1 00:00:00,000 --> 00:00:02,610 >> [Semina] [watetezi Nyuma hila: Simu ya Matumizi ya Usalama] 2 00:00:02,610 --> 00:00:04,380 [Chris Wysopal] [Chuo Kikuu cha Harvard] 3 00:00:04,380 --> 00:00:07,830 [Hii ni CS50.] [CS50.TV] 4 00:00:07,830 --> 00:00:10,360 >> Good mchana. Jina langu ni Chris Wysopal. 5 00:00:10,360 --> 00:00:13,360 Mimi nina CTO na mwanzilishi wa Veracode. 6 00:00:13,360 --> 00:00:15,880 Veracode ni maombi kampuni ya usalama. 7 00:00:15,880 --> 00:00:18,230 Sisi mtihani kila aina ya maombi mbalimbali, 8 00:00:18,230 --> 00:00:25,060 na nini mimi kwenda kwa majadiliano juu ya leo ni maombi ya simu usalama. 9 00:00:25,060 --> 00:00:28,630 Background yangu nimekuwa kufanya utafiti wa usalama 10 00:00:28,630 --> 00:00:31,970 kwa muda mrefu sana, pengine kwa muda mrefu kama mtu yeyote. 11 00:00:31,970 --> 00:00:35,000 Mimi kuanza katikati 90, 12 00:00:35,000 --> 00:00:37,370 na ilikuwa wakati huo alikuwa pretty kuvutia kwa sababu 13 00:00:37,370 --> 00:00:39,220 sisi alikuwa na mabadiliko dhana katikati 90. 14 00:00:39,220 --> 00:00:43,520 Wote wa kompyuta kila mtu ghafla ilikuwa yatakuwapo hadi internet, 15 00:00:43,520 --> 00:00:46,550 na wakati huo tulikuwa na mwanzo wa maombi ya mtandao, 16 00:00:46,550 --> 00:00:49,330 na kwamba ni nini mimi ililenga mengi wakati huo. 17 00:00:49,330 --> 00:00:51,160 Ni jambo la kushangaza. 18 00:00:51,160 --> 00:00:53,930 Sasa tuna mwingine mabadiliko dhana kinachotokea na kompyuta, 19 00:00:53,930 --> 00:00:58,710 ambayo ni mabadiliko ya maombi ya simu. 20 00:00:58,710 --> 00:01:03,680 >> Mimi kuhisi ni aina ya wakati sawa basi ni katika mwishoni mwa 90s 21 00:01:03,680 --> 00:01:07,650 tulipokuwa kuchunguza mtandao maombi na kutafuta kasoro kama 22 00:01:07,650 --> 00:01:11,800 makosa ya usimamizi wa kikao na SQL sindano 23 00:01:11,800 --> 00:01:14,940 ambayo kwa kweli haikuwepo kabla, na kwa ghafla, wakasema walikuwa kila mahali 24 00:01:14,940 --> 00:01:19,360 katika maombi ya mtandao, na sasa muda mwingi mimi kutumia 25 00:01:19,360 --> 00:01:27,950 ni kuangalia maombi ya simu na kuangalia nini kinaendelea huko nje katika pori. 26 00:01:27,950 --> 00:01:32,060 Maombi ya simu ni kweli kwenda kuwa kubwa kompyuta jukwaa, 27 00:01:32,060 --> 00:01:35,060 hivyo sisi kwa kweli wanahitaji kutumia muda mwingi kama wewe ni katika sekta ya usalama 28 00:01:35,060 --> 00:01:39,280 kulenga maombi ya mtandao. 29 00:01:39,280 --> 00:01:43,420 Kulikuwa na 29000000000 programu ya simu kupakuliwa mwaka 2011. 30 00:01:43,420 --> 00:01:47,920 Ni alitabiri kuwa programu 76000000000 na 2014. 31 00:01:47,920 --> 00:01:54,040 Kuna 686,000,000 vifaa kwamba ni kwenda kununuliwa mwaka huu, 32 00:01:54,040 --> 00:01:57,060 hivyo hii ni mahali ambapo watu kwenda kufanya 33 00:01:57,060 --> 00:01:59,600  wengi ya mteja kompyuta zao kwenda mbele. 