Bad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions

Black Hat USA 2016

Presented by: Vincent Tan
Date: Thursday August 04, 2016
Time: 14:30 - 15:20
Location: Mandalay Bay EF

The global market for Bring Your Own Device (BYOD) and enterprise mobility is expected to quadruple in size over the next four years, hitting $284 billion by 2019. BYOD software is used by some of the largest organizations and governments around the world. Barclays, Walmart, AT&T;, Vodafone, United States Department of Homeland Security, United States Army, Australian Department of Environment and numerous other organizations, big and small, all over the world. Enterprise Mobile Security (EMS) is a component of BYOD solutions that promises data, device and communications security for enterprises. Amongst others, it aims to solve Data Loss, Network Privacy and jailbreaking/rooting of devices.

Using the Good Technology EMS suite as an example, my talk will show that EMS solutions are largely ineffective and in some cases can even expose an organization to unexpected risks. I will show attacks against EMS protected apps on jailbroken and non-jailbroken devices, putting to rest the rebuttal that CxOs and solution vendors often give penetration testers, "We do not support jailbroken devices." I will also introduce a groundbreaking tool, Swizzler, to help penetration testers confronted with apps wrapped into EMS protections. The tool conveniently automates a large amount of attacks that allows pen-testers to bypass each of the protections that Good and similar solutions implement. In a live demonstration of Swizzler I will show how to disable tampering detection mechanisms and application locks, intercept & decrypt encrypted data, and route "secure" HTTP requests through BURP into established Good VPN tunnels to attack servers on an organization's internal network. Swizzler will be released to the world along with my talk at Blackhat USA. Whether you are a CxO, administrator or user, you can't afford not to understand the risks associated with BYOD.

Vincent Tan

Vincent Tan has over 4 years of experience in information security, whoseexpertise spans almost the entire enterprise technology eco-system. Hisexpertise and experience includes software engineering, vulnerabilityresearch, penetration testing, source code auditing, reverse engineering andnetwork analysis as well as many other areas within the information securityindustry. This broad and deep capability gives Vincent a unique insight intothe complexities of enterprise eco-systems and how they can be undermined. Hehas spent the past year focused on understanding, analyzing and attackingmobile applications across different platforms and operating systems. His workwith hostile and complex mobile applications has given him the necessaryknowledge and understanding on how to securely develop mobile application andalso measures that mobile security solution provided need to take in order toproperly secure mobile devices.


KhanFu - Mobile schedules for INFOSEC conferences.
Mobile interface | Alternate Formats