How to industry sign banking new york document mobile
a lot of used today so let's do that and that should do it and okay and fine I think I'll just go here for the moment so you have enough time for a few news things here and there are a lot of good ones this one is very interesting it relevant to this plan yeah yeah yeah very relevant stuff that's a bunch I saw just today that's not working out so well that's actually any other class what's that well apparently so apparently that is real I thought maybe it was a fake website the Taiwan bikini liner but apparently this is really true he did a lot of selfies like this and she managed to follow up I I saw something I saw stuff over here it seems so insane hardly fake maybe think this was a fake website like the onion but I think this is real and so I know I've heard a few of these apparently in China especially they have one sees people that do selfies of them posing on the edge of a cliff and shove a little have died the edge of a building stuff like that it's apparently the the new medium over the already here it's like making bleach or something but is it guilty kill you filthy and kill kill alright well I know um a few years ago I heard about a Japanese customer people kill themselves from overwork and there's a special word for this kind of suicide and it hit the news because about five years ago the government passed a special law that someone who kills himself from overwork is the traitor and their whatever their widows will not get any survivor benefit because it betrayed their company which shows that they got a work ethic over there well you know they got it they got like the Protestants think they have work ethic well the Japanese have worked at anyway um work is important in any dry case that brought was a guy that had worked from the one year without a single day off and eighteen hours a day with like six hours a day of mandatory overtime and he finally just killed himself and they said that rotten bum he sorta done that a mess so there's this website you can put it in your you can finish browser extension and it will tell you if the new site you're looking at it's considered reputable which I thought was pretty interesting it likes this one it gave clocks are pretty good rating um because you know I must say I haven't had to do that to I quit watching Bloomberg because they just make up lies but Fox News is not always wrong I mean I I didn't like him much because they're slant but if you look at their ratings on this thing they don't score that badly there's a few things they're not as as transparent as they should good enough I must say they um I try to hate them but they're not always wrong like Trump I mean what's that right right I mean they they seem they're trying to take him seriously I don't trust Bloomberg far more I mean Bloomberg made up this whole thing about people putting hardware in network devices and never retracted it even though they have no basis for it at all but anyway they scored pretty well too anyway it's kind of interesting um this is some attempt to try to do something about all the fake news this one is particularly relevant to the students and by the way let me remember to mute all these folks and remind me but the chat message if I forget and you're irritated by each other's barking dogs and stuff because that tends to happen anyway so OSC be several of my students are trying to get this this is the response respected certification that penetration testers get and yet apparently I've heard this statement or several my students took the exam the machines you're attacking a really old it's obvious that they have not updated the testing years the point of this test and why it was so respected is it's not a multiple-choice test you have to really happen to smudge machines and then you have to write an explanation of how you got in so you have to really pen test machines but they're really old and this person says cyber sick that there all kinds of underground forums where people just post the solutions because they haven't updated the stuff in years so this person is going to post the solutions available to everybody and to shame them end up dating the machines and the osep people immediately respond by saying this person is a bomb and should be locked up and should be silenced they say well that kind of is my point but they have to do is update their stuff anyway we'll see what comes of all this right now people are screaming and yelling at each other about it but it is interesting this certainly happened to all of your certification exams like Cisco and Microsoft you can totally just buy the answers online and so a bunch of people have the credential and don't know anything and that water's down the value of the credential in general employers know that if somebody has credentials you don't really want to trust that unless you also see like classes or experience to back it up if all I have is credentials and nothing else they could very well have just cheated on the exam and that's what a lot of these boot camps do anyway umm so this guy stole ten million dollars worth of IOT and I just thought I'd mention it because this is something I've heard a lot you go to an online website and he generates your secret t4 and their online websites will generate passwords for you I say who would use that and wait the end this doesn t be lighting up making me think I'll make a phone it's not right it's using the internal microphone how rude for just a moment aha the cables oops that's odd no it's good all right sites for remote viewers anyway so if anybody if you go to any kind of website that generates a password for you don't do it are you nuts because he just on the server you just logged a password generated for you made it come one for you one for me huh huh huh you you shouldn't be using an internet site to generate a secret anyways so this one is pretty good oh this is a new kind of malware affecting Arabic speakers and it uses it has several good techniques interesting techniques