Top Mobile Vulnerabilities And Exploits Of 2012

While many security prognosticators had tried to predict previous years as the "year of mobile exploits," 2012 was one of the first that actually seemed to live up to expectations. Security researchers found new vulnerabilities, developed new proof-of-concepts, and found exploits in the wild, too. Here are some of the year's highlights.

Twitter SMS Spoofing
Security researcher Jonathan Rudenberg last week demonstrated the types of risks that can crop up from fast-access social media apps when he showed how an attacker could post messages or alter the account settings of a Twitter user as long as he knew the mobile number tied to that user's account and the user had not set a PIN number for the account. Since the PIN code is not a feature available to U.S. users, and because Rudenberg felt he'd been brushed off by the Twitter security team since he disclosed the SMS spoofing vulnerability to it in August, he decided to go public with the flaw. He'd found similar vulnerabilities in Facebook and the Venmo payment network, as well, but those sites took care of the bug.

[Which applications and vendor dominated the vulnerability and exploit headlines in 2012? See The Vulnerability 'Usual Suspects' Of 2012.]

Dirty USSD
In September, researcher Ravi Borgaonkar went public with a vulnerability he disclosed to Android-powered handset manufacturers earlier in the year that would allow hackers to remotely reset and wipe phones running versions earlier than Android 4.1.x (Jelly Bean). A potential attack would use the Android dialer functionality to execute special Unstructured Supplementary Service Data (USSD) codes that are normally used by a carrier to send commands to the phone operator network. Using an NFC attack or an attack through a malicious URL or QR code, attackers could exploit the vulnerability remotely without user permission. Initially the vulnerability was demonstrated on only Samsung phones, but researchers found they could replicate the vulnerability across all handsets running early Android versions. Numerous anti-malware companies came out with apps to protect against the flaw, but another simple workaround would also be to use a different dialer than the default provided by the operating system.

Android SSL/TLS Woes
A study published in October by a team of security researchers in Germany found that 8 percent of Android apps could be vulnerable to man-in-the-middle attacks due to poor SSL/TLS implementations. Many of the poor implementations came by way of customized SSL code that was more permissive than default Android settings. In particular, the researchers did a manual audit of 100 apps on the Google Play marketplace and found that 41 of them let researchers capture credentials for bank accounts, remote servers, email accounts, and social media accounts. It is estimated by the sample sizes that as many as 185 million users could be affected by these poor SSL practices among third-party apps.

Android NFC Vulnerabilities
Renowned Apple bug hunter Charlie Miller made one of the biggest splashes at Black Hat this summer with his presentation on the "cautionary tale" of near-field communications (NFC) vulnerabilities that could crop up as the technology gains ground in hardware over the next few years. Miller showed how vulnerabilities in Android smartphones could allow for exploitation of NFC to take over a device using another device placed within a few centimeters of the phone under attack.

Mobile Man-In-The-Middle Attacks Using Exchange
Another Black Hat presentation by researcher Peter Hannay focused on the lopsided trust model of Microsoft Exchange, which focuses mainly on authenticating a client to a server and not the other way around. Hannay developed a proof-of-concept attack that had him using Exchange to conduct man-in-the-middle attacks against poorly configured mobile clients that would give attackers the ability to access device emails, calendar entries, and phonebook entries. Even more damaging, the attacker could potentially impersonate a corporate email server and erase all of the data on the device through push commands.

Social And Sharing Authentication Flaws
Facebook, LinkedIn, and Dropbox were all found to expose users to identity theft through a flaw in the design of their authentication systems in iOS apps that had them saving authentication keys in unencrypted plain text files. These files could be transferred to other devices, allowing a criminal to access someone's account without ever having to enter log-in information. Discovered first on the Facebook app by researcher Gareth Wright this spring, further research by blogger Neil Cooper found the flaw worked on other apps, such as LinkedIn and Dropbox, and would likely translate over to other platforms, such as Android.

Zitmo
One of the most successful banking Trojans of all time, Zeus, made the jump from PCs to mobile devices through the Zeus-in-the-mobile (Zitmo) spyware application. Prevalent on Android, Zitmo masquerades as a banking activation application and eavesdrops on SMS messages in search of the mobile transaction authentication numbers (mTANs) banks send via text to their users as a second form of authentication. Initially discovered in 2010, researchers last summer saw Zitmo gaining steam in the wild throughout 2012.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.