start	end	text
0	7760	I'm going to introduce myself. I am speaking for the XR Village. My name is Whitney Phillips.
7760	17000	I'm going to be presenting on augmented reality and the implications on mobile security. A
17000	23800	little bit about myself. So I've been in InfoSec and IT for about 12 years. I started off at
23800	32780	helpdesk. I was a system administrator after that. Shortly after doing system administration,
32780	43600	I became a security operations, I guess, analyst. I would do anything between running
43600	52200	antivirus or putting encryption on PCs. Anything that could break my way into security. After
52200	60000	that, I switched over to a purple team where I did code review and I know zero code coding. So
60660	66660	that was quite an interesting one year and I quickly got out of it and that's where I turned
66660	74200	to mobile application pen testing. Um, I started that about 5 years ago and have enjoyed it
74200	80660	ever since and that's what kind of broke me into my job here at TrustedSec right now. So I
80660	86000	primarily do mobile app pen testing and then I go and do gray box when they need help for
86000	94280	that. So that's a little bit about me. Um, I was, had no plan on coming to DEF CON today. Um,
94280	103040	about 3 weeks ago, the XR village needed an extra person to fill in so I created my talk and
103420	114100	here I am and we'll give this a go. Yay! Woo! Alright. So, why are we here? I am going to talk
114100	122800	to you about augmented reality and the security and privacy issues it has around mobile security.
122880	130820	So, um, a little bit about augmented reality and I'm not going to lie, like I'm more of a mobile
130820	136800	expert. Um, augmented reality is a little bit like outside of my realm so I felt like big bird
136800	142240	trying to research something completely new and I'm like I don't know what I'm doing. What, you
142240	148100	know, why, you know, why, why am I researching something that's out of my realm? But it's not
148100	156760	because we live in augmented reality every single day. So, augmented reality, it's technology
156760	163620	that is digital. It integrates into a user's physical environment in real time. So, anything
163620	174920	from QR codes to snapchat to even those fun little things that you can put out in your house
174920	180600	like little 3D images, that's all augmented reality. But what we don't really think about is
180600	193460	it collects a wealth of our information, um, in our everyday life. Some, that's my break slide.
193660	198280	So, when I was doing research for augmented reality, I, it was kind of hard. There was a lot
198280	206920	of different information out there. So, this is kind of the information that I've gathered. Um,
206920	212500	there's two different main types of augmented reality. There's marker based. And that's like
212500	219160	your snapchat, your face filtering, um, logos, posters, QR codes. There's augmented reality. I
219160	226240	wouldn't even have thought of that. It's so crazy. Um, then there is without markers. So,
226240	234880	location based. That's GPS. Projection based. That's your 3D images that you, maybe you get an
234880	241140	app from, uh, target. And you're like, this dresser looks really cute in my house. That's the 3D
241140	248780	image. Or Pokemon Go. And then the overlay of screen for the super, um, in position. It's like,
249260	259260	the best I can explain it is like, um, like flying a drone app. That's how, how I take that
259260	265760	specific augmented reality. So, with all those, like, I kind of broke them down a little bit
265760	273720	more into not so marker, markerless, projection. I wanted to like talk about it and how I
273720	279500	understood it. Um, so, a lot of augmented reality, there's a lot of biometrics that are
279500	286780	involved. Especially, uh, with face changing ones or makeup apps. You've got like facial
286780	291580	recognition software. They're tracking your eyes. Heart rate monitors is considered an
291580	296980	augmented reality. Those fun makeup apps where you want to put eye shadow on your face to see
296980	304520	if it looks really cute. Not that I, that everybody does that. Here. Um, yeah, face filtering
304520	308280	and even those clothing apps. There's clothing apps right now that you can take a picture of
308280	313760	yourself and see how that fits on you. But at the meantime, you're still scanning your whole