it um is PowerShell based and it can do a variety of backdoors some are custom DNS tunnels and some going through Google on the shared files and before doing anything else it checks to see if it's running in a virtual machine or sandbox by doing wmii queries and running processes like say it's very easy to tell if you're in a virtual machine you're off and running something like VMware tools the name of the network card is something like VMware simulated network card it's actually pretty easy and there are even some add-ons you can put to try to disguise your virtual machine to make it less obvious that it's a virtual machine but in fact this is increasingly common that malware does check before running to see if it's in a virtual machine and not display its behavior than to thwart dynamic analysis which is easy and powerful but I mean I'm teaching the malware analysis class we talked about this dynamic analysis is sloppy easy and powerful but it would be pretty easy to avoid and when the bad guys wise up it's gonna be a lot less useful and we're getting there the bad guys are wising up to how easy that makes it process and this is Bruce Schneier who have you haven't read your stuff he's very good go see his talks are very good news blog is very good as books are very good he's one of the famous security guys like Dan Kaminsky who is not only an expert but also very good at communicating so you do not need to be advanced to understand his talks and here's to talk about the evolution of darknets which is very interesting you know the Silk Road was on the darknet where we could only get there with the tor browser and then the FBI took it down and all those customers were just sort of lost disassociated from merchants you like brought up another one and took it down another one and took it down and he's talking about how people are figuring this out if you put up an illegal marketplace it will be taken down and then you'll lose access to your customers and so they're trying to develop new techniques that will survive the takedown and what they're saying is instead of having direct purchase through cryptocurrency they're switching to other techniques like moving a messaging contacts through messaging programs to increase their customers and then they're using dead drops to deliver the goods instead of trying to ship it through the post office or something you just leave it in a public location and then you tell them to go get it and you could even put it there before you sell it just tell customers where it is this is the way spies have been doing it for decades yeah yeah and they're just talking about what I used to make it so that the actual motion of the money and the motion of the illegal product are concealed and kept away from anything is easy for anyone to track you moving into more and more sophisticated ways of doing it so it's interesting to watch and in that same spirit there's just one more I want to mention which is a range somewhere ransomware was the number one attack last year now it's way down to 4% it's gone from like 45% of all companies infected with ransomware down to 4% the new hotness is crypto miners crypto miners infect your browser and meinem a cryptocurrency so it's running using up a lot of CPU and you clean it off it stops and the bad guys already gotten some money whereas the ransomware of course you have to pop up a message try to get you to pay it maybe you won't pay it and anyway the number two is mobile malware almost all Android malware so that gets us back to this class and we'll shown here now we're on the official clock here um I should mention for starters that the project that was the zero day that I gave you last week has already been patched that was project not so if you did this last week you could do it with the version in the Google Play Store but you can no longer do it they I thought by the time it hit the major press these guys were finally humiliated in the patchiness so you can download the old version here several versions more than a year old that's been probable for years I just went and got some old version from one of the site still archives old versions of Android apps of which there are a ton but anyway then you can watch the old version and see that he exposes all your pictures um I say this is something to be aware of in this class instead of using fake vulnerable apps I'm using real company apps and therefore they keep patching as they get humiliated enough sometimes by this class is why they patch them because they're tired of being used as homework anyway um but a lot of machine lists enough to just leave their junk broken for years and years and I can give them for homework for years and years at DEFCON and everywhere and they just seem utterly and vulnerable to the humiliation so that's convenient for me anyway all right so let's some go through the first chapter here which is here okay all right and there's the game and make it big okay so mobile OS there used to be a variety of mobile operating systems and there isn't anymore there's nothing but Android and iOS and all has changed just this week Microsoft officially announced they're giving up their throwing in their marbles and going home no more Windows Mobile they're just they struggle to struggle then they can't get anywhere they never got up to like 1% of the market because their product was just never worth much compared to these it wasn't as it wasn't a lot better or a lot cheaper and that's what you have to do when you walk into a field with somebody else already owns but anyway that's what happened they gave up other people were around like blackberry and Palm Pilot long ago but not anymore Android more popular than iOS but it's almost 50/50 now it's like 55 45 Android iOS so the issue is if you have a mobile device which normally would call a phone because it's usually a phone but it could be a tablet or something else so here's your attack surface these are all the vulnerable ways to attack it one obvious one is through the Wi-Fi when you