34 00:01:59,600 --> 00:02:04,220 >> Nilikuwa kuzungumza na makamu wa rais katika Fidelity Investments 35 00:02:04,220 --> 00:02:08,780 miezi michache iliyopita, na alisema wao tu kuona zaidi trafiki 36 00:02:08,780 --> 00:02:12,610 kufanya shughuli za fedha kutoka kwa wateja yao ya msingi 37 00:02:12,610 --> 00:02:16,230 juu ya maombi zao za mkononi kuliko kwenye tovuti yao, 38 00:02:16,230 --> 00:02:20,610 hivyo matumizi ya kawaida kwa ajili ya mtandao katika siku za nyuma imekuwa 39 00:02:20,610 --> 00:02:23,800 kuangalia hisa yako quotes, kusimamia kwingineko yako, 40 00:02:23,800 --> 00:02:28,060 na sisi ni kweli kuona kwamba mwaka 2012 kubadili juu ya 41 00:02:28,060 --> 00:02:30,960 kuwa zaidi kubwa juu ya simu jukwaa. 42 00:02:30,960 --> 00:02:34,530 Hakika kama kuna kwenda kuwa shughuli yoyote ya jinai, 43 00:02:34,530 --> 00:02:38,900 shughuli yoyote ya malicious, ni kwenda kuanza kuwa na umakini katika jukwaa simu 44 00:02:38,900 --> 00:02:44,210 baada ya muda kama watu kubadili juu ya hilo. 45 00:02:44,210 --> 00:02:48,320 Kama ukiangalia simu jukwaa, 46 00:02:48,320 --> 00:02:54,380 kuangalia hatari ya jukwaa ni muhimu kwa kuvunja chini katika tabaka mbalimbali, 47 00:02:54,380 --> 00:02:59,010 tu kama ungependa kufanya kwenye kompyuta desktop, 48 00:02:59,010 --> 00:03:02,860 na unafikiri kuhusu tabaka mbalimbali, programu, mfumo wa uendeshaji, 49 00:03:02,860 --> 00:03:07,730 mtandao safu, vifaa safu, na bila shaka, kuna udhaifu juu ya tabaka hizo zote. 50 00:03:07,730 --> 00:03:10,510 >> Kitu kimoja kinachotokea kwenye simu. 51 00:03:10,510 --> 00:03:14,880 Lakini za Mkono, inaonekana kwamba baadhi ya tabaka hizo ni mbaya zaidi. 52 00:03:14,880 --> 00:03:19,840 Kwa moja, tabaka la mtandao ni zaidi matatizo kwenye simu 53 00:03:19,840 --> 00:03:25,650 kwa sababu mengi ya watu katika ofisi zao au nyumbani 54 00:03:25,650 --> 00:03:30,780 wired uhusiano au wao kuwa salama uhusiano Wi-Fi, 55 00:03:30,780 --> 00:03:36,530 na na mengi ya vifaa vya mkononi uko wazi nje ya nyumba 56 00:03:36,530 --> 00:03:40,520 au nje ya ofisi mengi, na kama wewe ni kutumia Wi-Fi huko 57 00:03:40,520 --> 00:03:42,820 unaweza kutumia uhaba wa Wi-Fi uhusiano, 58 00:03:42,820 --> 00:03:45,570 kitu ambacho ni umma uhusiano Wi-Fi, 59 00:03:45,570 --> 00:03:48,840 hivyo wakati sisi kufikiri kuhusu programu za Mkono tuna kuzingatia 60 00:03:48,840 --> 00:03:53,770 kwamba mazingira ya mtandao ni riskier kwa maombi hayo 61 00:03:53,770 --> 00:03:57,640 wakati Wi-Fi ni kuwa kutumika. 62 00:03:57,640 --> 00:04:02,410 Na wakati mimi kupata ndani ya zaidi ya hatari maombi ya simu 63 00:04:02,410 --> 00:04:04,910 utaona nini kuwa muhimu zaidi. 64 00:04:04,910 --> 00:04:09,710 Kuna hatari katika ngazi ya vifaa kwenye vyombo vya muziki. 65 00:04:09,710 --> 00:04:11,670 Hii ni eneo la utafiti unaoendelea. 66 00:04:11,670 --> 00:04:15,910 Watu kuwaita mashambulizi hayo broadband au mashambulizi ya baseband 67 00:04:15,910 --> 00:04:21,870 ambapo wewe ni kushambulia firmware hiyo kusikiliza kwenye redio. 68 00:04:21,870 --> 00:04:25,430 >> Haya ni kweli mashambulizi inatisha kwa sababu 69 00:04:25,430 --> 00:04:27,280 user hana kufanya kitu chochote. 