I'm going to introduce myself. I am speaking for the XR Village. My name is Whitney Phillips.
I'm going to be presenting on augmented reality and the implications on mobile security. A
little bit about myself. So I've been in InfoSec and IT for about 12 years. I started off at
helpdesk. I was a system administrator after that. Shortly after doing system administration,
I became a security operations, I guess, analyst. I would do anything between running
antivirus or putting encryption on PCs. Anything that could break my way into security. After
that, I switched over to a purple team where I did code review and I know zero code coding. So
that was quite an interesting one year and I quickly got out of it and that's where I turned
to mobile application pen testing. Um, I started that about 5 years ago and have enjoyed it
ever since and that's what kind of broke me into my job here at TrustedSec right now. So I
primarily do mobile app pen testing and then I go and do gray box when they need help for
that. So that's a little bit about me. Um, I was, had no plan on coming to DEF CON today. Um,
about 3 weeks ago, the XR village needed an extra person to fill in so I created my talk and
here I am and we'll give this a go. Yay! Woo! Alright. So, why are we here? I am going to talk
to you about augmented reality and the security and privacy issues it has around mobile security.
So, um, a little bit about augmented reality and I'm not going to lie, like I'm more of a mobile
expert. Um, augmented reality is a little bit like outside of my realm so I felt like big bird
trying to research something completely new and I'm like I don't know what I'm doing. What, you
know, why, you know, why, why am I researching something that's out of my realm? But it's not
because we live in augmented reality every single day. So, augmented reality, it's technology
that is digital. It integrates into a user's physical environment in real time. So, anything
from QR codes to snapchat to even those fun little things that you can put out in your house
like little 3D images, that's all augmented reality. But what we don't really think about is
it collects a wealth of our information, um, in our everyday life. Some, that's my break slide.
So, when I was doing research for augmented reality, I, it was kind of hard. There was a lot
of different information out there. So, this is kind of the information that I've gathered. Um,
there's two different main types of augmented reality. There's marker based. And that's like
your snapchat, your face filtering, um, logos, posters, QR codes. There's augmented reality. I
wouldn't even have thought of that. It's so crazy. Um, then there is without markers. So,
location based. That's GPS. Projection based. That's your 3D images that you, maybe you get an
app from, uh, target. And you're like, this dresser looks really cute in my house. That's the 3D
image. Or Pokemon Go. And then the overlay of screen for the super, um, in position. It's like,
the best I can explain it is like, um, like flying a drone app. That's how, how I take that
specific augmented reality. So, with all those, like, I kind of broke them down a little bit
more into not so marker, markerless, projection. I wanted to like talk about it and how I
understood it. Um, so, a lot of augmented reality, there's a lot of biometrics that are
involved. Especially, uh, with face changing ones or makeup apps. You've got like facial
recognition software. They're tracking your eyes. Heart rate monitors is considered an
augmented reality. Those fun makeup apps where you want to put eye shadow on your face to see
if it looks really cute. Not that I, that everybody does that. Here. Um, yeah, face filtering
and even those clothing apps. There's clothing apps right now that you can take a picture of
yourself and see how that fits on you. But at the meantime, you're still scanning your whole
body and you're scanning everything about you and you're placing it in this app. Um, and then
location based and projection. Like, so, I keep going on about like apps that you can see how
products will fit in your house. Um, architecture uses augmented reality. Navigation is
augmented reality. Manufacturing games like the Pokemon Go. And even our military uses
augmented reality for this. One more man? I don't know if anybody... I didn't have to have
those break slides, so. Alright, so here's some examples of what I found when I was doing
research of what is considered augmented reality. Uh, Shopify has an integration into apps
that will basically do the same thing as the Target and IKEA app. Like, I want to see how this
fits in my home. Um, okay, well now you're taking your GPS location, you're taking everything in
your home and you're now giving it to that app. Um, the Uke makeup cam. Is it gif or jif? Um,
world. Roar, you're putting dinosaurs in your house. Like, this is, you're giving your
information up for dinosaurs. So, other, other app examples. Pokemon Go. I know we have some
Pokemon Go people in here, for sure. Um, I didn't take that soldier's location out. It's supposed
to go into a separate part, but ignore that. That's, that's later on. QR codes and again