connect to shared Wi-Fi in a coffee house which most of these things do automatically without even telling you then of course anybody can intercept that communication or inject communication because you're often using unencrypted into your channels so that's obviously some risk there then we can just steal the phone entire this is a special risk that applies a lot less to these desktop machines which is where a lot of people develop their security model back a decade or two ago when the main computing was these desktop machines and you could just lock the door and have a reasonable confidence that nobody's going to physically take the device that is emphatically no longer true if a couple years ago SFO there was this article said the San Francisco Airport looted has 50,000 lost laptops e gear and what they do is they just pile them on a pallet and they action them off they don't attempt to clean them or analyze them anything they're all full of hard drives full of everybody's data one of them's mine I lost my laptop on an airplane like almost anybody and you know it's some that this is a tissue they're gonna just steal the whole device and then what then you're going to wish you had really encrypted that whole device with something there the key was not stored in a label on the device or somewhere foolish that's the only way you're gonna know that did it wasn't so on mine works my only secret is the grade book and it's encrypted with a password that's why I didn't really care I just got another laptop and kept going anyway malicious apps on the phone a huge especially you have an Android device there's very few malicious apps for iOS but there's a ton of malware for Android and it's kind of in the Google Play Store and there was a study that came out this week also showing that most of the or some large portion of the VPNs in the Google Play Store are malicious where their malicious or poorly designed there was a study a couple years ago showing like 80% of all VPNs don't work they don't actually encrypt all the traffic in particular most of them fail to encrypt the DNS resolution so they do encrypt some of the traffic but not all the traffic and you might say that is of some benefit but it certainly is not what the customers expected or what they reasonably ought to expect anyway then you've got all these other things near field communication the short-range cell radio used for things like google pay which supposed to which is RFID Bluetooth the camera the microphone SMS all these things are data flying into the device and let's see I have a chat message let me see if I figure out how to get to it all right the sound is getting loud and then soft okay what he goes on alright hopefully it's getting better this was at 6:10 then I found a prominent microphone let me know if it's still bad but I switch to my better microphone so hopefully you'll have better sound I know that's the weak spot of my amateur recordings here so here is what the textbook authors found 92% of apps have lack of binary protection I certainly verified that independently I'll show you the research I did over the last several years almost every app is trivially available to let you read the source code and modifies it is possible to prevent that but almost nobody box I don't know why um then a lot of them leak sensitive data by putting it in the log or similar Foolish have hard-coded passwords permitting injection from other apps on the phone send the data over the network in an insecure way such as plain text or it broke an HTTP or storage foolishly on the device I must say I I think I thought about sixty percent of the retail apps I tested stored secrets in securely on the device it is amazing and it is abundantly clear that the app developers have no idea about security they don't have any idea doing anything wrong and apparently no one in the management because they need the companies that hire these app developers has any clue that anything is wrong either apparently there is no security audit anywhere by anyone even remotely competent my impression is although I do not have any direct inside knowledge that all they do is look at the app to see if it looks pretty and test it to see if it works as intended for nor
al customers and then they pay the bill and call it a success and they do not have anything for they test it for security because this stuff is blindingly obvious and we'll be finding it anyway so the the primary problem here is developers don't even know anything about security so they do what they think is a good job they do what they would have learned in a clash and got an 84 they make a beautiful app that's fast and and lets the legitimate users log in and do things and then they call their job done they don't realize they're doing anything wrong it is of course very difficult for them to be up with security because security as you can see is big many classes and books full of it and they here's another one that's becoming more and more of a problem is supply chain threat if you use a language like PHP or Python you're actually using libraries written by many other people and a lot of those are really old and you don't even know it so there was another news article today about one of the major PHP code repositories got compromised weeks ago and nobody noticed and it was serving up modified malicious versions of the custom libraries that everybody's using and you're often using many layers of custom libraries so library you install is actually using something else using something else so you're using stuff written by somebody ten years ago in some foreign country abandoned that's been sitting somewhere on some server that somebody compromised long ago and put malware on and you'll never know that's why you know it's a if that's the dark that's the dark side of open-source your open source stuff is just layers of stuff from God knows who from who knows how old thrown together well even if you write a custom app you typically use libraries and the libraries are these inherited