313760	320560	body and you're scanning everything about you and you're placing it in this app. Um, and then
320560	327220	location based and projection. Like, so, I keep going on about like apps that you can see how
327220	332720	products will fit in your house. Um, architecture uses augmented reality. Navigation is
332720	340140	augmented reality. Manufacturing games like the Pokemon Go. And even our military uses
340140	349260	augmented reality for this. One more man? I don't know if anybody... I didn't have to have
349260	354280	those break slides, so. Alright, so here's some examples of what I found when I was doing
354280	360560	research of what is considered augmented reality. Uh, Shopify has an integration into apps
360560	367280	that will basically do the same thing as the Target and IKEA app. Like, I want to see how this
367280	374340	fits in my home. Um, okay, well now you're taking your GPS location, you're taking everything in
374340	385240	your home and you're now giving it to that app. Um, the Uke makeup cam. Is it gif or jif? Um,
385240	392580	world. Roar, you're putting dinosaurs in your house. Like, this is, you're giving your
392580	400840	information up for dinosaurs. So, other, other app examples. Pokemon Go. I know we have some
400840	407780	Pokemon Go people in here, for sure. Um, I didn't take that soldier's location out. It's supposed
407780	413800	to go into a separate part, but ignore that. That's, that's later on. QR codes and again
413800	419680	Snapchat. We all know we like our Snapchat filters, right? We all know we like our Snapchat
419680	428800	filters. Again, I'm a sucker to it. Don't I look really pretty as an elf? And I have no friends. So,
429540	438480	yeah, we have friends right here. Alright, so, with apps, there's also devices too. So, Apple's
438480	446000	coming out with a new device. Google Glass has had devices out. Uh, Bose, didn't even know they
446000	453860	have frames. Ray-Bans have frames. Did not know that. Amazon and even our U.S. Army, they have a
454580	466000	tactical augmented reality. That's my, it looks like this. So, I know, I know the army gets picked
466100	471680	on a lot and I just, I see something like that and it makes me a little uncomfortable because I
471680	479640	hope that maybe they're the ones sitting, uh, behind the scenes and not doing the actual military
479640	487240	work but like shooting and stuff but this might be our future right here. Um, and especially with
487240	495420	these devices. So, where am I going with this? You have these devices. You have these apps. Let's
495420	500400	talk about the physical, like, let's talk about security concerns and privacy concerns around
500400	507260	these. So, with the physical devices, imagine you're wearing your Google Glasses and you're
507260	512880	trying to go into somewhere where you're not supposed to take pictures. Um, how are we
512880	518120	supposed to know if you're recording or not? Um, I'm pretty sure plenty of people in here don't
518120	525220	want their picture taken. If I had glasses on right now, you know, would you want to be in my,
525960	533080	um, would you want to be in my Google thing and have your information being sent out? Uh,
533080	539420	there was also earlier reports of people being assaulted for wearing Google, like, those types
539420	547860	of virtual reality, augmented reality glasses just because it's, uh, you're kind of drawing a
547860	555200	fine line in people's privacy. So, that's kind of where I'm going with the physical devices. Um,
555220	564440	and with the apps, there's also just general app security concerns. So, attackers can gain
564440	573060	device, or access to your device. Um, I know when you're building out an app and there's such a
573060	581420	rush to get things out, you have, um, developers creating apps that are maybe not as up to
581420	586640	par. And then, like, where are your data stored? And then what third parties get it? And I'm
586640	596880	going to kind of go over those now. So, um, attackers gaining access, it's basically, you
596880	606040	know, they could potentially capture your images if it's not stored properly on your device. Um,
606800	612600	that's another way if they can get a secure backup, or a backup from your phone, they can pull
612600	623530	that information off, um, depending on how the app is storing it. Ransomware, um, on your
623530	631670	device is another security issue. So, I don't see it as much on my end because I'm doing more of
631670	638830	the red teaming and, um, mobile pen testing, but higher profile people, you know, are
