Speaker 1: Welcome to the deep dive. We cut through the noise
Speaker 1: to bring you well the stuff that matters, the insights,
Speaker 1: the twists, surprising facts. Today we're digging into something that's
Speaker 1: probably in your pocket right now, mobile security. I mean,
Speaker 1: think about it, our phones, our tablets, they're not just
Speaker 1: for calls anymore, are they. They're basically tiny vaults holding
Speaker 1: so much personal data. But just how strong are those
Speaker 1: digital walls? How secure is all that incredibly sensitive stuff
Speaker 1: you carry around every day? To help us unpack all this,
Speaker 1: we're mainly drawing from penetration testing with Colleen net Hunter
Speaker 1: by Gerald Tripp. Riebel Trips are Real Pro Season red
Speaker 1: Teamer founded TENNESSEC and Harmful Stimulus LC got certifications like
Speaker 1: GPN CISSP Solid Credentials, and backing him up are his reviewers,
Speaker 1: Doctor James Horlock, cybersecurity manager, ethical hacker, PhD Interesh bringing
Speaker 1: experience from Oracle, Big Fortune, five hundred companies, AI Cloud,
Speaker 1: a lot of brain power here. So our mission today
Speaker 1: cut through the jargon. We want to explore mobile penetration testing,
Speaker 1: you know, finding the weaknesses using the tools, but maybe
Speaker 1: more importantly, show you why this matters. For detecting your
Speaker 1: own digital life, give you that shortcut to really understanding
Speaker 1: what's at stake. Let's start by just thinking about how
Speaker 1: quickly these things took over smartphones, tablets. You remember the
Speaker 1: early ones, like the Palm Pilot, maybe the Neukia communicator.
Speaker 1: Early days.
Speaker 2: Yeah, attempts at putting things together.
Speaker 1: Exactly, but then boom, the iPhone in two thousand and seven.
Speaker 1: Android hot on its heels in two thousand and eight.
Speaker 1: That wasn't just a new phone, it was a fundamental shift.
Speaker 1: They suddenly became these incredibly rich but also well vulnerable
Speaker 1: personal data hubs.
Speaker 2: That's the key point. The attack surface as we call it,
Speaker 2: just exploded. Yeah, and our awareness, our defenses they lagged
Speaker 2: behind massively, and that pervasive use it directly feeds into
Speaker 2: the rising threat landscape. The convenience, how personal these devices
Speaker 2: are makes them prime targets. We're seeing really sophisticated malware now,
Speaker 2: stuff designs specifically to go after your mobile banking app,
Speaker 2: grab credentials.
Speaker 1: Quietly scary stuff it is.
Speaker 2: And it's not just apps. The operating systems themselves iOS, Android,
Speaker 2: They have vulnerabilities popping up constantly. It's a real cat
Speaker 2: and mouse game. So the big question becomes, how do
Speaker 2: we get proactive? How do we secure these little pocket
Speaker 2: computers before the bad guys find the next hole?
Speaker 1: Right, So let's get into that core difference the two
Speaker 1: big players, Android and iOS. The numbers are pretty stark, right.
Speaker 1: January twenty twenty four, stat Counter had Android at nearly
Speaker 1: seventy percent globally.
Speaker 2: Yeah, sixty nine point nine to four percent. To be exact,
Speaker 2: iOS was around twenty nine point three two percent.
Speaker 1: So why is androids so dominant? People usually point to
Speaker 1: the open source aspect, right, more manufacturers, different price points.
Speaker 2: Absolutely, and that open nature leads directly to a different
Speaker 2: security philosophy. It's a tail of two worlds. Really. Android's
Speaker 2: openness allows for rootability. That means getting privileged control, like
Speaker 2: becoming the super ruser of your own device.
Speaker 1: Okay, what does that actually involve?
Speaker 2: Well, typically you unlocked the bootloader first. Think of it
Speaker 2: like opening a locked door and getting control of the
Speaker 2: device's foundation. Then you might install a custom recovery something
Speaker 2: like TWRP for doing updates or backup, and then you
Speaker 2: root it, often with a tool called magisk.
