by RSS Alexandre Aumoine  |  Mar 18, 2011  |  Filed in: Security Research

Last week we attended Insomni'Hack 2011, where our Crypto Girl (Axelle Apvrille) presented on mobile phone threats. Debriefing of the conference may be found here and there. Both blog authors highlighted the main goal of Axelle's talk, which was to raise awareness about existing threats on smartphones.

Mobile phones had already been targeted for a long time (by application sending sms for instance) but since recently (approximately one year) it has been hit by more advanced attacks - probably with the help of cybercriminal organizations.

Their goal is to earn money quickly and for this purpose, they develop a botnet-like infrastructure much like in the PC world, the goal being to dispose of an army of zombie phones. The examples of this trend are Android/Geinimi and Android/DroidDream with their standard features:

  • Trojan

  • C&C

  • Silent install

  • ...

With such botnets at disposal, cybercriminals can potentially sell 'underground' services like sms spam, silent application install (pay-per-install), 'click jacking', Black SEO and other 'non ethical' lucrative business. Of course Extra charges will end up on the infected user's monthly bill :( .

On my side I designed and implemented a challenge for the competition. It is based on Symbian OS and the main goal is to practice some 'static reversing' on the sample.

This will allow you to extract a secret sentence. At this time (waiting confirmation from SCRT.CH), it seems that nobody has solved the challenge during the event (6PM to 1AM).

From my point of view I think this is due to several factors:

  1. It is difficult to understand the SIS file format or ARM instructions without some help (internet not available during the challenge to the staff's great displeasure)

  2. No specific tools was provided like a sis file explorer or extractor (my fault)

  3. I am a 'n00b' of challenge writing, so probably I used to much stages/steps for the time that the challengers had

  4. Already more than 30 challenges available

Everything will be (un)confirmed by the feedback of competitors (don't hesitate to post 'useful' comments on it).

Some solutions of challenges from Junod itself and other competitors (severals challenges here, the GPGPU reverse and the reverse 2)

-- the Reverse naM

by RSS Alexandre Aumoine  |  Mar 18, 2011  |  Filed in: Security Research