70 00:04:27,280 --> 00:04:30,760 Unaweza hit kura ya vifaa ndani ya RF mbalimbali 71 00:04:30,760 --> 00:04:36,690 mara moja, na inaonekana kama wakati wowote utafiti huu Bubbles up 72 00:04:36,690 --> 00:04:40,750 haraka anapata kundi la ambapo 73 00:04:40,750 --> 00:04:46,600 watu akishuka katika karibu na kusema, "Hapa, kutuambia kuhusu hilo, na tafadhali kuacha kuzungumza kuhusu suala hilo." 74 00:04:46,600 --> 00:04:49,460 Kuna baadhi ya utafiti kinachoendelea katika eneo broadband ni, 75 00:04:49,460 --> 00:04:51,980 lakini inaonekana kuwa hush hush sana. 76 00:04:51,980 --> 00:04:56,910 Nadhani ni zaidi ya aina hali taifa ya utafiti kwamba kinaendelea. 77 00:04:56,910 --> 00:05:02,140 eneo la utafiti wa kazi, ingawa, ni mfumo wa uendeshaji safu, 78 00:05:02,140 --> 00:05:08,910 na tena, hii ni tofauti na katika kompyuta desktop dunia 79 00:05:08,910 --> 00:05:14,840 kwa sababu katika nafasi ya simu una timu hizi la watu walioitwa jailbreakers, 80 00:05:14,840 --> 00:05:18,670 na jailbreakers ni tofauti na watafiti mara kwa mara mazingira magumu. 81 00:05:18,670 --> 00:05:21,970 Wao ni kujaribu kupata udhaifu katika mfumo wa uendeshaji, 82 00:05:21,970 --> 00:05:27,000 lakini sababu wao ni kujaribu kupata udhaifu ni si kwa 83 00:05:27,000 --> 00:05:31,810 kuvunja ndani ya mashine ya mtu mwingine na maelewano yake. 84 00:05:31,810 --> 00:05:34,280 Ni kwa kuvunja ndani ya kompyuta yake mwenyewe. 85 00:05:34,280 --> 00:05:38,820 >> Wanataka kuvunja ndani ya muziki wao wenyewe, kurekebisha mfumo wa simu zao wa uendeshaji 86 00:05:38,820 --> 00:05:41,050 ili waweze kuendesha maombi ya uchaguzi wao 87 00:05:41,050 --> 00:05:44,510 na kubadili mambo kwa ruhusa kamili ya utawala, 88 00:05:44,510 --> 00:05:49,050 na hawataki kuwaambia muuzaji kuhusu hili. 89 00:05:49,050 --> 00:05:52,960 Siyo kama mtafiti usalama ambayo ni nyeupe mtafiti kofia ya usalama 90 00:05:52,960 --> 00:05:56,600 ambayo ni kwenda kufanya kutoa taarifa kuwajibika na kuwaambia muuzaji kuhusu hilo. 91 00:05:56,600 --> 00:06:01,270 Wao wanataka kufanya utafiti huu, na wanataka kweli kuchapisha 92 00:06:01,270 --> 00:06:06,400 katika kutumia au rootkit au mapumziko ya gerezani code, 93 00:06:06,400 --> 00:06:10,010 na wanataka kufanya hivyo kimkakati, kama haki baada ya 94 00:06:10,010 --> 00:06:13,570 meli muuzaji mpya mfumo wa uendeshaji. 95 00:06:13,570 --> 00:06:16,350 Una uhusiano huu ushindani 96 00:06:16,350 --> 00:06:19,000 na udhaifu OS ngazi ya juu ya muziki, 97 00:06:19,000 --> 00:06:23,150 ambayo nadhani ni ya kuvutia kabisa, na sehemu moja tunaona 98 00:06:23,150 --> 00:06:29,210 ni inafanya hivyo kwamba kuna nzuri kuchapishwa kutumia code huko nje 99 00:06:29,210 --> 00:06:31,750 kwa udhaifu kernel ngazi ya juu, 100 00:06:31,750 --> 00:06:35,040 na tumeona wale kweli kutumika na waandishi wa zisizo. 101 00:06:35,040 --> 00:06:38,450 Ni kidogo tofauti na PC dunia. 102 00:06:38,450 --> 00:06:42,530 Na kisha Safu ya mwisho ni safu ya juu, safu ya maombi. 