Devices - Penetration Testing Like a Hacker. - SecNiche Security Labs

than they’re worth. First you have to find a phone totarget which is usually on a person, hope they haveit on and then hope it’s vulnerable to somethingyou’re prepared before. It’s pretty difficult to craft anattack in just a few seconds as the target is walkingby. I digress, the real gold is in the managementinfrastructure of these devices (where it exists)because most likely it contains all the information inthe phone anyway. It’s also probably a much easierand more practical target.I’m also not going to focus on any one managementinfrastructure as I would like to keep it generic enoughto apply to as many as possible. As I looked at thesevarious management tools most of them seemed tohave a few things in common. First, they’re almostall web based with a database backend, does thatsound new, exciting or cutting edge? I hope not. That’sright though, most of these cutting edge, high endmanagement infrastructures are simple web apps.Do we need to break out our compilers and startcomposing custom attacks yet? Probably not. Let’slook at a few ways to approach the problem, withoutdoing anything crazy.Attacking the FrontNow that we have determined most of these arebasically web apps let’s look at where we can hit thisinfrastructure the hardest, the management interface.If you have either been a penetration tester or a webapplication developer, I’ve been fortunate (I think) tohave been both, then you know a dirty not-so-secretsecret. Developers, administrators and IT managementdo not take management interfaces terribly seriously. Ifit’s an inside the firewall test you are nearly guaranteedto find a few open admin interfaces typically with defaultcredentials. Of course I’m certain this won’t happenwith anything as important as a mobile managementinfrastructure but just in case let’s continue our attackon the front.Theoretically every web application that interfaceswith a database has a SQL Injection (SQLi)vulnerability of some sort. Bold statement? Not really,just based on years of experience, I’ve met very fewwith no exploitable vulnerability. Fast forwardingthough let’s say our management infrastructure hasa SQLi vulnerability and we can insert records, let’slook at all we can do with that. First and foremostwe can probably enroll our own phone and figure outwhat the management infrastructure does to a phone.Second we will be able to push our own maliciouscode to the entire enterprise. From a penetrationtesting perspective it’s not going to get much betterthan that. Fortunately I’m sure all of these variousinfrastructures have undergone many rounds ofsecurity testing and hence it just won’t be this easy.Moving on.Attacking the MiddleA few things I noticed while taking my tour of thevarious management suites (aside from how cute alltheir names are) is that almost without exception theyall included some sort of enterprise app store thoughthey gave them various names. Thispiqued my interest for several reasonsoutside of just attack vectors thoughhaving an app store front-end presentsus with the same vulnerabilities asthe management system’s admininterface. This one is interestingfrom a purely logistical perspectivebecause I’m curious who is doingquality control on the apps gettingpushed out. Can anyone submit anapp? Most of the vendor website’sweren’t very clear on this matter andI was on a tight deadline. At any rate,the workflow in these systems wouldbe very interesting to analyze. Like itor not (I don’t particularly) but Apple’spolicy of app review before app storesubmission probably catches mostmalware. More companies should takenote for their enterprise mobile appsand adopt a similar policy I think.05/2011 (5) SeptemberPage 27http://pentestmag.com