Presented at
Black Hat USA 2014,
Aug. 7, 2014, 10:15 a.m.
(60 minutes)
The secure BYOD hype is growing and Virtual Desktop Infrastructure (VDI) is considered the alternative solution for secure containers. In a nutshell, VDI solutions provide a remote workstation offering so that no data is stored locally. We decided to examine the architecture and see for ourselves whether VDI delivers on its security promise.
In this engaging session, we demonstrate a proof-of-concept attack where a malicious app leverages screen scraping to exfiltrate data through common VDI platforms. By simulating the user's interaction, we show how such an attack is not only feasible - but also efficient. While keeping the espionage activity invisible both from client-side and server-side malware detection measures, the attacker can automate the process and ultimately render the VDI solution ineffective.
Presenters:
-
Michael Shaulov
- Lacoon Mobile Security
Michael Shaulov is CEO and Co-Founder of Lacoon Mobile Security. Michael has more than a decade of experience researching and working in the mobile security space, keeping a tight tab on the shift from feature-phones to smartphones. He is a recognized industry speaker, having spoken at Black Hat EU, Black Hat USA and Infosec. Prior to founding Lacoon, Michael founded and led the Mobile Intrusive Interception team for the security division of NICE Systems LTD. Before his commercial endeavors, Michael pioneered the mobile security field in an elite military technological unit, where he received the Israeli Presidential Excellency Honor for his contributions. Michael holds a BSc in Computer Sciences and Physics from Ben-Gurion University, Israel.
-
Daniel Brodie
- Lacoon Security
Daniel is a Senior Researcher at Lacoon Mobile Security where he leads dynamic analysis and instrumentation of mobile malware. His in-depth research findings and corresponding demos have been presented at various Black Hat conferences. Before joining Lacoon, Daniel provided vulnerability research and exploitation for low level vulnerabilities, in both PC and Mobile environments, as a contractor to various companies - from small start-ups to Fortune 500s. Prior to that, Daniel served in the IDF where he managed a project involving next-generation OS research.
Links:
Similar Presentations: