Ask Us Almost Anything about Android Security, Privacy or Malware with beaups, Tim "diff" Strazzere, Joshua "jduck" Drake, and Jon "jcase" Sawyer

BlackPhone is easily the fastest.

Though I have to give some props to Amazon as they respond very fast to things I've chatted with them about believe they handle things relatively well.

I can't speak to many other vendors as I rarely get responses, or if I do, ever see patches make it out to devices.

They all have their weaknesses, and strengths but from the ones I watch, these three (in no particular order) seem fastest at patching vulns (talking non carrier devices).

BlackPhone Samsung Motorola

Was digging into some devices I bought off Amazon and was excited when I found a really strange one that had interesting specs. I plugged in the usb cable and was getting ready to dive head first into the device... Adb dropped directly to root without asking for device authorization... :sigh:

My case, considering no background research, probably the HP medfield devices. It kicked me into a shell with a debuggable ramdisk when I plugged it in when powered off. "adb root" and i had root.

grep -r boobz /proc -- OOPS?

I was frustrated with a factory installed app that was behaving poorly, at the time no root solution was available for my phone. I looked at every open source exploit for Android I could fine, learned smali, and read every available disclosure I could find. I also bugged Dan Rosenberg often once I met him.

As a resource, I can recommend doing the same. Look at past works, and read what you can find. I can recommend two books on the subject, that both sit on book shelf:

http://www.amazon.com/Android-Security-Internals--Depth-Architecture/dp/1593275811/ref=sr_1_1?ie=UTF8&qid=1439924705&sr=8-1&keywords=android+security

http://www.amazon.com/Android-Hackers-Handbook-Joshua-Drake/dp/111860864X/ref=sr_1_2?ie=UTF8&qid=1439924705&sr=8-2&keywords=android+security

I started by reading and dissecting exploits that were out there at the time. These were things like GingerBreak and ZergRush... Other than that, just researching and reading all the papers/presentations I could find. There are a lot of them listed here: http://droidsec.org/wiki/

Thanks for the kind words. It's a tiny bit of a sore subject, but I'm not terribly bothered by it.

Regardless of what people might think, I'm human and thus am prone to making mistakes. Also, I never once said that the patches I submitted fixed all the bugs in Android, let alone Stagefright. I've always been very open about how I believe there to be many more issues and have since been proven correct in that belief. All in all, I'm thankful that the community responded so strongly. Future versions of Android will be much more secure because of the efforts of everyone involved.

Please answer this, I've met the guy in person more than once and I still don't know the answer.

[deleted]

1. Definitely expecting increased security. It's a good thing IMHO. Especially when it comes to devices like Nexus where you can root it if you want by design.

2. I'm personally not a fan of fingerprint scanners because you simply cannot change your biometrics in the event that they get compromised. Once stolen, forever lost.

1) Maybe, but this isnt going to be the only driving factor. More and more people are doing banking, and sensitive non work functions on their mobile devices as well. Securing an OS is just plain smart, and good for consumers. We should have secure phones.

2) I love the one on my Galaxy S6 edge, I won't be using a phone without one again. The HTC fiasco is bad, but it also depends on local malware. Be responsible in what you install on your phone.

I'm really excited about the upcoming changes. I think they are really onto something with prompts that make sense in the context that they are needed. This is how permissions should have worked on Android since the beginning IMHO.

It sounds like a major inconvenience to users, and thus I see people working to bypass it. But I'll reserve final judgement until official release.

In my opinion, this depends entirely on the user's behavior. I don't personally, however I do for my kids, as they install lots of apps.

If you download outside the play store, apps from non major publishers, or are a (eww) pirate, you MAY need one.

We located my son's Nexus 4 that was lost via one, I showed up at a trailer across town to a very surprised person to retrieve the phone. Necessary? dunno depends on you. Helpful? was for me.

I would think it is. Device Manager is pretty useful when you have internet. But what if the phone has no internet connectivity? That's why I have Cerberus, with it I can get the phone's location via SMS in case it gets stolen, and in the worst of cases, erase it.

moar s-off's

I have a rack of ribs in the smoker, so probably eating ribs for me.