from the past and unfortunately since some people get tired and quit then often the libraries get compromised nobody knows and one thing I've read the news in the last month or so is if you write a popular library for a popular browser extension criminals will contact you and offer to pay you to buy it from you so they can put malware so that's uh that's another trap model yeah yeah we'll well we'll talk we'll get there but I mean the server-side vulnerabilities are the web app vulnerabilities that's the most important phone ability or detection most people is not actually on the phone or in the app it's the server being configured incorrectly and that means all the data you send up can be stolen from the server so we that's where most of the actual data gets stolen on servers this is why one thing a lot of custom 5 students tell me is I don't use online banking so I'm safe I say well that might prevent some attacks but in fact the most likely thing is they'll hack into the bank and steal the whole list and then the fact that you're not using online banking will not save you so that's the issue the the servers are repositories of a lot of data and they're they really should be protected a thousand times more strongly than an individual app and they are not so they said breach have to breach after breach of huge databases on the web and that's really a service beyond our control it's not it's not yeah and that's that and you could say as I refer I suppose one could argue they shouldn't call that a mobile phone ability but that is it is a threat that affects you when you use mobile devices yeah yes even if you just went into the bank and wrote on a piece of paper to make an account they then type it into a computer and it gets stolen off that computer so you know yeah exactly the only thing the only thing not using online banking does is mean they can't steal it off your phone or off the Wi-Fi network near you but that is not the most common way they steal it anyway because they steal them one by one that way that's for punks the pros hack into the server and steal the whole thing so you know it's like it's like sticking people up in an alley and taking what's in their wallet as opposed to robbing a bank the second is much more profitable and the defense's unfortunately are not comparable the reason why they don't rob banks because banks have security guards and faults and everything and the online servers don't really they're not very secure at all many of them so here we are this is the OWASP mobile top 1000 Oscar is an open source group almost every company belongs to it it's very popular our students staff the OWASP booth at RSA a few years ago and everybody they should you know members but everybody that came by was already remember they all loved our WASC there they all volunteer their time to it Microsoft and Google and everybody has representative as an OAuth and they meet and decide why don't they do many things they write code libraries you can download and use to improve your security they write gullible things you can do to practice and they publish these top-ten lists which are highly valued so here's the top 10 mobile risks the first one is arguably not even right is on the server not on the phone the fact that the server's misconfigured is probably the main risk your data actually therefore there's nothing you can do on your phone to protect you but this is probably the biggest risk to the data and then there's these other ones which we'll go through notice m10 is the one I mentioned before lack of binary protections that is exposing the source code of an app so it can be modified and it is the most common it is considered the least severe because in itself it doesn't typically expose data but it does mean that you can make a counterfeit for a modified app and it will run and it does mean that whatever techniques they were hoping to keep secret are not kept secret very well because I could read the source code so it is a risk and it's very common but it's considered a relatively low risk so number one is top server track controls it's so important we got a whole class just in this and this class exists because the NCC group people said they wanted us to teach this class they said this is what people really need to protect Web Apps and they um and they're hiring a lot of students that finish this I think three of our students are working there now and they say when you try for the job they make you take a CTF well kind of like this because this is where it's at you learn how to use Burke there's written by the book is written by the guy that made Burke and we're going through that you learn how to tests for many many flaws on web servers and almost all web services have a bunch of these flaws and you need people are good at finding them or you get capped and me people get hacked at companies she's filled millions of records and they find that very embarrassing so they tend to actually do something about it so um then we get to the actual claws that are on the phone insecure data storage where you store the data on the phone private data in some place where it's easy to steal you don't transmit it well you use plaintext transmission or you use invalid HTTPS certificates or other flaws and then there's leakage where you let the data leave your app and you're supposedly protected directory and leaked off somewhere else through sloppy coding like putting it in the log the log is available to every app on the phone so it's not a safe place to put data some apps put data on the SD card which is also available to every app on the phone because you're supposed to be putting things like photographs on the SD cards you can move them to another device it's not a place you should be to be passwords or secrets because it's not in the control of the app and then there's failure and authorization and authentication this is true especially if Internet of Things devices um they do not really keep track of who you are properly this is a very common flaw also home routers