1. A Comprehensive Guide to Mobile Targeted Attacks (and What Can You Do About It) Ohad Bobrov, CTO ohadl@lacoon.com twitter.com/LacoonSecurity

2. The collapse of the perimeter Why mobile devices are targeted Mobile Remote Access Trojans (mRATs) Demo Infection vectors Detection, remediation, and building a secure BYOD / HYOD architecture Agenda

3. Protecting organizations from mobile threats HQ SF, USA. R&D Israel Cutting edge mobile security research team Protecting tier-1 financial, manufacturing, legal and defense organizations About Lacoon Mobile Security

4. The Collapse Of The Corporate Perimeter > 2011

5. TARGETED MOBILE THREATS

6. Why To Hack Mobile Device? Eavesdropping Extracting contact lists, call &text logs Tracking location Infiltrating internal LANs Snooping on corporate emails and application data

7. The Mobile Threatscape Business Impact Complexity Consumer- oriented. Mass. Financially motivated, e.g.: Premium SMS Fraudulent charges Botnets Targeted: Personal Organization Cyber espionage Mobile Malware Apps mRATs / Spyphones

8. The Mobile Threatscape mRATs / Spyphones High End: Government / Military grade Mid Range:Cybercrime toolkits Low End:Commercial surveillance toolkits

9. HIGH END: GOV / MIL mRATs Low End High End

10. FinSpy – Mobile Extracted from: http://wikileaks.org/spyfiles/docs/gamma/291_remote-monitoring-and-infection-solutions-finspy-mobile.html

11. MID: CYBERCRIME TOOLKITS Low End High End

12. Recent High-Profiled Examples

13. LOWER END: COMMERCIAL SURVEILLANCE TOOLKITS

14. Commercial Mobile Surveillance Tool (Spyphone)

15. Commercial Mobile Surveillance Tools: A Comparison

16. Varying Costs, Similar Results CapabilityFlexiSpyAndroRATFinFisher Real-time listening on to phone calls+++ Surround recording+++ Location tracking (GPS)+++ Retrieval of text+++ Retrieval of emails+++ Invisible to the user+++ SMS C&C fallback+++ Infection vectorPhysicalRepackageExploit? Cost$279Free€287,000 Activation screen+--

17. STATISTICS

18. Data sample 1 GB traffic sample of spyphone targeted traffic, collected over a 2-day period. Collected from a channel serving ~650K subscribers Traffic constrained to communications to selected malicious IP address Communications Traffic included both encrypted and non-encrypted content Survey: Cellular Network 2M Subscribers Sampling: 650K

19. Infection rates: June 2013: 1 / 1000 devices

20. Survey: Cellular Network 2M Subscribers Sampling: 650K

21. DEMO

22. INFECTION VECTORS

23. Infection Vectors - Android

24. Infection Vectors – iOS (iPhones and iPads)

25. Current Security Status

26. Current Solutions – FAIL to Protect

27. Mitigation: Current Controls Mobile Device Management (MDM) Multi-Persona Wrapper Active Sync NAC

28. Mitigation: Current Controls Mobile Device Management (MDM) Multi-Persona Wrapper Active Sync NAC

29. Detection: Adding Behavior-based Risk Malware Analysis Threat Intelligence Vulnerability Research

30. Detection: Adding Behavior-based Risk Malware Analysis Threat Intelligence Vulnerability Research Application Behavioral Analysis Device Behavioral Analysis Vulnerability Assessment

31. Detection: Adding Behavior-based Risk Malware Analysis Threat Intelligence Vulnerability Research Application Behavioral Analysis Device Behavioral Analysis Vulnerability Assessment

32. Lacoon Solution

33. Thank You. Ohad Bobrov, CTO Lacoon Security Inc. ohad@lacoon.com twitter.com/LacoonSecurity