Snapchat. We all know we like our Snapchat filters, right? We all know we like our Snapchat
filters. Again, I'm a sucker to it. Don't I look really pretty as an elf? And I have no friends. So,
yeah, we have friends right here. Alright, so, with apps, there's also devices too. So, Apple's
coming out with a new device. Google Glass has had devices out. Uh, Bose, didn't even know they
have frames. Ray-Bans have frames. Did not know that. Amazon and even our U.S. Army, they have a
tactical augmented reality. That's my, it looks like this. So, I know, I know the army gets picked
on a lot and I just, I see something like that and it makes me a little uncomfortable because I
hope that maybe they're the ones sitting, uh, behind the scenes and not doing the actual military
work but like shooting and stuff but this might be our future right here. Um, and especially with
these devices. So, where am I going with this? You have these devices. You have these apps. Let's
talk about the physical, like, let's talk about security concerns and privacy concerns around
these. So, with the physical devices, imagine you're wearing your Google Glasses and you're
trying to go into somewhere where you're not supposed to take pictures. Um, how are we
supposed to know if you're recording or not? Um, I'm pretty sure plenty of people in here don't
want their picture taken. If I had glasses on right now, you know, would you want to be in my,
um, would you want to be in my Google thing and have your information being sent out? Uh,
there was also earlier reports of people being assaulted for wearing Google, like, those types
of virtual reality, augmented reality glasses just because it's, uh, you're kind of drawing a
fine line in people's privacy. So, that's kind of where I'm going with the physical devices. Um,
and with the apps, there's also just general app security concerns. So, attackers can gain
device, or access to your device. Um, I know when you're building out an app and there's such a
rush to get things out, you have, um, developers creating apps that are maybe not as up to
par. And then, like, where are your data stored? And then what third parties get it? And I'm
going to kind of go over those now. So, um, attackers gaining access, it's basically, you
know, they could potentially capture your images if it's not stored properly on your device. Um,
that's another way if they can get a secure backup, or a backup from your phone, they can pull
that information off, um, depending on how the app is storing it. Ransomware, um, on your
device is another security issue. So, I don't see it as much on my end because I'm doing more of
the red teaming and, um, mobile pen testing, but higher profile people, you know, are
could be susceptible to ransomware, um, because they have more information that's needed or is
desired. And then this is a little bit more, um, in my realm, man in the middle of attacks trying
to intercept traffic. We don't know, and this is more where I'm coming in from the mobile
perspective, I see a lot of applications that they rush through and get the app done just to get
it out there, and then they have no concern over how their app is done, or if it's done
securely. They want to be the front runner of being in the augmented reality space. Um,
especially because this is, it's newer, but if you look back, there still is research that is
going back like several years, um, I will say the information out on augmented reality reminds me
of how like mobile security was five years ago when I started doing this. So, so proper app
development, I don't know, mobile app development life cycle is something needed, um, and I don't
see that happening very quickly. Uh, data storage on your device, that's another privacy and
security concern. I do get a lot of apps, um, not augmented reality, but example, chat, and a
chat app that I had stores, um, stores every photo that you take into the cache of the phone, and
if you have backups enabled on that app, well, now you have all your phone's pictures that you
took in that app, so whether, so data storage on the device, if you don't have a lock screen,
on your device, is an issue. So, um, we're lost and damaged, I mean, it's still a privacy
concern. And then these apps also store stuff up in the cloud and we have, a lot of times we do
not know, I, I know going and doing my gray box testing and my mobile testing, when I first
started working there, I was like, wait a minute, why is all this information heading, like, to
all these different, uh, companies? Like, why is that a thing? Because I was so, uh, focused on
data leaving the device and you just, you don't realize how much goes to third parties. But it's
a huge risk because if the third party vendor potentially gets breached, then your data is out
there and I know that's a general concern of everybody in security. So, that's a little bit,
like, on my take on augmented reality, on the app portion of it. So, we have these apps, how are
we going to maybe look at them from a technical's perspective? So, I actually did these, a
couple of these slides just a couple of days ago, so, um, I'm kind of going to go over, um,
something you can do as a user and you don't even have to have, um, you don't even have to have a