103 00:06:42,530 --> 00:06:45,250 Hiyo ni nini mimi nina kwenda kuzungumza juu ya leo. 104 00:06:45,250 --> 00:06:48,970 >> Tabaka nyingine zipo, na tabaka nyingine kucheza ndani yake, 105 00:06:48,970 --> 00:06:53,310 lakini mimi nina zaidi kwenda kuzungumza kuhusu nini kinaendelea katika safu ya maombi 106 00:06:53,310 --> 00:06:55,560 ambapo code ni mbio katika sandbox. 107 00:06:55,560 --> 00:06:58,670 Ni hana haki ya kiutawala. 108 00:06:58,670 --> 00:07:02,170 Ina kutumia APIs ya kifaa, 109 00:07:02,170 --> 00:07:06,970 lakini bado, shughuli nyingi za malicious na mengi ya hatari yanaweza kutokea katika safu ya kwamba 110 00:07:06,970 --> 00:07:09,220 kwa sababu hiyo safu ambapo taarifa zote ni. 111 00:07:09,220 --> 00:07:12,330 Programu wanaweza kupata habari zote kwenye kifaa 112 00:07:12,330 --> 00:07:15,390 kama wana ruhusa ya haki, 113 00:07:15,390 --> 00:07:17,540 na wanaweza kupata kwenye vihisi tofauti juu ya kifaa, 114 00:07:17,540 --> 00:07:23,950 Sensor GPS, kipaza sauti, kamera, kitu gani wewe. 115 00:07:23,950 --> 00:07:27,380 Hata ingawa sisi ni tu kuzungumza juu ya katika safu ya maombi 116 00:07:27,380 --> 00:07:33,700 tuna mengi ya hatari huko. 117 00:07:33,700 --> 00:07:38,450 kitu ambacho ni tofauti kuhusu mazingira ya simu 118 00:07:38,450 --> 00:07:45,060 ni wachezaji wote mfumo wa uendeshaji, kuwa ni Blackberry au Android 119 00:07:45,060 --> 00:07:53,410 au iOS au Windows Mkono, wote wana faini grained ruhusa mfano, 120 00:07:53,410 --> 00:07:56,990 na hii ni moja ya njia ambazo kujengwa katika mfumo wa uendeshaji 121 00:07:56,990 --> 00:08:01,230 wazo kwamba si kama hatari kama unafikiri. 122 00:08:01,230 --> 00:08:04,550 Hata kama wewe na mawasiliano yako yote juu ya huko, habari binafsi yako yote, 123 00:08:04,550 --> 00:08:09,080 una picha yako, una eneo lako juu ya huko, 124 00:08:09,080 --> 00:08:14,820 wewe ni hifadhi ya benki siri yako kwa auto kuingia huko, ni salama kwa sababu 125 00:08:14,820 --> 00:08:19,430 programu kuwa na ruhusa baadhi ya kupata katika baadhi ya maeneo 126 00:08:19,430 --> 00:08:25,080 wa habari juu ya kifaa, na user ina kuwasilishwa kwa 127 00:08:25,080 --> 00:08:29,230 ruhusa hizi na kusema sawa. 128 00:08:29,230 --> 00:08:32,590 >> Tatizo na hilo ni user daima anasema sawa. 129 00:08:32,590 --> 00:08:35,240 Kama mtu usalama, najua unaweza kuchochea user, 130 00:08:35,240 --> 00:08:40,100 kusema kitu mbaya kweli kweli kinaenda kutokea, je, unataka kutokea? 131 00:08:40,100 --> 00:08:44,680 Na kama uko katika kukimbilia au kuna kitu kweli Huwaongoza upande wa pili wa kwamba, 132 00:08:44,680 --> 00:08:47,760 kama mchezo ni kwenda kuwa imewekwa kwamba wao tumekuwa kusubiri, 133 00:08:47,760 --> 00:08:50,860 wao wanaenda bonyeza sawa. 134 00:08:50,860 --> 00:08:56,630 Hiyo ndiyo maana Mimi kusema juu ya slide yangu hapa tu basi mimi Fling ndege katika nguruwe tayari, 135 00:08:56,630 --> 00:09:03,150 na unaweza kuona kwenye slide hapa kuna mifano ya BlackBerry sanduku ruhusa. 