a lot of small devices don't actually bother to maintain a session state properly and have you log in first record who you are and then every time you try to do something compare your permissions to see if you're authorized to do that instead they do something sleazy like have an administration page in a folder with a non-obvious name and just have a link to it you only see after you've logged in so if that's one they call insecure direct object access anybody couldn't back to use the administrative control but they hope you won't find it unless you log in first this is not really protecting it it's just hiding it like a key under the match they're hoping you won't look under there and that's one of the many types of failures you have here where you do not actually check to make sure you know who people are all the time and make sure that they're authorized to do what they're doing all the time then broken cryptography tons of this people actually implement cryptography but they do it stupidly so it doesn't really protect you correctly executed cryptography is your most powerful security control the math is very well developed if you actually use something like a es RSA correctly nobody is getting in there Snowden what it says to leaked NSA secrets and you to leak him using PGP encryption because he knew that the NSA can't even get any TP encryption if you use it correctly but it's almost impossible to use correctly people don't and the apps do stupid things so many of them use AES use it foolishly and it doesn't protect you at all we'll do that in the projects and then client-side injection this is the one we can get into this semester that I have not been able to do in previous semesters because I've got closure that's why I got this book this book is written by the author of drove your new textbook Dozier is an Android on penetration testing platform and the purpose of it is you install an agent on the phone and now that app is under your control and you can use that app to attack the other apps on the phone which is what malware authors do they your installed malware then the malware tries to steal the data from the other apps I wasn't able to do that before but now with drozer we can do that and we're checking for flaws like this client-side injection these attempt to put malicious activities in the signals from one app to another on the phone and vulnerable apps are susceptible to that then there's inter process communication a similar issue different processes and on the phone can talk to each other and security decisions via untrusted input is common because this is related to the linux server flaws of our login in fact once you've logged into one server you can often connect to another and trust you it thinks it knows who you are so you might trust some signal that comes from another app as sufficient evidence that this person is authorized to do something but it might be that that other app should not be trusted to the extent they're trusting it then session handling is another issue you have to somehow keep track of who people are this is typically done with something like an authorization cookie but if you let people steal the authorization cookie it doesn't work and we'll see this a lot in web apps and also on the phone and we've already talked about lack of binary protections that's what I had last time or you can just see the source code and modify it to make a counterfeit Trojans version of the app so a loss makes these vulnerable frameworks I'm asked to secure iOS apps go droid and so on deliberately insecure apps for practice and various other ones for practice these are the ones I've used occasionally so far I'm not using them in this class although we will use one for the inter-process communication with the new attack tool because I haven't yet found real apps that are vulnerable to attack from other apps after I get good at it I'm planning to go through and test many companies you will probably find a bunch of real apps with that vulnerability but when I get to tell you that this semester we'll have to do it like secret because I do have to give them 30 days to ignore me before I make them homework but I would be surprised if we make it to the end of the semester and do not find several real apps that are vulnerable to these new attacks I just didn't know enough to test him a few years ago when I started at this so but I did do this stuff and so I checked the banks insurance companies and stockbrokers and medical apps and retailers these the ones I've tested in previous years and talked about at Def Con such and many of them would led to these projects so I tried all the top 10 banks most of them are very vulnerable chase wasn't they after a driver chase actually fixed it but they're all vulnerable to code modification that's the main one here some of them are also using insecure data transmission none of them are so bad is to actually use plaintext transmission but some of them did send data with broken HTTP where you could use a forged certificate and it would accept it that is very calm it's in my experience that's about 15% of Android apps allow that and maybe 5% of iOS apps stock broking apps were fantastically bad similar and TD Ameritrade was the very worst that actually put your password in the log in addition to doing other things and they took them about two years but they finally fixed it and when I tried to use them this semester for homework as I have done for years in the past they actually finally passed their apps so when you try to run the old version it'll not let you run the old version so they eventually get tired of being humiliated about two years two years of being the bad example and all my product classes eventually they get fed up with it and they wise up too but the NFL figured out five years ago that you can't win it you turn on an app the server can ask your app okay what's your signature wait you're not the official app I like I'm not going to do anything I'm gonna pop a message saying you must update your app