Speaker 1: The magist I've heard of that. What's special about it?
Speaker 2: It's clever because it's a systemless rooting method. It gets
Speaker 2: you root access without messing with the main system files,
Speaker 2: which makes it harder for security checks to spot. So
Speaker 2: lots of flexibility for users for developers, but it definitely
Speaker 2: creates a different security situation compared to Apple's.
Speaker 1: Approach, which is the famous walled garden exactly.
Speaker 2: iOS is tightly controlled, closed source, sleek design, intuitive, sure,
Speaker 2: but very locked down. Now it is robust, but you
Speaker 2: can still get around the restrictions, sometimes through jail breaking.
Speaker 1: Right jail breaking? Is that all the same or are
Speaker 1: there different kinds?
Speaker 2: Good question? Three main types. Tether it means you need
Speaker 2: a computer plugged in every time you reboot the phone.
Speaker 2: Some my tether lets a boot up okay, but some
Speaker 2: features are disabled until you connect to a computer again,
Speaker 2: and then there's untethered. That's the goal. Usually it stays
Speaker 2: jail broken, fully functional, no computer needed at the first time.
Speaker 2: Tools like paloer on end check right one in unzero
Speaker 2: over are the names you hear there.
Speaker 1: That's a really clear contrast. So Android being open, iOS
Speaker 1: being closed, how does that translate into specific security features
Speaker 1: on the devices themselves? What's a key Android feature? For instance.
Speaker 2: Well, for Android, a big one is its sandbox environment.
Speaker 2: It keeps apps isolated from each other and the main
Speaker 2: system very important. Plus its permissions model lets you control
Speaker 2: what apps can access, and the binder mechanism is crucial
Speaker 2: for secure communication between different processes, like a graphic coup
Speaker 2: for data. Then you've got paramode networking to control network access,
Speaker 2: hardware backed security features Google play protect scanning apps, and
Speaker 2: the Android key store for safely storing things like encryption keys.
Speaker 1: And on the iOS side, what's the equivalent focus control?
Speaker 2: Really? iOS also has sandboxing, but it adds mandatory code signing. Basically,
Speaker 2: apps have to come from known, validated sources. Apple has to.
Speaker 1: Approve it, so it's harder to run unauthorized stuff.
Speaker 2: Much harder. Then there's a hardware security, especially the secure enclave.
Speaker 2: Think of it as a separate, secure, little processor of
Speaker 2: just for handling encryption keys and sensitive data. Even if
Speaker 2: the main chip is compromised, the enclaves stays safe.
Speaker 1: That sounds pretty secure.
Speaker 2: It is, and secure boot ensures that right from startup,
Speaker 2: every piece of software it runs is genuine and has
Speaker 2: not been tampered with.
Speaker 1: What about that criticism though, that the walled garden, while secure,
Speaker 1: maybe makes it harder for outside researchers to find flaws.
Speaker 2: That's a valid point. The closed nature can make some
Speaker 2: deep dives trickier. But Apple does invest heavily in bug
Speaker 2: bounty programs trying to incentivize finding flaws, and they have
Speaker 2: large internal security teams. It's a trade off, balancing control
Speaker 2: with encouraging security research.
Speaker 1: Okay, makes sense. So if these phones are such data
Speaker 1: treasure chests and the ocs have these defenses, how do
Speaker 1: security pros actually test them? How do they find the cracks?
Speaker 1: It feels like digital detective work, it.
Speaker 2: Really is, And certain types of vulnerabilities just keep showing
Speaker 2: up in mobile apps. Number one is probably insecure data storage.
Speaker 1: What does that mean exactly?
Speaker 2: It means sensitive stuff, passwords, personal info keys is just
Speaker 2: left lying around in unprotected storage locations, maybe plain text
Speaker 2: in a database file and log files, sometimes even in
Speaker 2: the iOS keychain if not used.
Speaker 1: Properly, like leaving the keys under the doormat.
Speaker 2: Pretty much, it's like leaving a treasure chest unguarded. You'd
Speaker 2: be surprised how often it happens.
