A Day in the Life of your Mobile Phone (or: How Your Phone Hates You)

#ISC2CongressStrengthening Cybersecurity Defenders

A Day in the Life of Your Mobile Phone

Rob Barnes, CISSP®, CSSLP®

Software Security ArchitectThe College Board

#YourPhoneHatesYou

(or: how your phone hates you)

3 #ISC2Congress

Reality:

Your phone hates you.

How we like to think our phones protect our

privacy:

4 #ISC2Congress

Things you do every day

» Check email» Check weather» Check stocks» Use social media» Take photos» Post photos» Buy coffee» Sync device with phone

» Join Wi-Fi access points» Send email» Navigate with map» Research restaurants» Place hands-free calls» Browse websites» (Plus all the things your

kids do that you don’t know about)

5 #ISC2Congress

Things your phone does every day

Collects location information(Divulges location information.)

Collects personal information(Divulges personal information.)

Collects usage information(Divulges usage information.)

6 #ISC2Congress

Does it matter?

97% of mobile applications access personal address books, social media pages and

connectivity options like Bluetooth or Wi-Fi.

86% of mobile applications are insecure.

But it doesn’t matter. 100% of what you do reveals something about you.

http://www8.hp.com/us/en/hp-news/press-release.html?id=1528865#.VA2ntvlr6Cc

http://threatpost.com/insecure-applications-we-are-84-percent-120711/75961

7 #ISC2Congress

Don’t think like an attacker.

Think like:

a marketer.

a parent.

a forensic investigator.

8 #ISC2Congress

Location Privacy: Using the device

9 #ISC2Congress

Location Privacy: Browsing

This is where I spent my summer, as told by a web service:

10 #ISC2Congress

Browser version

Firmware version = iOS 6.1.4

Belongs to Verizon FiOS in Chantilly, VA

Device make and model (OLD!)

Location and Device Privacy

108.28.101.205

08/Sep/2014:14:18:45 -0400

Mozilla/5.0 (iPhone; CPU iPhone OS 6_1_4 like Mac OS X)

Version/6.0 Mobile/10B350 Safari/8536.25

(a two-for-one bonus!)

When you (or an app) access a web page or web service, it sends the following information:

11 #ISC2Congress

Location Privacy: Using apps

Are you sure you’re just checking the weather? As a bonus to you, Weather Channel shares your usage statistics!

» http://or1.sc.omtrdc.net/b/ss/twciiphonescroll/0 . . .» Resolution=640x1136» AppID=iPhone 6.2.1 (420573)» TimeSinceLaunch=58» DeviceName=iPhone6,1» action=weather:data-refresh-requested» OSVersion=iOS 7.1.2» CarrierName=Verizon» actionTracking=weatherdatarefreshrequested» ts=1408722639

(which translates to 8/22/2014 11:50:39 AM)

XYZ XYZ

12 #ISC2Congress

Location Privacy: Using apps

Sure enough, you agreed to all of this.

13 #ISC2Congress

When you’re at home

When you’re at workWhen you’re driving

Why should you care?

“Big Data” marketing can infer:

14 #ISC2Congress

…and when you’re not

When you’re at home

Why should you care?

An attacker can infer:

15 #ISC2Congress

Device Privacy: Using Wi-Fi

Hi! Can I please join your network? My MAC address is DC:9B:9C:xx:xx:xx!

Sure! (Ah…so you’re an Apple device…)

Thanks! Oh, also, my name is “Rob Barnes’s iPhone 5”!

OK, thanks. Welcome! (Welcome, indeed, “Rob Barnes”!)

16 #ISC2Congress

It’s 209.48.123.456.

Device Privacy: Using Wi-Fi

Hey, it’s “Rob Barnes’s iPhone 5” again. Sorry to bother you. What is the IP address for email.mycompany.com?

17 #ISC2Congress

Why should you care?

Dear Rob Barnes:

Congratulations! Your iPhone 5 is eligible for a free upgrade! Please click here for details, or visit your local Atlanta Apple retail store.

