INFO6065 Lecture-10 Mobile Devices 322.pdf - INFO-6065...

1
Ethical Hacking
& Exploits
Mobile Devices
INFO-6065
INFO-6065 Art Mackiewicz

▪ Housekeeping notes
▪ Mobile Vulnerabilities
▪ Psexec
▪ Dumping Hashes
▪ getgui
▪ Lab 10
▪ Post Exploit activities
INFO-6065 Art Mackiewicz
2
Agenda

Mobile Devices
INFO-6065 3

INFO-6065
4
Devices & Risks
▪ When we are talking about mobile devices we
are generally thinking about Mobile Phones
and Tablets
▪ The risks affecting mobile devices fall into two
main categories
▪ Device Risks
▪ Application Risks

INFO-6065
5
Device & Application Risks
▪ Device Risks
▪ Risks that are inherent to the devices themselves
▪ Mobile devices are now basically computers with a
different form factor and thus are exposed to similar
risks found on computers
▪ Application Risks
▪ Risks which originating from third party applications
▪ There is often little the end user can do to really tell
what a third party application is doing on their device
▪ Permissions during install

Device Risks
INFO-6065 6

INFO-6065
7
Device Risks
▪ Data Storage
▪ Allow users to remove data from the organization
▪ Allow users to take pictures of sensitive areas
▪ Weak Passwords
▪ Users traditionally use weak passwords with mobile
devices
▪ If they have sensitive data on their device it is at risk
▪ Although you can centrally set password policies on
some devices it isn’t available to all mobile devices
▪ Often requires specific infrastructure components
▪ BES, Exchange, etc.

INFO-6065
8
Device Risks
▪ WiFi Hijacking
▪ Taking advantage of free wireless to steal personal
information
▪ Attacks are performed on open hotspots
▪ Open Hotspots
▪ If a user is connected to the corporate network
and allowing people to connect to their mobile
device
▪ Similar to the unauthorized APs