Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/12/2012
01:55 AM
50%
50%

Top Mobile Vulnerabilities And Exploits Of 2012

Spoofing, banking attacks, authentication flaws, and more top the list of 2012's biggest mobile security headaches

While many security prognosticators had tried to predict previous years as the "year of mobile exploits," 2012 was one of the first that actually seemed to live up to expectations. Security researchers found new vulnerabilities, developed new proof-of-concepts, and found exploits in the wild, too. Here are some of the year's highlights.

Twitter SMS Spoofing
Security researcher Jonathan Rudenberg last week demonstrated the types of risks that can crop up from fast-access social media apps when he showed how an attacker could post messages or alter the account settings of a Twitter user as long as he knew the mobile number tied to that user's account and the user had not set a PIN number for the account. Since the PIN code is not a feature available to U.S. users, and because Rudenberg felt he'd been brushed off by the Twitter security team since he disclosed the SMS spoofing vulnerability to it in August, he decided to go public with the flaw. He'd found similar vulnerabilities in Facebook and the Venmo payment network, as well, but those sites took care of the bug.

[Which applications and vendor dominated the vulnerability and exploit headlines in 2012? See The Vulnerability 'Usual Suspects' Of 2012.]

Dirty USSD
In September, researcher Ravi Borgaonkar went public with a vulnerability he disclosed to Android-powered handset manufacturers earlier in the year that would allow hackers to remotely reset and wipe phones running versions earlier than Android 4.1.x (Jelly Bean). A potential attack would use the Android dialer functionality to execute special Unstructured Supplementary Service Data (USSD) codes that are normally used by a carrier to send commands to the phone operator network. Using an NFC attack or an attack through a malicious URL or QR code, attackers could exploit the vulnerability remotely without user permission. Initially the vulnerability was demonstrated on only Samsung phones, but researchers found they could replicate the vulnerability across all handsets running early Android versions. Numerous anti-malware companies came out with apps to protect against the flaw, but another simple workaround would also be to use a different dialer than the default provided by the operating system.

Android SSL/TLS Woes
A study published in October by a team of security researchers in Germany found that 8 percent of Android apps could be vulnerable to man-in-the-middle attacks due to poor SSL/TLS implementations. Many of the poor implementations came by way of customized SSL code that was more permissive than default Android settings. In particular, the researchers did a manual audit of 100 apps on the Google Play marketplace and found that 41 of them let researchers capture credentials for bank accounts, remote servers, email accounts, and social media accounts. It is estimated by the sample sizes that as many as 185 million users could be affected by these poor SSL practices among third-party apps.

Android NFC Vulnerabilities
Renowned Apple bug hunter Charlie Miller made one of the biggest splashes at Black Hat this summer with his presentation on the "cautionary tale" of near-field communications (NFC) vulnerabilities that could crop up as the technology gains ground in hardware over the next few years. Miller showed how vulnerabilities in Android smartphones could allow for exploitation of NFC to take over a device using another device placed within a few centimeters of the phone under attack.

Mobile Man-In-The-Middle Attacks Using Exchange
Another Black Hat presentation by researcher Peter Hannay focused on the lopsided trust model of Microsoft Exchange, which focuses mainly on authenticating a client to a server and not the other way around. Hannay developed a proof-of-concept attack that had him using Exchange to conduct man-in-the-middle attacks against poorly configured mobile clients that would give attackers the ability to access device emails, calendar entries, and phonebook entries. Even more damaging, the attacker could potentially impersonate a corporate email server and erase all of the data on the device through push commands.

Social And Sharing Authentication Flaws
Facebook, LinkedIn, and Dropbox were all found to expose users to identity theft through a flaw in the design of their authentication systems in iOS apps that had them saving authentication keys in unencrypted plain text files. These files could be transferred to other devices, allowing a criminal to access someone's account without ever having to enter log-in information. Discovered first on the Facebook app by researcher Gareth Wright this spring, further research by blogger Neil Cooper found the flaw worked on other apps, such as LinkedIn and Dropbox, and would likely translate over to other platforms, such as Android.

Zitmo
One of the most successful banking Trojans of all time, Zeus, made the jump from PCs to mobile devices through the Zeus-in-the-mobile (Zitmo) spyware application. Prevalent on Android, Zitmo masquerades as a banking activation application and eavesdrops on SMS messages in search of the mobile transaction authentication numbers (mTANs) banks send via text to their users as a second form of authentication. Initially discovered in 2010, researchers last summer saw Zitmo gaining steam in the wild throughout 2012.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
@WolfFlight
50%
50%
@WolfFlight,
User Rank: Apprentice
12/13/2012 | 10:21:24 PM
re: Top Mobile Vulnerabilities And Exploits Of 2012
How did Georgia Weidman and her research as well as the Smartphone Pentest Framework not get a mention here?
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17210
PUBLISHED: 2019-07-20
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
CVE-2019-12934
PUBLISHED: 2019-07-20
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
CVE-2019-9229
PUBLISHED: 2019-07-20
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
CVE-2019-12815
PUBLISHED: 2019-07-19
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
CVE-2019-13569
PUBLISHED: 2019-07-19
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.