Android 5.x and up is particularly annoying for me to try and root, my go to tactics are often dead due to the strengthened SELinux policies. Historically, Samsung devices have been complained about by other researchers for being "hard'.

The latest devices with the latest updates are almost always harder to attack.

I ended up in stagefright because of the name. I found it when looking around in frameworks/* of AOSP. There is a ton of code there and I don't think anyone really every reviewed any of it.

The issues I found were found by a combination of fuzzing and manual code review. I didn't use any SCA tools. Actually, I've not had a lot of luck with those in the paste either. Maybe they have improved since though!

I heard a rumor that they are strongly considering moving more components into the app-store-updatedable model in the future. Time will tell. From the time that the idea of making that change to WebView to the time it was implemented was over a year. I think I first started complaining about it in ICS and it wasn't until Lollipop that it happened (so not Jellybean, nor KitKat).

I'm a big fan of being able to update more things faster!! Update speed has a huge impact on bad guys. When's the last time you saw some Chrome exploit being exploited in the wild?!

I don't think it is possible to do so for the media playback frameworks, without major push back from the OEMs. For example (as jduck pointed out to me) look at CM's implementation, these OEMs make massive and major modifications to the media playback frameworks.

Read everything you can get your hands on and experiment often! I'm a firm believer in applying what you learn to solidify your knowledge.

I love looking at heavily obfuscated things that make my brain want to melt. It's like an old school MUD game where I need to map out things and understand (hopefully) new problems I've never come across.

With that said, it is nice when you see people leave symbol and debug code inside code which lets you completely understand the code and find issues in just a few minutes...

Small, clearly defined functions.

Personally, treading the line of privacy/security while working for a defensive company is the hardest thing.

Most people tend to think security is (almost) never an issue. Whenever we discover or find something, it's genuinely a battle with press to keep them from overhyping it but still being interested in it. It's also a battle to make some things understandable to general audiences and still make it an approachable subject.

Just for an slight example - I can write a whitepaper on the most interesting malware I've ever seen and how complex it is. Though unless I have a TLDR with a tag line of "your nudes are stolen" or "phones blow up" it would likely never get traction. On the flip side, if I find one piece of malware that steals photos but it isn't widely distributed (because we got all the C&Cs taken down) we would be labeled as FUD and drumming up hype.

Media is weird and it's tough to be a sane voice when everyone around you wants hype. (This seems to ring true for all things that deal with media... security just has it real hard sometimes)

edit: doh, I spell well

Ensuring that I feel my kids are safe with their mobile devices. I give them devices from OEMs (not carrier branded) that I believe will get quick updates, I also have Lookout installed on their devices, as they do download and install a lot of crap.

What Jon said. Also, there are carriers and more in play here. There's more to the problem than just who signs the update. OEMs typically are the only ones with the source code to build binaries for devices! Then, who runs the OTA infrastructure? See what we are up against?

Google Authenticator

Reddit Is Fun

A custom password manager

Twitter

Timely

Google Voice

This is a strange question, but I'll bite. I'm primarily an offense guy so let me know if I get something wrong.

To my knowledge, most mobile security suites are very limited in what they can provide. They simply scan apps installed on the device or provide a rudimentary firewall.

Zimperium's zIPS product, to my knowledge, is completely different than the other tools out there. We use behavioral analysis and machine learning to differentiate between good and bad things going on. This allows us to do things such as detect previously unknown privilege escalation exploits without modifying our engine.

Mac Book Pro (2013?) Lots of junk in some cloud services running ubuntu server... or some similar for heavy lifting :)

1) Usually not. I didn't even use CM until it shipped on the One Plus.

2) I think most sources are trustworthy, but be careful. ROMS with backdoors pre-baked in them are not unheard of.

3) I'm really excited about http://copperhead.co/ ! There have been a few others that got me excited too, but they never released :-/ I admire Blackphone's dedication to fast patching!

That's like a bonus three questions!

Security is an issue for everyone. The sheer number of users/devices in play in the Android ecosystem brings extra risk IMHO.

I couldn't give a good number for a percentage of users that get infected.

I think rebooting into safe mode or recovery is definitely one way to remove them. However, usually it's as simple as uninstalling some app.