Secure Messengers and Man in The Contacts
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 11:45· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Implementation of Man in The Contacts claims full remote control of a handset address book via a Play Store Android game (a social Rock-Paper-Scissors game), backed by a Command-and-Control server that creates duplicate or edited contacts and triggers push notifications with malicious links. Proof-of-concept bypasses Play Protect, is open-sourced, works in live demos, can enable targeted spear phishing and even relay messages for a practical man-in-the-middle on WhatsApp Telegram Signal.
AI-written summary · about
chapters (9)
- 0:00Secure messengers intro
- 3:22Mobile app security
- 10:10Contact permissions attack
- 15:10Live attack demo
- 24:01Full MITM scenarios
- 25:46Mitigations and responses
- 28:57Key provisioning importance
- 31:04E2E encryption risks
- 34:44Q&A
related talks
32m(In)Secure Messaging Apps: A Lateral Movement Into Your Privacy
19mProtecting Your Users in an Agentic World
20mChameleon Devices: Investigating More Secure and Discreet Mobile Interactions via Active ...
29mAndroid Commercial Spyware Disease and Medication
42mLook, No Hands! -- The Remote, Interaction-less Attack Surface of the iPhone
56mModern Android Hacking
56mHacking your Mind and Emotions
37mYour Phone is Not Your Phone: A Dive Into SMS PVA Fraud