D2T2-Ajin-Abraham-Hacking-Tizen-The-OS-of-Everything

More documents

Recommendations

Info

PENTESTING METHDOLOGIESWhiteboxAccess to Source andKnowledge about theapplicationBlackboxNo access to Sourceand no idea about theapplicationFurther Classification● Static Analysis● Dynamic Analysis● Network Analysis
STATIC ANALYSIS• Certificate Signature Analysis – Developer and Distributor• Manifest Analysis – manifest.xml/config.xml* Unwanted Privileges.* CSP is proper or not.* Smack Labels and Rules• Decompile Native App* Apps Compiled with CLANG/CLANG++ compiler.* LLVM decompiler - tizen_tpk_decompiler.py (make use <strong>of</strong> Retdec API).• Code Review* Weak Encryption, Crypto, Plaintext Information, SSL Overriding, InsecureFile Storage, Client Side SQLi/XSS.* Pretty much OWASP Mobile Top 10.• Couple <strong>of</strong> tools - https://github.com/ajinabraham/tizen-security
Page 1 and 2: HACKING TIZENTHE OS OF EVERYTHINGAJ
Page 3 and 4: DISCLAIMER• All Images, Logos and
Page 5: TIZEN : The OS of EverythingIoT (In
Page 8 and 9: Source: h$p://' mesofindia.india'
Page 10 and 11: Source: h*p://www./zenexperts.com/
Page 12 and 13: THE FAMILY
Page 14 and 15: TIZEN ARCHITECTURETizen Web App
Page 16 and 17: TIZEN APPLICATION STRUCTURE
Page 18 and 19: NATIVE APPS (.TPK).tpk Install Loca
Page 20 and 21: HYBRID APP(.TPK)
Page 22 and 23: SMACKSIMPLIFIED MANDATORY ACCESS CO
Page 24 and 25: SMACK TERMS- Subject à Any Running
Page 26 and 27: WEB APPS - CONFIG.XML
Page 28: QUICK COMPARISON• Apps identified
Page 31 and 32: OVER PRIVILEGED ANDROID APP VS TIZE
Page 33 and 34: LIKE ANY LINUX DISTRO : SHELLS
Page 35 and 36: eDEMO
Page 41: eDEMO
Page 47 and 48: NETWORK ANALYSIS• Installing SSL
Page 49 and 50: MOBILE SECURITY FRAMEWORK○ Automa
Page 51 and 52: CONCLUSION• Security Model/Archit
Page 53: QUESTIONS?Ajin Abraham@ajinabrahamh

D2T2-Ajin-Abraham-Hacking-Tizen-The-OS-of-Everything

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?