Appsec2013 presentation

Appsec2013 presentation

• 1.
  Hacking Web FileServers for iOS Bruno Gonçalves de Oliveira Senior Security Consultant – Trustwave’s SpiderLabs
• 2.
  About Me #whoami • BrunoGonçalves de Oliveira • Senior Security Consultant @ Trustwave’s SpiderLabs • MSc Candidate • Computer Engineer • Offensive Security • Talks: Silver Bullet, THOTCON, SOURCE Boston, Black Hat DC, SOURCE Barcelona, DEF CON, Hack In The Box Malaysia, Toorcon, YSTS e H2HC. Hosted by OWASP & the NYC Chapter
• 3.
  INTRO • Smartphones – ALOT OF information – iPhone is VERY popular • Mobile Applications – (MOST) Poorly designed • Old fashion vulnerabilities Hosted by OWASP & the NYC Chapter
• 4.
  What are thoseapps? • Designed to provide a storage system to iOS devices. • Data can be transferred utilizing bluetooth, iTunes and FTP. • Easiest way: HTTP protocol. • They are very popular.
• 5.
  Examples
• 6.
  Features • Manage/Storage files •Create Albums, etc. • Share Data
• 7.
  VULNERABILITIES
• 8.
  • No encryption(SSL):
• 9.
  • No authentication(by default):
• 10.
  • (Reflected) XSS
• 11.
  • (Persistent) XSS
• 12.
  • (Persistent) XSS http://www.vulnerability-lab.com/get_content.php?id=932
• 13.
  • Vulnerability-Lab Advisories: http://www.vulnerability-lab.com/show.php?cat=mobile
• 14.
  Disclaimer • Trustwave (me)did this research on March/13 and just now we are disclosing these advisories.
• 15.
  • Path Traversal •WiFi HD Free Path Traversal (CVE-2013-3923) • FTPDrive Path Traversal (CVE-2013-3922) • Easy File Manager Path Traversal (CVE-20133921) You probably want to test the app that you use.
• 16.
  • Path Traversal(DEMO)
• 17.
  • Easy FileManager • Unauthorized Access to File System (CVE2013-3960)
• 18.
  • Unauthorized Accessto File System (CVE2013-3960)
• 19.
  • Getting worstwith a jailbroken device.
• 20.
  • Remote CommandExecution: Unauthorized Access to File System (CVE-2013-3960) – Jailbroken Device
• 21.
  • iOS 7Security Improvement
• 22.
  How to findvulnerable systems mDNS Queries <= mDNS Watch for iOS
• 23.
  • Conclusions • MobileApps (already) are the future. • Mobile Apps designers still don’t care too much about security. • Too many apps, we have to take care. • Old fashion vulnerabilities still rock.