jailbroken phone, um, just these two, um, pieces of information. So, there's a site called APK
Pure. This is where you can pull down Android installation files. And from there, um, let me
go over my IPA. Uh, iPhone cake, same idea. I did that, I pulled my APK file out of my
phone, I pulled down APK, uh, if you're not familiar, it's the Android installation file, uh,
IPA is the iOS installation file. So, I took those and I stuck it in a static analysis tool
called MobSF. Um, this is so great, like, if you're just wanting, like, a high level overview
of what's going on in your app. Um, so, I took Snapchat, for instance. Um, look at all these
security, like, issues with danger all over here. Read your phone number, um, your phone
state, external storage. I mean, I guess maybe it stores something there. Read your call
logs. Isn't that a little scary? So, um, and this is something I do, like, as a mobile pen
tester. I'm, this is my first step. I'm looking at how this app is functioning. So, we've got
vulnerabilities, Janice vulnerabilities, and you can install it on a really old version of
Android. So, is your data going to be secured? No. It also allows clear text traffic. So,
yeah, it's, and I was a little bit surprised. So, I thought maybe Snapchat would have had a
lot of trackers to it. It doesn't. Just Mapbox and, you know, your general Firebase
analytics. So, that was really impressive. I was, I was kind of hoping to see a list of
trackers, but I did not. Back to that Roar app. I just, I like it for some reason. I'm, I kind
of want to install it after I'm done with this talk and give them all my data. Um, they
actually have like less permission settings, uh, that I would have expected. Still the read
external storage, um, fine location, but they need that. And that's kind of as a mobile
tester, you have to look and see and look at the app. Like, why, what does the app do? Does
it absolutely need to do this? That, alright. What else do they got? Oh, minimum version
again and clear text. So, clear text allowed on this app. But look at all these trackers. So,
that's the dinosaur app. So, you're purchasing this app to put 3D images in your house of
dinosaurs. And it's tracking all your information. And I know, I hate to pick on the
military, but I like picking on them a little bit. Just because our guys are using these
apps. And this is a civilian version, so I shouldn't get in trouble for this. But our boots
on the ground are using these apps. And it's just as, we want to make sure that they're
secure. Um, but then it still needs a lot of permissions to have that app run. And still
clear text. And another vulnerability. But why do we have servers over in different countries
if it's a US app? So, I know. It's, all this, all this I just wanted to like kind of show from a
mobile, um, you know, a mobile pen testers perspective. How I would securely look at these
devices. I'm going to go in just a little bit more on my mobile. Um, say you want to take it a
step further. Uh, you need a jailbroken or rooted device. I use Magisk personally for my
Android. I use Uncover for my, uh, IOS. And then these are my steps that I would take to look at
like local data storage. I would have my rooted or jailbroken phone. And then, uh, if I was
wanting to, um, not get, like get the app from the actual app store, I would just create a fake
account. Um, and do it that way. But, the, if you're just going to do static analysis and you
don't need a phone, um, APK Pure and MobSF is like the best way to go. So, this is my little
bit more technical part of my talk. Um, I use ADB for Android. And that, um, is my tool kit
that I use a lot to do more internal investigation of the device and the application. Burp
Suite I use, uh, to do that traffic to see what the application, um, how it functions, which,
um, Frida is another app that I use. Um, this app, if it, you have to, like, be in a wrong state
of mind to learn, learn how this app functions. So, I use FreeDump a lot to dump the memory of a
device. So, sometimes applications will dump information in run time. Um, this is a great
tool. So, if they don't reboot their phone and you're looking for maybe potential security
flaws or application issues, um, I would use this tool right here. This one I have just left
over. I was, you pull, like, your unencrypted IPA file and that's another way you can, like,
statically, uh, analysis an IPA for iOS and that's, uh, FreeDump. Tied to Frida, let me take a
break here. Tied to Frida is Objection and that's another tool that I use in and out. And if I
were to be taking these augmented reality, um, apps, I would go through and kind of inspect
them a little bit deeper. So, Objection, you can do, um, file system, exploration, you can
bypass certificate pinning, dump keychains, so if they're not, um, storing things or if
they're storing, uh, stuff in the keychain properly or maybe they're not storing it
properly, you can get that information. Memory leak issues, you can manipulate objects. Um,
this is a starting command for Objection. You didn't think this was going to be a mobile talk
now, did you? It is. Um, so these are the kind of commands that you can run with Objection.