Speaker 1: I bet I heard a story once about an entire
Speaker 1: user database just sitting unencrypted in local storage wild. What
Speaker 1: about when you actually use the app inputting data.
Speaker 2: Ah that leads to improper input handling. If the app
Speaker 2: doesn't check will you type in.
Speaker 1: Properly, bad things happen, Bad.
Speaker 2: Things like SQL injection, sneaking database commands into a search field,
Speaker 2: or cross site scripting XSS in web views within the app,
Speaker 2: running malicious code in someone else's session. Then there's weak
Speaker 2: or broken authentication passwords that are easy to guess, maybe
Speaker 2: hard coded into the app itself or just using insecure
Speaker 2: ways to log people in.
Speaker 1: Yeah, basic stuff sometimes.
Speaker 2: And insufficient transport layer protection. That's about data send over
Speaker 2: the network using weak encryption, bad certificates, or just sending
Speaker 2: sensitive stuff over plane unencrypted HTTP easy pickings for anyone
Speaker 2: listening in Okay?
Speaker 1: What else is specific to mobile?
Speaker 2: Well? Insecure web view implementations can be risky. That's when
Speaker 2: an app displays web content but doesn't lock it down properly,
Speaker 2: allowing unexpected code execution. Also, improper handling of deep links,
Speaker 2: those links that open specific parts of an app can
Speaker 2: sometimes give unauthorized access. And don't forget API security. The
Speaker 2: back end systems apps talk to are often a weak
Speaker 2: point insecure data handling, broken access control, letting users see
Speaker 2: or change data they shouldn't, or error messages that reveal
Speaker 2: too much information.
Speaker 1: Got it? So that's what they look for. How do
Speaker 1: they actually find these things? What techniques did they use?
Speaker 2: There are a few main approaches. Static analysis is one.
Speaker 2: It's like reading a book, scrutinizing each line. You look
Speaker 2: at the app's code or its compiled version without running it.
Speaker 1: What tools help with that?
Speaker 2: Tools like jabx or gidra are common. They decompile so
Speaker 2: you can read something closer to the original code, looking
Speaker 2: for flaws, hard coded secrets, things like that.
Speaker 1: Okay, so static is looking at the blueprint. What else?
Speaker 2: Then there's dynamic analysis. This is observing the application during execution.
Speaker 2: You run the app, interact with it, and use tools
Speaker 2: to see what it's doing under the hood, like cooking
Speaker 2: into it exactly. Tools like freeda let you hook into
Speaker 2: the running app, watch its data, even change its behavior
Speaker 2: in real time to test things. And finally, there's reverse engineering.
Speaker 2: This is like deconstructing as much as building. Taking the
Speaker 2: compiled app the AP profile for Android or IPA for iOS,
Speaker 2: and breaking it down into a more understandable format, why
Speaker 2: do that? To find hidden logic bypass security checks, understand
Speaker 2: how it really works. Tools like Hopper or Ida pro
Speaker 2: are the heavy hitters here. It's painstaking work.
Speaker 1: Sounds like it, and for people wanting to learn the stuff,
Speaker 1: hands on.
Speaker 2: Practice is key. There are intentionally vulnerable apps out there
Speaker 2: safe training grounds these like Diva, Damn insecure and vulnerable
Speaker 2: app Cure, Bank, feed too, o, Wasp, goat Droid.
Speaker 1: How do those help well?
Speaker 2: You can try exploding known issues in a safe space,
Speaker 2: for example, finding sensitive data leaked via androids logging system blogcat,
Speaker 2: or finding hard coded passwords by treating the APK file
Speaker 2: like a ZIP archive and digging inside. You can practice
Speaker 2: SQL injection with simple inputs like ORR one equals one,
Speaker 2: or use the Android debug Bridge ADB to try and
Speaker 2: bypass access controls on certain app screens. It's learning by doing,
Speaker 2: which is crucial here.
Speaker 1: Right, that makes sense, But then things get really interesting.
Speaker 1: When we talk about Colleen net Hunter, this feels like
Speaker 1: a different level entirely.
