Pwning Androids, iPhones with Exchange

Powered by SC Magazine
 

Wipe phones, steal data and cause mayhem with ActiveSync.

View larger image View larger image View larger image

See all pictures here »

An attacker can steal your contacts, snoop on your email and erase all data from your iPhone or Android using Microsoft Exchange, a Perth university lecturer has revealed.

Peter Hannay discovered that by pushing policy to phones he could wipe the devices clean and likely steal data and sniff outgoing emails.

“There is nothing technically difficult to this – it's really easy and really lame, and that's a problem,” the Edith Cowan researcher told delegates at the Kiwicon security conference. 

Kiwicon 6 coverage

“We can set a minimum length for device passwords, demand as the server that a 65,500-long character password be set … and set the screen lock to a one second timeout and give one password attempt.”

“And we pushed a WiFi [ban] out to a WiFi-only iPad.”

In a proof-of-concept demonstration also shown at Defcon, Hannay used a WiFi Pineapple with DNS spoofing plus a fake certificate to which victim phones would connect.

Victim iPhones would flag a connection warning of which “nine out of 10 CEOs will click through” before the devices would be wiped.

“The problem is that we are giving users ... the ability to turn off security measures and they have been trained for years to bypass these sorts of errors,” Hannay said.

Microsoft's Windows Phone was not vulnerable to the attack.

Hannay along with a crew of Edith Cowan university students were further developing the research to include a protocol library to emulate the ActiveSync Protocol. 

“We may be able to get the phones to sync address books, contacts and so on. We could … push a new outgoing mail server to devices so that from now on whenever you send an email, it comes through us.”

He said the attack would gather a lot of victims in public areas such as airports.

Hannay also said when analysing a recent iteration of Android, he discovered Google Apps for business could also push policies following fallible reverse DNS checks.

Copyright © SC Magazine, Australia


 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Optus expands 4G coverage
Oct 10, 2014
If you rely on an Optus phone for work you might be interested to know that there are now 200 ...
Microsoft Office is now free for some charities
Oct 10, 2014
Microsoft has announced that eligible Australian non-profit organisations and charities can now ...
Vodafone lights up 4G in Adelaide
Oct 9, 2014
Live and work in Adelaide? Vodafone has switched on its 4G network in the city and suburbs.
Next year tradies will be able to take payments using ingogo
Oct 3, 2014
Ingogo is going to provide a card payment service for Xero users.
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 335

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  57%
 
No
  43%
TOTAL VOTES: 139

Vote