ceh_15_hacking_mobile_platforms

hacking mobile platforms

• mobile devices has changed access to information dramatically
  • anyon with these devices can access information from any time or location
  • can edit documents on the go
  • send messages
  • share file
  • mobile is slowing replacing desktop and laptop
  • access email, internet
  • stores password, calendar
  • transactions
  • BYOD
    • unpatched mobile devices at work

1. Creating binary payloads using Kali linux to hack android

• comapny security might be strong
  • attacker can hack employees mobile devices connected to company network
• android gets network IP
• kali --> metasploit
  • create android payload
  • set the options like target ip --> exploit
  • install payload to android
  • time for footprinting and enumeration
    • collect information about the target machine
    • traverse the directory structure
    • create new folders
    • upload files from kali to android
    • access sdcard in android
    • download files from android into kali

2. harvesting users' credentials using social engineering toolkit

• social engineering applies to mobile devices just like any other devices
  • better than any toolkits available
  • attach malicious files in email or attached files
  • malicious links
• Social Engineering Toolkit (SET) is standard for social engineering pen testing
  • python tool
  • designed specifically to perform advanced attacks against human element
• kali --> socialEngineeringToolkit
  • list of social engineering attacks presented
  • website attack vector --> credential harvesting attack
  • clone site
  • when android device logs into clone website --> creadential sent to attacker

3. using mobile platform to enforce a DoS attack on victim machine

• LOIC performs Denial of service attack or DDoS by flodding TCP or UDP packets
• install LOIC in android
  • set target machine --> fire
• DoS or DDoS attack using mobile device

4. securing android device from malicious applications

• scan mobile device for any unsecure settings

  • advice accordingly
  • privacy advisor --> 3 categories
    • apps that may cost you
    • harm privacy
    • apps that access internet
  • Spam protection
    • call and SMS filter
  • app protection
    • lock apps

• Sophos Mobile Security

  • scans all apps during installation
  • anti-virus
  • protects device from attack via USSD
  • remote lock
  • wipe personal info

• install Sophos app in android

  • malware scanner --> remove threats found
  • security advisor --> disable app install from unknown sources