Speaker 2: It really is a game changer. Colleen net Hunter essentially
Speaker 2: puts the power of Collie Linux, the main penetration testing
Speaker 2: operating system, onto your Android phone.
Speaker 1: So turning your phone into the hacking.
Speaker 2: Tool precisely, and it enhances these operations significantly. Take wireless exploitation.
Speaker 2: Net Hunter often comes with kernel support for a POH
Speaker 2: two point one point one wireless injection meaning meaning you
Speaker 2: can intercept monitor even in jet traffic into Wi Fi
Speaker 2: networks directly from your phone. Full monitor mode lets you
Speaker 2: just passively listen to all nearby Wi Fi tracks.
Speaker 1: Aw, what tools does it use for that?
Speaker 2: Standard Collie tools often integrated things like air cracking for
Speaker 2: cracking Wi Fi passwords, gizmt for discovering networks even hidden ones.
Speaker 2: Your phone becomes a portable Wi Fi auditing station.
Speaker 1: Okay, that's wireless. What else?
Speaker 2: Each idea attacks human interface device. Nt hunter lets your
Speaker 2: phone pretend to be a keyboarder mouse when plugged into
Speaker 2: a computer.
Speaker 1: Like the infamous rubber ducky.
Speaker 2: Exactly like that, Yeah, bad USB duck hunter attacks. Plug
Speaker 2: your phone in and it can automatically type commands, run scripts,
Speaker 2: potentially take over the machine.
Speaker 1: That's sneaky, very.
Speaker 2: And then there's the kex manager. This lets you run
Speaker 2: a full Collie Linux graphical desktop. Plug your phone into
Speaker 2: a monitor, connect a Bluetooth keyboard and mouse.
Speaker 1: And you have a full desktop, a.
Speaker 2: Virtually identical Collie desktop experience. It brings the extensive capabilities
Speaker 2: of Kalie Linux into a mobile form factor, super discrete,
Speaker 2: super powerful, incredible.
Speaker 1: What about network standing and exploitation.
Speaker 2: Built in n map scan pain makes complex network scans easier,
Speaker 2: and it integrates the metasplit framework, the standard tool for
Speaker 2: finding and using exploits, creating payloads to get command execution,
Speaker 2: privileged escalation, or creating backdoors. It also has specialized tool
Speaker 2: sets like bluetooth arsenal tools like ubertooth support for specific
Speaker 2: hardware like the NRF five one for really deep bluetooth sniffing,
Speaker 2: even car Whisperer for messing with car audio systems via.
Speaker 1: Bluetothe ceriously car audio Yeah.
Speaker 2: Injecting a recording audio and USB arsenal lets the phone
Speaker 2: emulate other USB devices, flash drives, network cards useful for
Speaker 2: more complex bad USB.
Speaker 1: Style attacks, and I guess it can do standard network
Speaker 1: attacks too.
Speaker 2: Oh yeah, Advanced network attacks ARP scoofing with ttercap to
Speaker 2: redirect traffic through your phone and still credentials, DNS hijacking
Speaker 2: with dn's mask to send victims to fake websites even
Speaker 2: ssltls stripping with SSL strip to try and downgrade HTTPS
Speaker 2: connections to planastdps so you can read the traffic.
Speaker 1: So having that capability right there in your pocket, it
Speaker 1: must change how defenders think about threats. Right, attackers could
Speaker 1: be anywhere.
Speaker 2: Fundamentally, it makes network attacks much more localized and potentially
Speaker 2: harder to trace back to a traditional source. How do
Speaker 2: you defend when the attack tool could be the phone
Speaker 2: of the person sitting next to you?
Speaker 1: A really unsettling thought. Okay, let's switch gears slightly. Talk
Speaker 1: about the people doing this work. A career in mobile
Speaker 1: security sounds intense dynamic.
Speaker 2: It definitely is challenging, yes, but also really rewarding. You
Speaker 2: get the satisfaction of making a real impact protecting people
Speaker 2: and companies.
Speaker 1: What's the foundation someone needs to get into this field?