136 00:09:03,150 --> 00:09:05,990 Ni anasema "Tafadhali kuweka BlackBerry Travel maombi ruhusa 137 00:09:05,990 --> 00:09:09,720 baada ya kubonyeza kifungo chini, "na kimsingi user ni kwenda tu kusema 138 00:09:09,720 --> 00:09:12,240 kuweka ruhusa na kuokoa. 139 00:09:12,240 --> 00:09:18,010 Hapa ni haraka Android ambapo inaonyesha mambo, 140 00:09:18,010 --> 00:09:20,260 na ni kweli unaweka kitu ambacho karibu inaonekana kama onyo. 141 00:09:20,260 --> 00:09:25,090 Ni got aina ya mavuno ishara huko akisema mtandao wa mawasiliano, simu, 142 00:09:25,090 --> 00:09:28,120 lakini user ni kwenda bonyeza kufunga, sawa? 143 00:09:28,120 --> 00:09:32,940 Na kisha moja Apple ni innocuous kabisa. 144 00:09:32,940 --> 00:09:34,300 Haina kutoa aina yoyote ya onyo. 145 00:09:34,300 --> 00:09:37,380 Ni tu Apple wangependa kutumia eneo yako ya sasa. 146 00:09:37,380 --> 00:09:39,670 Bila shaka ni kwenda bonyeza sawa. 147 00:09:39,670 --> 00:09:42,260 >> Kuna hii faini-grained ruhusa mfano, 148 00:09:42,260 --> 00:09:45,890 na programu kuwa na faili wazi ambapo wao kutangaza 149 00:09:45,890 --> 00:09:49,410 ruhusa wanahitaji, na kwamba kupata kuonyeshwa kwa mtumiaji, 150 00:09:49,410 --> 00:09:53,480 na mtumiaji na kusema mimi ruzuku ruhusa hizi. 151 00:09:53,480 --> 00:09:55,080 Lakini hebu kuwa waaminifu. 152 00:09:55,080 --> 00:09:58,400 Watumiaji ni kwenda tu siku zote kusema sawa. 153 00:09:58,400 --> 00:10:04,460 Hebu tuangalie kwa haraka katika ruhusa kwamba programu hizi ni kuuliza kwa 154 00:10:04,460 --> 00:10:06,850 na baadhi ya ruhusa kwamba ni huko. 155 00:10:06,850 --> 00:10:09,950 Kampuni hii Ikulu alifanya utafiti mwaka jana 156 00:10:09,950 --> 00:10:14,170 ya 53,000 maombi kuchambuliwa katika Android soko na chama 3 masoko, 157 00:10:14,170 --> 00:10:16,770 hivyo hii yote ni Android. 158 00:10:16,770 --> 00:10:19,670 Na programu wastani ombi 3 ruhusa. 159 00:10:19,670 --> 00:10:23,370 Baadhi ya programu ombi 117 ruhusa, 160 00:10:23,370 --> 00:10:27,480 hivyo ni wazi haya ni nzuri sana grained na njia ngumu sana kwa mtumiaji kuelewa 161 00:10:27,480 --> 00:10:31,600 kama wao ni iliyotolewa na programu hii kwamba mahitaji ya ruhusa hizi 117. 162 00:10:31,600 --> 00:10:37,270 Ni kama mtumiaji wa mwisho leseni ya makubaliano kwamba kurasa 45 kwa muda mrefu. 163 00:10:37,270 --> 00:10:40,240 Labda haraka itabidi chaguo ambapo ni kama 164 00:10:40,240 --> 00:10:43,100 magazeti ruhusa na kutuma barua pepe yangu. 165 00:10:43,100 --> 00:10:45,480 >> Lakini kama wewe kuangalia katika baadhi ya juu ruhusa ya kuvutia 166 00:10:45,480 --> 00:10:50,840 24% ya programu kwamba kupakuliwa nje ya 53,000 167 00:10:50,840 --> 00:10:57,230 aliomba taarifa GPS kutoka kifaa. 168 00:10:57,230 --> 00:10:59,810 8% kusoma mawasiliano. 169 00:10:59,810 --> 00:11:03,770 4% alimtuma SMS, na 3% kupokea SMS. 170 00:11:03,770 --> 00:11:07,730 2% kumbukumbu ya redio. 171 00:11:07,730 --> 00:11:11,210 1% kusindika simu zinazotoka nje. 172 00:11:11,210 --> 00:11:13,140 Mimi sijui. 173 00:11:13,140 --> 00:11:17,520 Sidhani 4% ya programu katika duka programu kweli wanahitaji kutuma ujumbe wa maandishi SMS, 174 00:11:17,520 --> 00:11:21,410 hivyo nadhani kwamba ladha kwamba kitu kiovu kinachoendelea. 