your app is out of date talking to you until you fix it that would fix this m10 vulnerability why do you accept a counter for that why don't you ask and only talk to an app that really is correctly signed by your company this doesn't seem like it's asking too much but none of these people bother the NFL bothers them anyway and all they're doing is selling t-shirts but they got humiliated because they were doing everything wrong and I see here to be sure to publish the NFL app is sending plaintext passwords and everything so then they apparently hired a competent security engineer to audit their app and they made it much more secure than any of these apps the insurance companies are also vulnerable and off you go I gave Geico a small improvement here because they actually have a way to report a vulnerability almost none of these people have anybody to tell them you have an insecurity um although I know from private communication from people in secret that they did in fact hear my reports but they wouldn't talk to me at all so I have no way to know they heard my reports Geico had a vulnerability page but they didn't patch the vulnerability and then there's the retail apps Home Depot these are once targeted versatile encryption that we doing these in the projects on these people store your password in the app directory with AES and then they hide the key on the phone or you could just totally find it and so what was the point of that this is I don't know why they bother encrypting at all when they don't let it apparently some the developers figured out that just not using encryption at all is bad so we'll just pretend to use encryption or apparently they don't understand what real encryption is and none of their so here is do either so they just sort of do something that makes it look like they've encrypted it and that passes this is a security theater that's what Bruce Snyder talks about it when you pretend to make things occur for example the TSA the tsa primarily checks to make sure they know who you are when you get on a plane and his Bruce Schneier explains in his book I don't care who you are all I care about is do you have a bomb knowing who you are is not benefiting anybody and comparing you to some list of who shouldn't be getting on the plane there's also complete garbage because that list is just names it's not even the right people that are all secur
ty theater it's just an expensive government bill on the airline industry he's pretending to secure you when in fact it's not stopping the threat but it making it look like you've done something and that's mainly where that's they throw in some encryption so it looks like they encrypted the stuff that they don't actually encrypt it which is a shame because it's not hard to actually use encryption cracker and if you do it'll actually stop attacks but that's not what they do so I like some hooch about that stuff Ringo's up all right and should be I guess this will do right there okay I should be able to track the music and I think I fixed my settings my cahoots were always having the first one be right and I know you'd be really disappointed if that continued I think I got that fix last night you'll notice the first ones right every time tonight I didn't guess I'll wait another few seconds okay so people coming [Music] alright looks like that okay alright what's the most popular ass okay Android I niosh had never been number one I think any always been Android but the gap is narrow we're down to a two horse race these days what's the most common vulnerability so that's it like a binary protections so what's the largest security problem most important all right it's the service the service or the big problem all right and if that puts passwords in the syslog which phone would Olaf call it that's it it's not data storage you don't stored it in the log and then get it back that'll be a database or something it's leakage it's putting data in some a place for you shouldn't be putting it all right come you record the winners and looks like all these are fake names so people will have to tell me who they are if they want your pink okay good all right and lo welding is your last thing good okay good good this looks like a fake name but it ain't good all right inkay is Kate oh good okay good Karla okay good good then I have real names life is good so um that's enough of the chapter and let me just say a few words about the project I don't know it's we talked I think about last time I saw people doing the plain text log in here and that's fine we'll get burp and look it broken SSL pretty soon I think we'll do that next time I just want to say a little bit about the drozer app that I talked about that's project 10 we're not there yet but we'll get there but let me just talk about how this goes we're gonna use Kali so what I'm actually doing you can do it a variety of ways I'm actually using a VirtualBox genymotion machine and a VMware calling machine and get them talking to each other now you could put it on VirtualBox and that'd be alright you could actually have two physical computers there are many ways to do it but the modern version of VirtualBox actually lets you choose different um different ways to network so let me bring this up so I can demonstrate this somewhat confusing technique so as you know you start your genymotion and you launch your phone you've been you've done this in the first and second project now here I'm going to get this message and you'll get this message after you do this project because I have connected my phone to VMware it won't start without VMware right so it's complaining however notice it says to find the problem start it from VirtualBox this is an important fact to note if you launch your phone from genymotion you are using VirtualBox but you can't see VirtualBox and not all the VirtualBox features are available so this is my Google pixel 3 would not start from genymotion if you want to find out what's really going on with the Google pixel 3 you have to start VirtualBox and down here