Speaker 2: Well, First, programming prowess helps immensely understanding languages like Java, Swift, Cotlin,
Speaker 2: Objective C, the very languages that bring mobile applications to life.
Speaker 1: Why is that so important?
Speaker 2: Because it lets you not only build secure apps, but
Speaker 2: also spot weaknesses in other people's code, things like buffer overflows,
Speaker 2: memory leaks, logic flaws us. Second, you need to dive
Speaker 2: deep into the mobile operating systems, really understand the intricate
Speaker 2: mechanisms of both iOS and Android, how they work, how
Speaker 2: they're secured, where the potential weak spots.
Speaker 1: Are makes sense. You need to know the territory exactly.
Speaker 2: And third, reverse engineering we touched on it earlier. It's
Speaker 2: the investigative art of taking compiled apps apart with tools
Speaker 2: like j DX or Hopper to see how they tick
Speaker 2: and find hidden flaws.
Speaker 1: So solid technical skills, what about proving those skills? Certifications?
Speaker 2: Certifications definitely help validate your knowledge. The OSP Offensive Security
Speaker 2: Certified Professional is widely respected, often called a transformative experience
Speaker 2: because it's so hands on and practical for pen testers.
Speaker 2: Others like CEH Certified Ethical Hacker, GPN, GAD Penetration Tester,
Speaker 2: GAOIB Mobile Device Security Analysts are valuable, and CISP is
Speaker 2: a broader, globally recognized credential covering security theory and management.
Speaker 2: It shows a well rounded understanding concerts.
Speaker 1: This field changes so fast. How do people stay current?
Speaker 1: It feels like you blink and there's a new threat.
Speaker 2: You're absolutely right. Continuous learning is non negotiable. It's not
Speaker 2: just about reacting. It's about anticipating shifts. Conferences are huge
Speaker 2: obviously black hat def Con they're iconic. Defcon especially was
Speaker 2: a paradigm shift in how we think about security. Cons.
Speaker 1: Are there specific ones good for mobile?
Speaker 2: Look for specialized tracks at the big cons, but also
Speaker 2: events like b sides often more community driven nullcn Avy Tokyo.
Speaker 2: They often have really focused cutting edge mobile talks. Hope
Speaker 2: Ackers on Planet Earth and CCC Chaos Computing Congress are
Speaker 2: also great for broader hacker culture and learning.
Speaker 1: What about smaller scale local stuff.
Speaker 2: Definitely local meetups, workshops over at tea, chapter meetings, even
Speaker 2: in formal twenty six hundred meetings. They're a celebration of
Speaker 2: a culture dedicated to learning and great for networking and
Speaker 2: online hubs are essential security blogs Crebs on Security, Schneier
Speaker 2: on Security, or classics podcasts like The cyber Wire or
Speaker 2: Darknet diaries, following key people in groups on social media,
Speaker 2: hoc five IPsec, live Overflow, Tango SEC, individual researchers.
Speaker 1: It's a constant stream of info, soaking it all in.
Speaker 2: And actively using continuous learning platforms. Of course, serah You
Speaker 2: to Me plural site. These aren't just for starting out.
Speaker 2: They help with proactive efforts to keep skill sharp, and finally,
Speaker 2: building a strong professional network. It's cliche, but who you
Speaker 2: know often complements what you know. How so mentorship, collaboration, opportunities,
Speaker 2: just bouncing ideas off people, getting advice when you're stuck.
Speaker 2: It accelerates learning. Having a good LinkedIn profile, engaging on Twitter, Reddit,
Speaker 2: contributing on GitHub. It all helps build that network.
Speaker 1: Okay, so looking ahead now the crystal ball time? What's
Speaker 1: coming next in mobile security? This ever evolving field, this
Speaker 1: dance between offense and defense.
Speaker 2: Well, we're definitely seeing some emerging thread areas gaining traction.
Speaker 2: ARVR vulnerabilities, for.
Speaker 1: One, augmented in virtual reality. How are they a security risk?
Speaker 2: Think about it? They blend the physical and virtual world.
