Module 13 of 20 — Advanced Domains

Mobile & IoT Security

Mobile devices and IoT present unique security challenges. iOS and Android have fundamentally different security models. IoT devices often lack basic security features while controlling physical systems. This module covers attack vectors and defensive strategies for both domains.

Android Security Architecture

Android security is defense-in-depth from hardware to apps. Each layer provides isolation and protection against different attack vectors.

Linux Kernel

Concerns: SELinux policies, kernel exploits, rooting attacks.
Protections: Verified Boot, dm-verity, kernel ASLR.

Hardware Abstraction Layer (HAL)

Concerns: Permission bypass, hardware interface exploits.
Protections: Binder IPC restrictions, SELinux domains.

Android Runtime

Concerns: Sandbox escape, code injection via JNI.
Protections: SELinux, seccomp-bpf, app sandbox.

Java/Kotlin Framework

Concerns: Insecure inter-app communication, exported components.
Protections: Permission model, intent filters, protection levels.

Apps

Concerns: Malicious apps, data leakage, root detection bypass.
Protections: Google Play Protect, SafetyNet, Play App Signing.

Mobile Threat Landscape

Mobile malware leverages platform features like accessibility services and app overlays to steal credentials and exfiltrate data.

Banking Trojans

Example: EventBot, TeaBot - Overlay attacks to steal credentials.
Vector: Third-party app stores, phishing downloads.

Screen Overlay

Example: Faketoken - Shows fake login screens over real apps.
Vector: Accessibility permissions abuse.

SMS Interception

Example: Android/SpyNote - Intercept 2FA codes.
Vector: SMS_READ permission, accessibility services.

Mobile Ransomware

Example: Android/Lockerpin - Lock devices until payment.
Vector: Malicious apps, exploit kits.

iOS Security Features

iOS prioritizes security through hardware isolation, code signing, and strict sandboxing. Jailbreaking defeats most protections.

Secure Enclave

Hardware-based key management for biometric data and encryption.

Attack: Physical attacks require expensive equipment to extract keys.

Code Signing

All apps must be signed by Apple or enterprise certificate.

Attack: Enterprise certs abused for distribution (Haima, PPD).

Sandbox

Each app runs in isolated container with restricted file access.

Attack: Jailbreak bypasses sandbox entirely.

ASLR & KASLR

Randomized memory layout prevents predictable exploits.

Attack: Info leaks can defeat ASLR.

IoT Protocols & Security

IoT protocols are designed for low power and low bandwidth, often at the cost of security. Understanding protocol limitations guides defense strategies.

MQTT

Lightweight publish-subscribe messaging for sensors.

Risks: No encryption by default, weak authentication.

Secure Use: TLS + client certificates, broker ACLs.

CoAP

UDP-based protocol for constrained devices.

Risks: UDP amplification DDoS, DTLS misconfiguration.

Secure Use: OSCORE for end-to-end security.

Zigbee

Low-power mesh networking for home automation.

Risks: Weak network keys, replay attacks.

Secure Use: Install codes, network key rotation.

BLE

Bluetooth Low Energy for proximity devices.

Risks: Just Works pairing, passive eavesdropping.

Secure Use: LE Secure Connections, application-layer encryption.

Key Takeaways

  • Android security is layered from kernel to apps with SELinux and sandboxing.
  • iOS relies on code signing and Secure Enclave—jailbreaking defeats protections.
  • IoT protocols often lack encryption—security must be layered on top.
  • Reverse engineering helps understand app behavior—use tools like Frida, JADX, Hopper.
Module 13 of 20
Quiz 3Next: Social Engineering