638850	646490	could be susceptible to ransomware, um, because they have more information that's needed or is
646490	653790	desired. And then this is a little bit more, um, in my realm, man in the middle of attacks trying
653790	662890	to intercept traffic. We don't know, and this is more where I'm coming in from the mobile
662890	668970	perspective, I see a lot of applications that they rush through and get the app done just to get
668970	676830	it out there, and then they have no concern over how their app is done, or if it's done
676830	685670	securely. They want to be the front runner of being in the augmented reality space. Um,
685670	691450	especially because this is, it's newer, but if you look back, there still is research that is
691450	698490	going back like several years, um, I will say the information out on augmented reality reminds me
698490	707650	of how like mobile security was five years ago when I started doing this. So, so proper app
708390	713510	development, I don't know, mobile app development life cycle is something needed, um, and I don't
713510	722710	see that happening very quickly. Uh, data storage on your device, that's another privacy and
722710	730370	security concern. I do get a lot of apps, um, not augmented reality, but example, chat, and a
730370	739710	chat app that I had stores, um, stores every photo that you take into the cache of the phone, and
739710	745870	if you have backups enabled on that app, well, now you have all your phone's pictures that you
745870	752690	took in that app, so whether, so data storage on the device, if you don't have a lock screen,
752710	763630	on your device, is an issue. So, um, we're lost and damaged, I mean, it's still a privacy
763630	772730	concern. And then these apps also store stuff up in the cloud and we have, a lot of times we do
772730	779710	not know, I, I know going and doing my gray box testing and my mobile testing, when I first
779710	785330	started working there, I was like, wait a minute, why is all this information heading, like, to
785330	791610	all these different, uh, companies? Like, why is that a thing? Because I was so, uh, focused on
792710	799570	data leaving the device and you just, you don't realize how much goes to third parties. But it's
799670	807430	a huge risk because if the third party vendor potentially gets breached, then your data is out
807430	814150	there and I know that's a general concern of everybody in security. So, that's a little bit,
814150	822190	like, on my take on augmented reality, on the app portion of it. So, we have these apps, how are
822190	831990	we going to maybe look at them from a technical's perspective? So, I actually did these, a
831990	839450	couple of these slides just a couple of days ago, so, um, I'm kind of going to go over, um,
839470	846330	something you can do as a user and you don't even have to have, um, you don't even have to have a
846330	855310	jailbroken phone, um, just these two, um, pieces of information. So, there's a site called APK
855530	863490	Pure. This is where you can pull down Android installation files. And from there, um, let me
863490	869450	go over my IPA. Uh, iPhone cake, same idea. I did that, I pulled my APK file out of my
869470	876150	phone, I pulled down APK, uh, if you're not familiar, it's the Android installation file, uh,
876150	882490	IPA is the iOS installation file. So, I took those and I stuck it in a static analysis tool
882490	888770	called MobSF. Um, this is so great, like, if you're just wanting, like, a high level overview
888770	897830	of what's going on in your app. Um, so, I took Snapchat, for instance. Um, look at all these
897830	904730	security, like, issues with danger all over here. Read your phone number, um, your phone
904730	911510	state, external storage. I mean, I guess maybe it stores something there. Read your call
911510	917930	logs. Isn't that a little scary? So, um, and this is something I do, like, as a mobile pen
917930	926370	tester. I'm, this is my first step. I'm looking at how this app is functioning. So, we've got
926370	932330	vulnerabilities, Janice vulnerabilities, and you can install it on a really old version of
932330	945110	Android. So, is your data going to be secured? No. It also allows clear text traffic. So,
945110	951550	yeah, it's, and I was a little bit surprised. So, I thought maybe Snapchat would have had a
951550	957210	lot of trackers to it. It doesn't. Just Mapbox and, you know, your general Firebase
