to poor SSL/TLS implementations. Many of the poor implementations came by way of customized SSL code that was more permissive than default Android settings. In particular, the researchers did a manual audit of 100 apps on the Google Play marketplace and found that 41 of them let researchers capture credentials for bank accounts, remote servers, email accounts, and social media accounts. It is estimated by the sample sizes that as many as 185 million users could be affected by these poor SSL practices among third-party apps.

Android NFC Vulnerabilities
Renowned Apple bug hunter Charlie Miller made one of the biggest splashes at Black Hat this summer with his presentation on the "cautionary tale" of near-field communications (NFC) vulnerabilities that could crop up as the technology gains ground in hardware over the next few years. Miller showed how vulnerabilities in Android smartphones could allow for exploitation of NFC to take over a device using another device placed within a few centimeters of the phone under attack.

Mobile Man-In-The-Middle Attacks Using Exchange
Another Black Hat presentation by researcher Peter Hannay focused on the lopsided trust model of Microsoft Exchange, which focuses mainly on authenticating a client to a server and not the other way around. Hannay developed a proof-of-concept attack that had him using Exchange to conduct man-in-the-middle attacks against poorly configured mobile clients that would give attackers the ability to access device emails, calendar entries, and phonebook entries. Even more damaging, the attacker could potentially impersonate a corporate email server and erase all of the data on the device through push commands.

Social And Sharing Authentication Flaws
Facebook, LinkedIn, and Dropbox were all found to expose users to identity theft through a flaw in the design of their authentication systems in iOS apps that had them saving authentication keys in unencrypted plain text files. These files could be transferred to other devices, allowing a criminal to access someone's account without ever having to enter log-in information. Discovered first on the Facebook app by researcher Gareth Wright this spring, further research by blogger Neil Cooper found the flaw worked on other apps, such as LinkedIn and Dropbox, and would likely translate over to other platforms, such as Android.

Zitmo
One of the most successful banking Trojans of all time, Zeus, made the jump from PCs to mobile devices through the Zeus-in-the-mobile (Zitmo) spyware application. Prevalent on Android, Zitmo masquerades as a banking activation application and eavesdrops on SMS messages in search of the mobile transaction authentication numbers (mTANs) banks send via text to their users as a second form of authentication. Initially discovered in 2010, researchers last summer saw Zitmo gaining steam in the wild throughout 2012.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
@WolfFlight
50%
50%
@WolfFlight,
User Rank: Apprentice
12/13/2012 | 10:21:24 PM
re: Top Mobile Vulnerabilities And Exploits Of 2012
How did Georgia Weidman and her research as well as the Smartphone Pentest Framework not get a mention here?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?