175 00:11:21,410 --> 00:11:24,350 8% ya programu haja ya kusoma mawasiliano orodha yako. 176 00:11:24,350 --> 00:11:26,510 Ni pengine si muhimu. 177 00:11:26,510 --> 00:11:30,990 Moja ya mambo mengine ya kuvutia kuhusu ruhusa ni 178 00:11:30,990 --> 00:11:36,740 kama kiungo katika maktaba pamoja ndani ya maombi yako 179 00:11:36,740 --> 00:11:39,780 wale kurithi ruhusa ya maombi, 180 00:11:39,780 --> 00:11:46,570 hivyo kama programu mahitaji yako kuwasiliana na orodha au mahitaji GPS eneo kwa kazi 181 00:11:46,570 --> 00:11:49,940 na kiungo katika maktaba ya matangazo, kwa mfano, 182 00:11:49,940 --> 00:11:53,170 maktaba ad pia kuwa na uwezo wa kupata mawasiliano 183 00:11:53,170 --> 00:11:57,630 na pia kuwa na uwezo wa kupata GPS eneo, 184 00:11:57,630 --> 00:12:01,990 na developer ya programu hajui chochote kuhusu kificho kwamba mbio katika maktaba ad. 185 00:12:01,990 --> 00:12:05,370 Wao ni kuunganisha tu kwamba kwa sababu wanataka Faidisha programu zao. 186 00:12:05,370 --> 00:12:09,820 >> Hii ni pale ambapo-na mimi itabidi kuzungumza kuhusu baadhi ya mifano ya hili na 187 00:12:09,820 --> 00:12:13,930 maombi ya kuitwa Pandora ambapo developer maombi 188 00:12:13,930 --> 00:12:18,910 wanaweza pasipo kujua kuwa kinachovuja habari 189 00:12:18,910 --> 00:12:24,580 kutoka kwa watumiaji yao kwa sababu ya maktaba wameweza wanaohusishwa in 190 00:12:24,580 --> 00:12:30,110 Upimaji mazingira huko nje, kuangalia programu mbalimbali 191 00:12:30,110 --> 00:12:34,310 kwamba imeripotiwa katika habari kama watumiaji malicious au kufanya kitu hakutaka 192 00:12:34,310 --> 00:12:39,360 na kisha ukaguzi mengi ya programu-sisi kufanya mengi ya tuli uchambuzi binary juu ya programu za Mkono, 193 00:12:39,360 --> 00:12:42,010 hivyo tumekuwa kukaguliwa yao na inaonekana katika kanuni yenyewe- 194 00:12:42,010 --> 00:12:49,640 sisi kuja na kile tunachokiita 10 wetu juu orodha ya tabia za hatari katika maombi. 195 00:12:49,640 --> 00:12:54,180 Na ni chini katika sehemu 2, kanuni malicious, 196 00:12:54,180 --> 00:12:57,600 hivyo ni mambo mabaya programu wanaweza kuwa kufanya hivyo 197 00:12:57,600 --> 00:13:06,520 ni uwezekano wa kuwa na kitu ambacho malicious ya mtu binafsi 198 00:13:06,520 --> 00:13:10,060 ina hasa kuweka katika maombi, lakini ni kidogo fuzzy. 199 00:13:10,060 --> 00:13:13,300 Ni inaweza kuwa kitu ambacho developer anadhani ni mzuri, 200 00:13:13,300 --> 00:13:16,350 lakini mwisho juu kuwa mawazo ya kama malicious kwa mtumiaji. 201 00:13:16,350 --> 00:13:19,830 >> Na kisha sehemu ya pili ni kile tunachokiita coding udhaifu, 202 00:13:19,830 --> 00:13:24,600 na haya ni mambo ambapo developer kimsingi ni kufanya makosa 203 00:13:24,600 --> 00:13:27,200 au tu haelewi jinsi ya kuandika programu salama, 204 00:13:27,200 --> 00:13:30,260  na hiyo ni kuweka programu user katika hatari. 205 00:13:30,260 --> 00:13:34,060 Mimi nina kwenda kwa njia hizi kwa undani na kutoa baadhi ya mifano. 