it is the Google pixel 3 and now you can adjust settings and Android net I mean VirtualBox networking is very confusing students have been suffering the red vs. blue projects and other ones if you go to network the way genymotion works you have an host-only adapter and that one always has this address which I guess isn't showing here but it's always a one night ooo and 6856 101 I think and that is the one that controls the phone through genymotion you can't change this adapter or genymotion will quit working so the way to connect it to another network is to enable a second adapter and you can send this adapter to various places um alright and I thought I had it going to the VMware adapter but it's looking kind of funny here anyway I'm not gonna worry about it right now let me start my VMware let's see if I got it set up here's my VMware and once VMware has started I should be able to start that phone from genymotion and the phone now has two adapters one going to the controller for genymotion and one going to the VMware network alright so here's my phone and all right now by the way you can sweep up from the bottom supposedly to start your phone in fact I have no luck doing that at all I made it work like once and after that it just doesn't work I use this button down here it gets you to start your phone then I can log in with my secure password not that secure it's one two three four okay and now if you look at the network settings I put settings here which I recommend because you need to adjust it all the time for what we're doing in this class and here settings other they are okay network boy looks like one of my apps like a sports app is freaking out oh no battery left I am charging it wait look at this Wow totally freaking out he's launching copy after copy of a sports app which I loaded neat looks like my phone is pretty much crashed on me yeah there it goes thanks so much oh hey good alright anyway I'm the this by the way is pretty common especially now my earlier version if you use a really old version like Android 4.4 it seemed to work pretty well the latest version seems to crash a lot but anyway I can usually keep it up long enough to get my job done you do have reboot now and then no all right and that was some app this SS I think that's the sports app I loaded a sports have to test it called team scored something anyway so let's see if it's going to stay up long enough for me to get the IP address out of here which is what I was going for networking internet Wi-Fi and Android Wi-Fi here and now if you go to advanced it will show you I've got one 47 144 219 197 so it is in fact bridge to the city college network which is not the way you set it up for droser there you set it to the virtual network for your your colleague machine but you can control it from VirtualBox here and the thing I wanted to show you is if you go into VirtualBox and go to the second network adapter leave the first you can actually point to almost anything here you can go out the bridge the wireless network you can go through the USB Ethernet and you can go to either the VM that network for NAT or for a post on one app so Android so VirtualBox is now smart enough to talk to a VMware virtual network so the two can talk to each other this did not use to be true anyway um that's an issue when you try to set these devices but for this project what I did was connect colleague used ro on color and color you can used most of our classes so now you connect it and you install an agent on the phone with ADB you push the agent from Kali onto the phone and install it and now on your phone you'll have this droser agents as an app and the drozer agent is the phone app that is going to be remote controlled by Kali and so you start a server here turn it on and now it's a server controlled by Kali and now you can use the drozer agents to send signals to other apps on the phone which is just what bad guys would do by tricking you to installing something nasty like a fake VPN client or something then they can try to use that client to steal data from the other apps on the phone and that's what drozer simulates and supposedly a ton of apps are vulnerable to this and I'll let you know when I find real ones right now I'm just doing the sample ones they give us with a known vulnerability and we'll do those but as soon as I get good and fast at this I'll try doing many many apps and see how many of the top ten banks insurance companies stock brokers and retailers and everything are vulnerable and I would expect a lot of them are because they haven't even tested the simple stuff I taught in previous semesters like ssl connections so I highly doubt they're testing for any of this but this is a drozer it launches this page and gives you a page sort of like Metasploit or you can now try attacks on your phone and you can now launch various forms of attacks here and we're going to do a series of attacks that attack vulnerable applications from another app on the phone which is pretty cool and will get us to the next level of Android security testing anyway I think that's enough you should all have um you should all have an account and be taking quizzes so make an account on this server here and you should be hitting quizzes before each class and starting in and when you do your homework the scores will end up there most of the homework here comes in two screenshots and is created by hand by my grader but some of them are actually automatically graded if you look at 128 projects yeah the ones with asterisks will automatically go into the canvas so if you have not made a canvas account you won't be able record your score that happened to a couple students it's on my other class they jump to the projects and didn't take any quizzes first anyway so let me know if you have any troubles I'm just gonna clean up and go up to the lab I'll help anybody who wants to work tonight uh all right I'm gonna stop the share and if anybody needs an ADD code let me know I've got them okay let me stop this and bring up the end code
