Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/12/2012
01:55 AM
50%
50%

Top Mobile Vulnerabilities And Exploits Of 2012

Spoofing, banking attacks, authentication flaws, and more top the list of 2012's biggest mobile security headaches

While many security prognosticators had tried to predict previous years as the "year of mobile exploits," 2012 was one of the first that actually seemed to live up to expectations. Security researchers found new vulnerabilities, developed new proof-of-concepts, and found exploits in the wild, too. Here are some of the year's highlights.

Twitter SMS Spoofing
Security researcher Jonathan Rudenberg last week demonstrated the types of risks that can crop up from fast-access social media apps when he showed how an attacker could post messages or alter the account settings of a Twitter user as long as he knew the mobile number tied to that user's account and the user had not set a PIN number for the account. Since the PIN code is not a feature available to U.S. users, and because Rudenberg felt he'd been brushed off by the Twitter security team since he disclosed the SMS spoofing vulnerability to it in August, he decided to go public with the flaw. He'd found similar vulnerabilities in Facebook and the Venmo payment network, as well, but those sites took care of the bug.

[Which applications and vendor dominated the vulnerability and exploit headlines in 2012? See The Vulnerability 'Usual Suspects' Of 2012.]

Dirty USSD
In September, researcher Ravi Borgaonkar went public with a vulnerability he disclosed to Android-powered handset manufacturers earlier in the year that would allow hackers to remotely reset and wipe phones running versions earlier than Android 4.1.x (Jelly Bean). A potential attack would use the Android dialer functionality to execute special Unstructured Supplementary Service Data (USSD) codes that are normally used by a carrier to send commands to the phone operator network. Using an NFC attack or an attack through a malicious URL or QR code, attackers could exploit the vulnerability remotely without user permission. Initially the vulnerability was demonstrated on only Samsung phones, but researchers found they could replicate the vulnerability across all handsets running early Android versions. Numerous anti-malware companies came out with apps to protect against the flaw, but another simple workaround would also be to use a different dialer than the default provided by the operating system.

Android SSL/TLS Woes
A study published in October by a team of security researchers in Germany found that 8 percent of Android apps could be vulnerable to man-in-the-middle attacks due to poor SSL/TLS implementations. Many of the poor implementations came by way of customized SSL code that was more permissive than default Android settings. In particular, the researchers did a manual audit of 100 apps on the Google Play marketplace and found that 41 of them let researchers capture credentials for bank accounts, remote servers, email accounts, and social media accounts. It is estimated by the sample sizes that as many as 185 million users could be affected by these poor SSL practices among third-party apps.

Android NFC Vulnerabilities
Renowned Apple bug hunter Charlie Miller made one of the biggest splashes at Black Hat this summer with his presentation on the "cautionary tale" of near-field communications (NFC) vulnerabilities that could crop up as the technology gains ground in hardware over the next few years. Miller showed how vulnerabilities in Android smartphones could allow for exploitation of NFC to take over a device using another device placed within a few centimeters of the phone under attack.

Mobile Man-In-The-Middle Attacks Using Exchange
Another Black Hat presentation by researcher Peter Hannay focused on the lopsided trust model of Microsoft Exchange, which focuses mainly on authenticating a client to a server and not the other way around. Hannay developed a proof-of-concept attack that had him using Exchange to conduct man-in-the-middle attacks against poorly configured mobile clients that would give attackers the ability to access device emails, calendar entries, and phonebook entries. Even more damaging, the attacker could potentially impersonate a corporate email server and erase all of the data on the device through push commands.

Social And Sharing Authentication Flaws
Facebook, LinkedIn, and Dropbox were all found to expose users to identity theft through a flaw in the design of their authentication systems in iOS apps that had them saving authentication keys in unencrypted plain text files. These files could be transferred to other devices, allowing a criminal to access someone's account without ever having to enter log-in information. Discovered first on the Facebook app by researcher Gareth Wright this spring, further research by blogger Neil Cooper found the flaw worked on other apps, such as LinkedIn and Dropbox, and would likely translate over to other platforms, such as Android.

Zitmo
One of the most successful banking Trojans of all time, Zeus, made the jump from PCs to mobile devices through the Zeus-in-the-mobile (Zitmo) spyware application. Prevalent on Android, Zitmo masquerades as a banking activation application and eavesdrops on SMS messages in search of the mobile transaction authentication numbers (mTANs) banks send via text to their users as a second form of authentication. Initially discovered in 2010, researchers last summer saw Zitmo gaining steam in the wild throughout 2012.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
@WolfFlight
50%
50%
@WolfFlight,
User Rank: Apprentice
12/13/2012 | 10:21:24 PM
re: Top Mobile Vulnerabilities And Exploits Of 2012
How did Georgia Weidman and her research as well as the Smartphone Pentest Framework not get a mention here?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11844
PUBLISHED: 2020-05-29
There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
CVE-2020-6937
PUBLISHED: 2020-05-29
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.
CVE-2020-7648
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
CVE-2020-7650
PUBLISHED: 2020-05-29
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
CVE-2020-7654
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.