Basically, these are my go to when I'm, like, searching through an app. Uh, if it's got SSL,
like a cert pinning so I can't use burp suite, I'll use the bypass. If it detects root
detection, I will bypass that with the root disable. Key store, um, looking for classes, I
like to take the classes and try to launch them in the app, um, without being logged in to see
if I can get some sort of different information. Um, and that's not so much with these apps
that I was talking about before, but a lot of times, like maybe a banking app, can I launch
that activity? Will it drop me into the banking software? So, iOS, um, NS user defaults,
sometimes a lot of information gets stored in that and you'd be surprised, um, yeah, you'd be
surprised. I've seen passwords in there, so it's definitely a good thing to look at. Uh,
credentials, I'll have you on, I have the defaults twice, I never fix that, whoops. Uh, key
chain dump, and then cookies, again, we need to see if the app is storing things properly in
the key chain. So, um, I know I kind of touched on, oopsie, a little crazy on the slides, I
know I kind of touched on iOS a little bit, but I use jadex too for decompiling my android
apps, um, that's a good app to have a nice, if you're a gooey person like I am, uh, you can
take that, uh, APK, you don't even have to do anything with it, it just, you stick it in the
app and it shows you all your classes and it's an easier way to be able to look at that
information and see what, um, what the app has. So you have your mobile apps, what am I looking
for? Secrets, keys, credentials, URLs, IP addresses, email addresses, um, and then again
with the augmented reality, if I was given that like as an assignment, I would probably look to
see what kind of URLs that aren't tied to that company, you know, how, why are they going to
that, is it necessary, because there is a lot of information that gets stored in apps that you
don't normally think you would want to see. So, after all this, um, circling back around with
our augmented reality and our mobile apps, like, how, what should we do as humans to like keep,
keep ourselves secure? So, avoiding giving out too much information. A lot of times it's easy
to just put your name down and just let it auto fill in the app and then hope for the best. So,
um, give, give half information if it's an app that does not need your information, you do not
need to give your app, that app your information. So, have a Jane Doe or whatever name and then
Paul won't be able to user enumerate you. So, do you want to come finish the rest of your
talk? No. Anyways, um, VPN, that's another one. I've been told I should use it. I probably
will, eventually. Um, and then going back to like the, the physical devices. So, firmware.
Firmware is huge when you have your physical devices, like your glasses, keeping those up to
date. I know when I worked, um, in my previous job, I did a lot of drone stuff and keeping
firmware up to date on your drones is a necessary, necessary evil. So, um, I know it can be a
pain in the butt and it probably sometimes might make your drone act funny. I might, may or
may not have had that happen in my life before. Maybe it will just fly up in your house for no
reason. But firmware updates are needed. Um, and then locking your device. I know it's
something really simple to say, but I feel like people still don't do that. And two factor
authentication is I feel like the best way to make sure that your information doesn't get put
out there. And like I said, to push that first bullet point is don't put your information out
there if it doesn't need to be. Um, that's like the best information that I could give for
keeping yourself secure in these kind of apps. Because they are going to start pushing more
tracking information and they are going to start getting more of our data and sending it out so
then they can use, uh, use it for other things. You know, like when you think about buying a
pair of shoes and it shows up in your, um, shows up in your ads. Right? So, I might have went
too fast. But, uh, some training material that I often like to suggest. Shameless post of my
job. The blog. Or you can hear me on a podcast. But, um, when I first started doing mobile
security, like this was my bread and butter. Uh, the OWASP mobile security testing guide. It's
my, it's my thing. Like I, I liked it. It has good information. Um, and there's also a website
hack tricks that I have referenced quite often now. Um, but I did not have that on that slide.
So, with that, I think, I think that's 30 minutes. That's a solid 30 minutes. If anybody has any
questions, we can answer them down, we, there's a royal we. I can answer them down there and
here's my information if you want to just message me, that's fine too. Um, but yeah, that's,
that's my first DEF CON talk. Woo!