958250	964030	analytics. So, that was really impressive. I was, I was kind of hoping to see a list of
964650	972610	trackers, but I did not. Back to that Roar app. I just, I like it for some reason. I'm, I kind
972610	977590	of want to install it after I'm done with this talk and give them all my data. Um, they
977590	984350	actually have like less permission settings, uh, that I would have expected. Still the read
984350	990150	external storage, um, fine location, but they need that. And that's kind of as a mobile
990150	996670	tester, you have to look and see and look at the app. Like, why, what does the app do? Does
996670	1006130	it absolutely need to do this? That, alright. What else do they got? Oh, minimum version
1006130	1014310	again and clear text. So, clear text allowed on this app. But look at all these trackers. So,
1014310	1021790	that's the dinosaur app. So, you're purchasing this app to put 3D images in your house of
1021790	1029170	dinosaurs. And it's tracking all your information. And I know, I hate to pick on the
1029170	1034290	military, but I like picking on them a little bit. Just because our guys are using these
1034290	1040170	apps. And this is a civilian version, so I shouldn't get in trouble for this. But our boots
1040170	1046250	on the ground are using these apps. And it's just as, we want to make sure that they're
1046250	1059230	secure. Um, but then it still needs a lot of permissions to have that app run. And still
1059230	1067470	clear text. And another vulnerability. But why do we have servers over in different countries
1067470	1079130	if it's a US app? So, I know. It's, all this, all this I just wanted to like kind of show from a
1079130	1085670	mobile, um, you know, a mobile pen testers perspective. How I would securely look at these
1085670	1094050	devices. I'm going to go in just a little bit more on my mobile. Um, say you want to take it a
1094050	1101590	step further. Uh, you need a jailbroken or rooted device. I use Magisk personally for my
1101590	1112130	Android. I use Uncover for my, uh, IOS. And then these are my steps that I would take to look at
1112130	1121570	like local data storage. I would have my rooted or jailbroken phone. And then, uh, if I was
1121570	1127310	wanting to, um, not get, like get the app from the actual app store, I would just create a fake
1127310	1134490	account. Um, and do it that way. But, the, if you're just going to do static analysis and you
1134490	1141830	don't need a phone, um, APK Pure and MobSF is like the best way to go. So, this is my little
1141830	1149910	bit more technical part of my talk. Um, I use ADB for Android. And that, um, is my tool kit
1150250	1160260	that I use a lot to do more internal investigation of the device and the application. Burp
1160260	1170800	Suite I use, uh, to do that traffic to see what the application, um, how it functions, which,
1174780	1185180	um, Frida is another app that I use. Um, this app, if it, you have to, like, be in a wrong state
1185180	1199140	of mind to learn, learn how this app functions. So, I use FreeDump a lot to dump the memory of a
1199140	1205860	device. So, sometimes applications will dump information in run time. Um, this is a great
1205860	1212340	tool. So, if they don't reboot their phone and you're looking for maybe potential security
1212340	1221780	flaws or application issues, um, I would use this tool right here. This one I have just left
1221780	1227420	over. I was, you pull, like, your unencrypted IPA file and that's another way you can, like,
1227420	1238160	statically, uh, analysis an IPA for iOS and that's, uh, FreeDump. Tied to Frida, let me take a
1238160	1248510	break here. Tied to Frida is Objection and that's another tool that I use in and out. And if I
1248510	1256490	were to be taking these augmented reality, um, apps, I would go through and kind of inspect
1256490	1267490	them a little bit deeper. So, Objection, you can do, um, file system, exploration, you can
1267490	1273030	bypass certificate pinning, dump keychains, so if they're not, um, storing things or if
1273030	1278530	they're storing, uh, stuff in the keychain properly or maybe they're not storing it
1278530	1286470	properly, you can get that information. Memory leak issues, you can manipulate objects. Um,
1287090	1291550	this is a starting command for Objection. You didn't think this was going to be a mobile talk
1291550	1298670	now, did you? It is. Um, so these are the kind of commands that you can run with Objection.
