A Markov adversary model to detect vulnerable iOS devices and vulnerabilities in iOS apps

作者：D'Orazio, Christian J.; Lu, Rongxing; Choo, Kim-Kwang Raymond^*; Vasilakos, Athanasios V.

来源：Applied Mathematics and Computation, 2017, 293: 523-544.

DOI：10.1016/j.amc.2016.08.051

• Mobile device vulnerability
• Mobile security and privacy
• Mobile threats
• Vulnerability discovery
• Vulnerability exploitation
• iOS device vulnerability

With the increased convergence of technologies whereby a user can access, store and transmit data across different devices in real-time, risks will arise from factors such as lack of appropriate security measures in place and users not having requisite levels of security awareness and not fully understanding how security measures can be used to their advantage. In this paper, we adapt our previously published adversary model for digital rights management (DRM) apps and demonstrate how it can be used to detect vulnerable iOS devices and to analyse (non-DRM) apps for vulnerabilities that can potentially be exploited. Using our adversary model, we investigate several (jailbroken and non-jailbroken) iOS devices, Australian Government Medicare Expert Plus (MEP) app, Commonwealth Bank of Australia app, Western Union app, PayPal app, PocketCloud Remote Desktop app and Simple Transfer Pro app, and reveal previously unknown vulnerabilities. We then demonstrate how the identified vulnerabilities can be exploited to expose the user's sensitive data and personally identifiable information stored on or transmitted from the device. We conclude with several recommendations to enhance the security and privacy of user data stored on or transmitted from these devices.

• 出版日期2017-1-15
• 单位中国地质大学（北京）