Speaker 2: AR could create physically unsafe situations through misleading overlays. VR
Speaker 2: raises huge questions about data privacy, what you look at,
Speaker 2: your reactions, and even potential for emotional manipulation, new territory, new.
Speaker 1: Risks, and un settling.
Speaker 2: What else AI based mobile threats. We hear a lot
Speaker 2: about AI for security, but AI can be used against
Speaker 2: it too, Like what adversarial attacks where you subtly change
Speaker 2: input data to fool an AI system, making malware look
Speaker 2: benign or tricking facial recognition and poisoning attacks where you
Speaker 2: feed bad data into an AI model over time to
Speaker 2: skew its learning, maybe teaching it to eventually flag legitimate
Speaker 2: sites as.
Speaker 1: Phishing, wow weaponizing AI and edge computing threats.
Speaker 2: As more processing happens on the device itself rather than
Speaker 2: in the cloud, it creates more new entry points for
Speaker 2: attackers and risks of localized attacks.
Speaker 1: So the threats are evolving, but hopefully the defenses are too.
Speaker 2: Absolutely there's a lot of work happening on the defensive side.
Speaker 2: Enhanced encryption is a big one. People are working on
Speaker 2: post quantum cryptography designed to with DAN future quantum computers,
Speaker 2: plus more alliance on hardware security, those secure enclaves we
Speaker 2: talked about isolated microprocessors to guard the really sensitive stuff.
Speaker 3: What about logging In biometrics, Enhanced biometrics are getting better,
Speaker 3: moving beyond just fingerprints to a reliable facial recognition, IRIS scanning,
Speaker 3: even vein pattern authentication.
Speaker 2: The trend is towards multimodal biometric systems, using multiple methods
Speaker 2: together for much stronger authentication, harder to fool.
Speaker 1: Makes sense.
Speaker 2: Secure boot mechanisms are also getting more sophisticated, making sure
Speaker 2: that from the second you turn the device on, every
Speaker 2: piece of software it runs is genuine and has not
Speaker 2: been tampered with. It protects the entire chain of trust.
Speaker 1: And AI. On the defensive side, yes.
Speaker 2: AI in mobile security is becoming huge, using AI and
Speaker 2: even large language models like chat GPT to improve threat detection,
Speaker 2: analyze massive logs for subtle patterns, even automate some of
Speaker 2: the basic penetration testing works so human experts can focus
Speaker 2: on the harder problems.
Speaker 1: What about things like five G and the Internet of Things?
Speaker 2: That's the sword. More connectivity is great, but five G
Speaker 2: and the explosion of IoT devices vastly expand the attack
Speaker 2: surface billions more connected things. It means meticulous security considerations
Speaker 2: are needed at every level, more than ever before.
Speaker 1: Prue, what an incredible journey we've covered, from the basics
Speaker 1: of android and iOS security, through finding vulnerabilities, the power
Speaker 1: of tools like net hunter, building a career right up
Speaker 1: to future threats and defenses. It really hammers home that
Speaker 1: in this dynamic domain, continuous learning and adapting aren't just
Speaker 1: nice to have, so they're essential. The game keeps changing.
Speaker 2: It absolutely does. And maybe the final thought to leave
Speaker 2: you with is this, given how fast mobile tech and
Speaker 2: cyber threats are moving, how can we individuals, organizations get
Speaker 2: beyond just reacting. How do we build a truly proactive mindset,
Speaker 2: one where we're trying to anticipate that next wave of
Speaker 2: attacks before they even hit. That's the real challenge, isn't
Speaker 2: it the puzzle we're all trying to piece together.
Speaker 1: That is a powerful thought, a great place to pause.
Speaker 1: We really encourage you listening to explore this further. Maybe
Speaker 1: look into net hunter, or research a vulnerability that relates
Speaker 1: to an app you use daily, or check out some
Speaker 1: of those advanced defenses like multimodal biometrics. Keep learning, keep
Speaker 1: asking questions, and let's all play a part in making
Speaker 1: our increasingly digital world just a little bit safer. Thanks
Speaker 1: for joining us on the deep Dive.