206 00:13:34,060 --> 00:13:39,620 Kwa ajili ya kumbukumbu, nilitaka kuweka OWASP Mkono orodha ya juu 10. 207 00:13:39,620 --> 00:13:43,590 Haya ni masuala 10 kwamba kundi katika OWASP, 208 00:13:43,590 --> 00:13:48,900 Mradi Open Mtandao Maombi Usalama, wana kikundi kazi 209 00:13:48,900 --> 00:13:50,620 kufanya kazi kwenye simu orodha ya juu 10. 210 00:13:50,620 --> 00:13:54,600 Wao na maarufu sana mtandao orodha ya juu 10, ambayo ni ya juu 10 211 00:13:54,600 --> 00:13:57,180 mambo hatari zaidi unaweza kuwa katika maombi ya mtandao. 212 00:13:57,180 --> 00:13:59,090 Wao ni kufanya kitu kimoja kwa ajili ya simu, 213 00:13:59,090 --> 00:14:01,750 na orodha yao ni tofauti kidogo kuliko yetu. 214 00:14:01,750 --> 00:14:03,670 6 kati ya 10 ni sawa. 215 00:14:03,670 --> 00:14:06,020 Wana 4 ambayo ni tofauti. 216 00:14:06,020 --> 00:14:10,550 Nadhani kidogo ya kuchukua mbalimbali juu ya 217 00:14:10,550 --> 00:14:14,490 hatari katika programu ya simu ambapo mengi ya masuala yao 218 00:14:14,490 --> 00:14:20,490 ni kweli jinsi maombi ni kuwasiliana na nyuma-mwisho server 219 00:14:20,490 --> 00:14:23,100 au nini kinaendelea juu ya nyuma-mwisho server, 220 00:14:23,100 --> 00:14:29,220 programu si kiasi kwamba kuwa na tabia hatari kwamba ni programu ya mteja tu moja kwa moja. 221 00:14:29,220 --> 00:14:36,640 >> Wale walio katika nyekundu hapa ni tofauti kati ya orodha 2. 222 00:14:36,640 --> 00:14:40,740 Na baadhi ya utafiti timu yangu ina kweli imechangia mradi huu, 223 00:14:40,740 --> 00:14:44,570 hivyo tutaweza kuona nini kinatokea baada ya muda, lakini nadhani takeaway hapa ni 224 00:14:44,570 --> 00:14:47,550 sisi si kweli kujua nini orodha ya juu 10 ni katika programu ya simu kwa sababu 225 00:14:47,550 --> 00:14:50,510 wameweza kweli tu kuwa karibu kwa miaka 2 au 3 sasa, 226 00:14:50,510 --> 00:14:57,750 na hakujawa na muda wa kutosha kwa kweli utafiti mifumo ya uendeshaji 227 00:14:57,750 --> 00:15:00,450 na nini wao ni uwezo wa, na hakujawa na muda wa kutosha 228 00:15:00,450 --> 00:15:06,870 kwa malicious jamii, kama wewe, kwa kuwa alitumia muda wa kutosha 229 00:15:06,870 --> 00:15:12,910 kujaribu kushambulia watumiaji wa njia programu za Mkono, hivyo natarajia orodha hizi kubadili kidogo. 230 00:15:12,910 --> 00:15:18,720 Lakini kwa sasa, haya ni mambo ya juu 10 na wasiwasi juu. 231 00:15:18,720 --> 00:15:24,150 Unaweza usiamini upande wa simu ambapo gani malicious Mkono code- 232 00:15:24,150 --> 00:15:28,880 jinsi gani kupata kwenye kifaa? 233 00:15:28,880 --> 00:15:35,210 North Carolina Serikali ina mradi inayoitwa Simu ya Mkono Malware Genome Project 234 00:15:35,210 --> 00:15:39,520 ambapo wao ni kukusanya kama vile ya simu zisizo kama wanaweza na kuchambua yake, 235 00:15:39,520 --> 00:15:45,270 na wameweza chini wadudu sindano kwamba zisizo za Mkono matumizi, 236 00:15:45,270 --> 00:15:51,490 na 86% kutumia mbinu inayoitwa kuandaa, 237 00:15:51,490 --> 00:15:54,160 na hii ni kwenye jukwaa Android 238 00:15:54,160 --> 00:15:56,720 unaweza kweli kufanya kuandaa hii. 239 00:15:56,720 --> 00:16:03,100 >> Sababu ni Android code ni kujengwa kwa 240 00:16:03,100 --> 00:16:08,130 Java byte code aitwaye Dalvik ambayo ni rahisi decompilable. 