Mobile Device Exploitation Cookbook

Prashant Verma, Akshay Dixit

• Publisher: Packt Publishing
• Year: 2016
• ISBN:
  9781783558728
• Edition: 1
• Topic: Computer Science
• Subtopic: Programming Mobile Devices
• Index: Computer Science

Over 40 recipes to master mobile device penetration testing with open source tools

About This Book

• Learn application exploitation for popular mobile platforms
• Improve the current security level for mobile platforms and applications
• Discover tricks of the trade with the help of code snippets and screenshots

Who This Book Is For

This book is intended for mobile security enthusiasts and penetration testers who wish to secure mobile devices to prevent attacks and discover vulnerabilities to protect devices.

What You Will Learn

• Install and configure Android SDK and ADB
• Analyze Android Permission Model using ADB and bypass Android Lock Screen Protection
• Set up the iOS Development Environment - Xcode and iOS Simulator
• Create a Simple Android app and iOS app and run it in Emulator and Simulator respectively
• Set up the Android and iOS Pentesting Environment
• Explore mobile malware, reverse engineering, and code your own malware
• Audit Android and iOS apps using static and dynamic analysis
• Examine iOS App Data storage and Keychain security vulnerabilities
• Set up the Wireless Pentesting Lab for Mobile Devices
• Configure traffic interception with Android and intercept Traffic using Burp Suite and Wireshark
• Attack mobile applications by playing around with traffic and SSL certificates
• Set up the Blackberry and Windows Phone Development Environment and Simulator
• Setting up the Blackberry and Windows Phone Pentesting Environment
• Steal data from Blackberry and Windows phones applications

In Detail

Mobile attacks are on the rise. We are adapting ourselves to new and improved smartphones, gadgets, and their accessories, and with this network of smart things, come bigger risks. Threat exposure increases and the possibility of data losses increase. Exploitations of mobile devices are significant sources of such attacks.

Mobile devices come with different platforms, such as Android and iOS. Each platform has its own feature-set, programming language, and a different set of tools. This means that each platform has different exploitation tricks, different malware, and requires a unique approach in regards to forensics or penetration testing. Device exploitation is a broad subject which is widely discussed, equally explored by both Whitehats and Blackhats.

This cookbook recipes take you through a wide variety of exploitation techniques across popular mobile platforms. The journey starts with an introduction to basic exploits on mobile platforms and reverse engineering for Android and iOS platforms. Setup and use Android and iOS SDKs and the Pentesting environment. Understand more about basic malware attacks and learn how the malware are coded. Further, perform security testing of Android and iOS applications and audit mobile applications via static and dynamic analysis.

Moving further, you'll get introduced to mobile device forensics. Attack mobile application traffic and overcome SSL, before moving on to penetration testing and exploitation.

The book concludes with the basics of platforms and exploit tricks on BlackBerry and Windows Phone. By the end of the book, you will be able to use variety of exploitation techniques across popular mobile platforms with stress on Android and iOS.

Style and approach

This is a hands-on recipe guide that walks you through different aspects of mobile device exploitation and securing your mobile devices against vulnerabilities. Recipes are packed with useful code snippets and screenshots.

Mobile Device Exploitation Cookbook

---

Mobile Device Exploitation Cookbook

Copyright © 2016 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: June 2016

Production reference: 1270616

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham

B3 2PB, UK.

ISBN 978-1-78355-872-8

www.packtpub.com

Credits

Authors Prashant Verma Akshay Dixit	Copy Editor Safis Editing
Reviewer Gregory John Casamento	Project Coordinator Sanchita Mandal
Commissioning Editor James Jones	Proofreader Safis Editing
Acquisition Editor Tushar Gupta	Indexer Mariammal Chettiyar
Content Development Editor Shali Deeraj	Graphics Disha Haria
Technical Editor Anushree Arun Tendulkar	Production Coordinator Nilesh Mohite

About the Authors

Prashant Verma, Certified Information Systems Security Professional (CISSP) is a Sr. Practice Manager—Security Testing at Paladion Networks. Information security has been his interest and research area for the past 10 years. He has been involved with mobile security since 2008. One of his career achievements has been to establish mobile security as a service at Paladion Networks.

He loves to share his knowledge, research, and experience via training, workshops, and guest lectures. He has spoken at premier global security conferences such as OWASP Asia Pacific 2012 in Sydney and RSA Conference Asia Pacific and Japan 2014 in Singapore. He has shared his knowledge via webinars and trainings.

He is primary security consultant for leading financial institutions.

His banking security experience was translated into his co-authored book Security Testing Handbook for Banking Applications, IT Governance Publishing. He has written articles for Hacki9 and Palizine Magazine.

Beyond mobile platforms, he holds expertise in various other areas of InfoSec, such as Security Testing, Security Management and Consulting. He has occasionally, analyzed security incidents and cybercrimes. He has conducted assessments for organizations globally at multiple locations. He is a subject matter expert and his work has earned him a distinguished position with his customers.

He can be contacted at [email protected]. His Twitter handle is @prashantverma21. He occasionally writes on his personal blog at www.prashantverma21.blogspot.in.

I would like to thank my parents, my wife, my sister, and my colleagues and friends for supporting and encouraging me for this book.

Akshay Dixit is an information security specialist, consultant, speaker, researcher, and entrepreneur. He has been providing consulting services in information security to various government and business establishments, specializing in mobile and web security. Akshay is an active researcher in the field of mobile security. He has developed various commercial and in-house tools and utilities for the security assessment of mobile devices and applications. His current research involves artificial intelligence and mobile device exploitation. He has been invited to several international conferences to give training, talks and workshops. He has written articles for various blogs and magazines on topics such as mobile security, social engineering, and web exploitation.

Akshay co-founded and currently holds the position of Chief Technology Officer at Anzen Technologies, an information security consulting firm specializing in providing end-to-end security services.

Anzen Technologies (http://www.anzentech.com) is a one-stop solution for industry-leading services, solutions and products in the cyber security, IT governance, risk management, and compliance space. Anzen's vision is to instill end-to-end security in organizations, aligned to their business requirements, in order to ensure their lasting success.

I would like to thank my Baba, a scholar, an inspiration, and one of the best storytellers I've met. I thank my parents, my brother, my sister, all the people who think well of and for me, and my wife Parul, a dreamer and a friend.

About the Reviewer

Gregory John Casamento is a software engineer with more than 25 years of experience. He is the maintainer of the GNUstep project. He helped to develop Winamp for the Mac as well as many other highly visible projects.

Open Logic Corporation (is his company). He has worked for AMGEN, AOL, Raytheon, Hughes Aircraft, and many others.

www.PacktPub.com

eBooks, discount offers, and more

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at [email protected] for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.

https://www2.packtpub.com/books/subscription/packtlib

Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books.

Why subscribe?

• Fully searchable across every book published by Packt
• Copy and paste, print, and bookmark content
• On demand and accessible via a web browser

2323__perlego__chapter_divi...

Table of contents

• Mobile Device Exploitation Cookbook