This message was sent to [email protected]. Click here to unsubscribe from future emails.

Sincerely,The Apple Customer Loyalty Team

18 #ISC2Congress

Device Privacy: Using Wi-Fi

belkin.d36

belkin.d36.guests

HoundNet_Guest

xfinitywifi

DUKE

LCPS-OPEN

Residence_GUEST

Marriott_Guest

Kimpton

Marriott_CONFERENCE

Dunn_Bros_337!

Carlton

My stored Wi-Fi networks(com.apple.wifi.plist)

19 #ISC2Congress

belkin.d36

belkin.d36.guests

HoundNet_Guest

xfinitywifi

DUKE

LCPS-OPEN

Residence_GUEST

Marriott_Guest

Kimpton

Marriott_CONFERENCE

Dunn_Bros_337!

Carlton

Device Privacy: Using Wi-Fi

Marriott_Guest

<key>lastAutoJoined</key><date>2014-07-13T06:33:08</date><key>SSID_STR</key><string>Marriott_Guest</string><key>Strength</key><real>0.9104790687561035</real><key>CAPABILITIES</key><key>NOISE</key><integer>91</integer><key>isWPA</key><integer>0</integer><key>CaptiveNetwork</key><boolean>true</boolean><key>lastJoined</key><date>2014-07-12T16:22:16</date>

20 #ISC2Congress

Device Privacy: MACEver get the feeling that you’re being watched?

http://qz.com/112873/this-recycling-bin-is-following-you/

This recycling bin is tracking you.

21 #ISC2Congress

Device Privacy: MAC

http://www.moxieretail.com/storage/heat_map2.jpg

Ever get the feeling that you’re being watched?

Your supermarket is tracking you.

22 #ISC2Congress

Why should you care?

Loyalty Card Yo

u

23 #ISC2Congress

A picture is worth1,000 words…

http://sophosnews.files.wordpress.com/2012/12/mcafee-exif.jpg?w=640

24 #ISC2Congress

…and some EXIF data as well…Exif Image Size 470 × 353Make AppleCamera Model Name

iPhone 4

Orientation Horizontal (normal)Date/Time Original

2012:12:03 12:26:00

Create Date 2012:12:03 12:26:00Flash Off, Did not fireGPS Latitude Ref NorthGPS Latitude 15.658167 degreesGPS Longitude Ref WestGPS Longitude 88.992167 degreesGPS Altitude Ref Above Sea LevelGPS Altitude 7.152159468 mResolution 72 pixels/inch

25 #ISC2Congress

…and some geolocation, too.

26 #ISC2Congress

Usage Privacy: Using email

iOS mail header:

X-Mailer: iPhone Mail (10B350)[10B350 = iOS 6.1.4]

Android mail header:

X-Mailer: YahooMailAndroidMobile/3.1.3

27 #ISC2Congress

Usage Privacy: Using Bluetooth

http://cnet3.cbsistatic.com/hub/i/r/2013/08/22/2cbcf893-6de6-11e3-913e-14feb5ca9861/resize/620x/e604bfe06973383ec0c3ca6323c35487/142B6607.jpg

28 #ISC2Congress

How to Protect Yourself

» Location Services• Turn it off• Use it selectively

» Browsing• Use Onion browser (or other Tor equivalent)• Maintain awareness

» Wi-Fi• Do not connect to untrusted networks

– (But if you do, assume everything you do is monitored)– (Also, tell your device to “forget” the network when you’re

done.)

29 #ISC2Congress

How to Protect Yourself

» EXIF Data• iOS

– TrashExif– Metadata Cut

• Android:– EXIF Stripper– Photo Editor

30 #ISC2Congress

How to Protect Yourself

» MAC Tracking• iOS

– Upgrade to iOS 8

• Android– Pry-Fi (requires rooting the device)

» Bluetooth• Delete any data from synced devices

– This becomes increasingly applicable with iOS 8’s HealthKit

31 #ISC2Congress

The End.

Rob Barnes

[email protected]

ww.linkedin.com/in/robertdbarnes

#YourPhoneHatesYou