Revision as of 06:45, 7 April 2013

Lessons in Mobile Penetration Testing by Zach Lanier

T This class is designed to provide students with an introduction to penetration testing, reverse engineering, and exploitation on modern mobile platforms. The instructor will cover the security architecture of popular mobile platforms and mobile applications, investigate their weaknesses and vulnerabilities, and give students hands-on experience in analyzing and attacking them. Through lectures and interactive labs, students will walk away armed with the foundational knowledge needed to discover, identify, and exploit vulnerabilities on mobile platforms such as Android, iOS, and Blackberry.

On day one, students will be brought up to speed with penetration testing on mobile platforms, exploring the differences and similarities between mobile and conventional pentesting. Students will be introduced to dynamic and static analysis tools and techniques for gaining the information necessary to reverse engineer, discover vulnerabilities, and plan their attacks against Android, iOS, or BlackBerry applications.

On day two, the training will dive a bit further into practical bug hunting, reverse engineering methods, and exploitation techniques, including replicating case studies from the instructors' experiences in real-world mobile application pentests. Students will also get hands-on experience through several labs including reverse engineering of the top Android security applications, exploiting native code vulnerabilities on the ARM architecture, and developing jailbreak/privilege escalation exploits from scratch and deploying them on real devices.

Requirements

• Laptop capable of running a VMware Virtual Machine

• Dual core CPU, 2GB+ of RAM recommended

• At least 12GB disk space available

• At least one free USB 2.0 port

• This training course has a strong emphasis on the Android platform, so an actual Android device is recommended, but not strictly required.

• Familiarity with protocol analyzers (e.g. Wireshark, tcpdump), man-in-the-middle techniques, and basic reverse engineering concepts (e.g. debuggers, disassemblers)

Course Outline

Day 1

1. Introduction

2. Conventional attacks / penetration testing, and why mobile is different

3. Building an Attack Methodology

4. Static Analysis Techniques

   * Tools used

   * How to identify issues for each platform and what to look for

5. Dynamic Analysis Techniques

   * Runtime issues, artifacts, etc.

   * Network issues, man-in-the-middle

6. Reverse Engineering Lab (Pt 1.)

   * Extracting "secrets" and useful data

   * Patching and rebuilding apps

Day 2

1. Application Auditing

2. Reverse Engineering Lab (Pt. 2)

   * Reversing advanced protection techniques

   * Deeper bug hunting

   * Native code threats and vulnerabilities

3. Intro to ARM Exploitation

   * Exploit mitigation across platforms

   * Real-world vulnerabilities

   * Exploiting a vulnerable mobile app

4. Jailbreak/privilege Escalation Lab

   * Platform-level vulnerabilities

   * Kernel-level vulnerabilities

   * Writing your own jailbreak

   * Post-exploitation persistence

5. Findings Review

More info : TBD

Trainer Biography

tbd

[url url]

24 & 25 September (09:00 - 17:00)

ADD REGISTRATION BUTTON

Back to Training Overview