1299210	1306510	Basically, these are my go to when I'm, like, searching through an app. Uh, if it's got SSL,
1306510	1312070	like a cert pinning so I can't use burp suite, I'll use the bypass. If it detects root
1312070	1319970	detection, I will bypass that with the root disable. Key store, um, looking for classes, I
1319970	1327450	like to take the classes and try to launch them in the app, um, without being logged in to see
1327450	1333970	if I can get some sort of different information. Um, and that's not so much with these apps
1333970	1339750	that I was talking about before, but a lot of times, like maybe a banking app, can I launch
1339750	1350630	that activity? Will it drop me into the banking software? So, iOS, um, NS user defaults,
1350630	1358550	sometimes a lot of information gets stored in that and you'd be surprised, um, yeah, you'd be
1358550	1365530	surprised. I've seen passwords in there, so it's definitely a good thing to look at. Uh,
1365530	1371650	credentials, I'll have you on, I have the defaults twice, I never fix that, whoops. Uh, key
1371650	1377490	chain dump, and then cookies, again, we need to see if the app is storing things properly in
1377490	1387350	the key chain. So, um, I know I kind of touched on, oopsie, a little crazy on the slides, I
1387350	1393490	know I kind of touched on iOS a little bit, but I use jadex too for decompiling my android
1393490	1401350	apps, um, that's a good app to have a nice, if you're a gooey person like I am, uh, you can
1401350	1407430	take that, uh, APK, you don't even have to do anything with it, it just, you stick it in the
1407430	1414050	app and it shows you all your classes and it's an easier way to be able to look at that
1414050	1423470	information and see what, um, what the app has. So you have your mobile apps, what am I looking
1423490	1432950	for? Secrets, keys, credentials, URLs, IP addresses, email addresses, um, and then again
1432950	1437590	with the augmented reality, if I was given that like as an assignment, I would probably look to
1437590	1446770	see what kind of URLs that aren't tied to that company, you know, how, why are they going to
1446770	1451550	that, is it necessary, because there is a lot of information that gets stored in apps that you
1451550	1465680	don't normally think you would want to see. So, after all this, um, circling back around with
1465680	1473360	our augmented reality and our mobile apps, like, how, what should we do as humans to like keep,
1473360	1480180	keep ourselves secure? So, avoiding giving out too much information. A lot of times it's easy
1480180	1487960	to just put your name down and just let it auto fill in the app and then hope for the best. So,
1487960	1495080	um, give, give half information if it's an app that does not need your information, you do not
1495080	1502740	need to give your app, that app your information. So, have a Jane Doe or whatever name and then
1502740	1508020	Paul won't be able to user enumerate you. So, do you want to come finish the rest of your
1508020	1515960	talk? No. Anyways, um, VPN, that's another one. I've been told I should use it. I probably
1515960	1523300	will, eventually. Um, and then going back to like the, the physical devices. So, firmware.
1523860	1528620	Firmware is huge when you have your physical devices, like your glasses, keeping those up to
1528620	1536020	date. I know when I worked, um, in my previous job, I did a lot of drone stuff and keeping
1536020	1545160	firmware up to date on your drones is a necessary, necessary evil. So, um, I know it can be a
1545160	1550540	pain in the butt and it probably sometimes might make your drone act funny. I might, may or
1550540	1555920	may not have had that happen in my life before. Maybe it will just fly up in your house for no
1555920	1562360	reason. But firmware updates are needed. Um, and then locking your device. I know it's
1562360	1567380	something really simple to say, but I feel like people still don't do that. And two factor
1567380	1574260	authentication is I feel like the best way to make sure that your information doesn't get put
1574260	1580900	out there. And like I said, to push that first bullet point is don't put your information out
1580900	1586220	there if it doesn't need to be. Um, that's like the best information that I could give for
1587460	1592300	keeping yourself secure in these kind of apps. Because they are going to start pushing more
1592300	1600800	tracking information and they are going to start getting more of our data and sending it out so
1600800	1605860	then they can use, uh, use it for other things. You know, like when you think about buying a
1605860	1613640	pair of shoes and it shows up in your, um, shows up in your ads. Right? So, I might have went
1613640	1621520	too fast. But, uh, some training material that I often like to suggest. Shameless post of my
1621520	1628020	job. The blog. Or you can hear me on a podcast. But, um, when I first started doing mobile
1628020	1634020	security, like this was my bread and butter. Uh, the OWASP mobile security testing guide. It's
1634020	1641100	my, it's my thing. Like I, I liked it. It has good information. Um, and there's also a website
1641880	1648720	hack tricks that I have referenced quite often now. Um, but I did not have that on that slide.
1648720	1656700	So, with that, I think, I think that's 30 minutes. That's a solid 30 minutes. If anybody has any
1656700	1662440	questions, we can answer them down, we, there's a royal we. I can answer them down there and
1662440	1669360	here's my information if you want to just message me, that's fine too. Um, but yeah, that's,
1669360	1671760	that's my first DEF CON talk. Woo!