csds 344 fial

Continued growth of connected devices, includes any device that is connected to the internet, includes "smart home" devices

- Data Protection
- Secure Enclave
- Trusted App Stores and Application Signing
- Application Level Encryption
- Certificate Pinning

- Unreliable connections- compromises
- challenge to update
- limited knowledge - developers make mistakes
- less resources -> less secure implementations of RNGs and encryption

1. Weak Guessable, or Hardcoded Passwords
2. Insecure Network Services
3. Insecure Ecosystem Interfaces

- Routers for example
- users should be required to change default password
- default password should be random for each user

- Communication over HTTP instead of HTTPS
- data is exposed over an unencrypted channel

- Configuring a router is often via a web application
- consider being able to update a device without authentication or authorization

Validation failure on update, unable to update

Includes both hardware and software

Device stores or transmit private data without proper protections to user

Lack of confidentiality in storing or transferring data

Includes provisioning, decommissioning devices

By default, they are insecure or user cannot make them secure

Users are able to take control of device with physical
access such as access a SD card

- Many devices use insecure random number generators
- this can affect secure connections where keys are generated

1. Improper Credential Usage
2. Inadequate Supply Chain Security
3. Insecure Authentication/Authorization

- Includes hardcoding credentials within the application or storing them without encryption
- Very easy to discover, you can use "strings" command on an APK
- Can also use tools like iExplorer to navigate filesystem of an application
- Utilize best practices provided by both iOS (e.g. Keychain) and Android (e.. Credential Manager)

- Includes using a library or package from a repository that might have malicious code injected into it
- Android uses Gradle and Maven to install dependencies, these are more
reliable than pulling a library from GitHub, iOS uses Swift Package Manager

- Most applications use backend services
- Using Burp Suite, we can examine these backend services
- Unless there is authentication, a service may think the call is coming from the mobile client, when it can come from a replay attack
- Other attacks can be bypassing authentication or authorization in the app itself to perform tasks that required a higher level of privilege
-- For example: Changing a config file to say you "purchased" an add-on pack

Similar to web

Similar to IoT! This is easier to fix with regular updates

Similar to IoT

This is actually attacking the application binary by
finding keys or repackaging it and distributing it

Includes provisioning, decommissioning devices

Insecure default settings, default passwords,
unprotected storage of keys or username/passwords

Using weak encryption, no salts, small keys

- Device level encryption where separate keys are used to encrypt files, separate keys are used to encrypt those keys, and so on
- A key encrypts a high level key or a set of keys using the user's passcode or biometrics

- Includes a true random number generator
- Secure boot and secure AES 256 encryption

- Applications are reviewed and signed by the app store provider
- Device checks signature before installing

Extra layer of protection, more for hiding data

Install the certificate locally in the application to prevent MITM

Can find files that were "deleted"

Used to browse and find data on a file system

Used to show browsing history of a user

Will look for credit cards, email address, GPS coordinates from image, and more from an image

Analyze logs, configuration files, etc.

- Anyone who accesses the evidence, it must be documented
- Also document what they did with the evidence, where it was stored,
- Every location and who interacted with the evidence must be documented
- If there is a point where custody cannot be determined, the evidence may be useless

- Evidence should be taken offline where it cannot be tampered with,
- Ensure only authorized investigators have access to evidence

- Document everything in your investigation → You need to have a trail
- Document steps to create an image (copy) of what you are investigating
- Document tools that you used and tests you performed
- Document anything that is suspicious, the steps you took to find it

One is the linux dd utility: sudo dd if=/dev/disk20 of=~/Desktop/clone.img

• Secure Evidence
• Chain of Custody
• Investigation

Association of Computing Machinery
- Special Interest Group Focused on Security, Audit, and Control (SIGSAC)
-- Popular conferences by SIGSAC:
- Special Interest Group on Computer and Human Interaction
-- Usability of security and privacy controls

IEEE
- IEEE Symposium on Security and Privacy
- International Symposium on Digital Forensics and Security (ISDFS)

Usenix
- Usenix Security Symposium
- Usenix SOUPS

- SANS Institute
- OpenSSF
- ISC2
- RSA
- Black Hat
- Def Con