241 00:16:08,130 --> 00:16:12,460 Nini guy mbaya unaweza kufanya ni 242 00:16:12,460 --> 00:16:16,590 kuchukua maombi Android, decompile yake, 243 00:16:16,590 --> 00:16:20,120 kuingiza kanuni zao malicious, recompile yake, 244 00:16:20,120 --> 00:16:28,070 na kisha kuiweka juu katika programu ya kuhifadhi inayosemekana kuwa toleo jipya la maombi kwamba, 245 00:16:28,070 --> 00:16:30,330 au tu labda kubadilisha jina la maombi. 246 00:16:30,330 --> 00:16:35,140 Kama ni aina fulani ya mchezo, mabadiliko ya jina kidogo, 247 00:16:35,140 --> 00:16:42,860 na hivyo kuandaa hii ni jinsi gani 86% ya Mkono zisizo anapata kusambazwa. 248 00:16:42,860 --> 00:16:45,810 Kuna mwingine mbinu ya kuitwa update ambayo ni 249 00:16:45,810 --> 00:16:50,030 sawa na kuandaa, lakini kwa kweli si kuweka code malicious in 250 00:16:50,030 --> 00:16:52,870 Nini kufanya ni kuweka katika utaratibu ndogo update. 251 00:16:52,870 --> 00:16:56,660 Wewe decompile, kuweka katika utaratibu update, na recompile yake, 252 00:16:56,660 --> 00:17:02,360 na kisha wakati programu ni mbio pulls chini zisizo kwenye kifaa. 253 00:17:02,360 --> 00:17:06,300 >> By mbali wengi ni wale mbinu 2. 254 00:17:06,300 --> 00:17:12,710 Kuna si kweli sana shusha gari-bys au gari-na downloads juu ya simu za mkononi, 255 00:17:12,710 --> 00:17:15,890 ambayo inaweza kuwa kama shambulio la hadaa. 256 00:17:15,890 --> 00:17:18,200 Hey, angalia tovuti hii kweli baridi, 257 00:17:18,200 --> 00:17:21,020 au unahitaji kwenda tovuti hii na kujaza fomu hii 258 00:17:21,020 --> 00:17:24,420 kuweka kuendelea kufanya kitu fulani. 259 00:17:24,420 --> 00:17:26,230 Hizo ni wizi mashambulizi. 260 00:17:26,230 --> 00:17:28,160 Jambo huo unaweza kutokea kwenye jukwaa simu ambapo wao 261 00:17:28,160 --> 00:17:33,830 uhakika na programu ya simu shusha, kusema "Hi, hii ni Benki Kuu ya Marekani." 262 00:17:33,830 --> 00:17:36,070 "Tunaona wewe ni kutumia programu hii." 263 00:17:36,070 --> 00:17:38,540 "Ni lazima kushusha maombi haya mengine." 264 00:17:38,540 --> 00:17:41,170 Kinadharia, kwamba anaweza kufanya kazi. 265 00:17:41,170 --> 00:17:48,610 Labda tu si kutumika kutosha kuamua kama ni mafanikio au la, 266 00:17:48,610 --> 00:17:51,680 lakini waligundua kuwa chini ya 1% ya muda mbinu ambayo ni kutumika. 267 00:17:51,680 --> 00:17:56,130 wengi wa wakati ni kweli code repackaged. 268 00:17:56,130 --> 00:17:58,710 >> Kuna mwingine jamii aitwaye ilio 269 00:17:58,710 --> 00:18:01,420 ambapo mtu tu hujenga maombi brand-mpya. 270 00:18:01,420 --> 00:18:04,020 Wao kujenga maombi kwamba purports kuwa kitu. 271 00:18:04,020 --> 00:18:07,360 Siyo kuandaa ya kitu kingine, na kwamba ina code mbaya. 272 00:18:07,360 --> 00:18:11,230 Hiyo kutumika 14% ya muda. 273 00:18:11,230 --> 00:18:17,880 Sasa nataka kuzungumza juu ya kile code malicious kufanya? 274 00:18:17,880 --> 00:18:23,070 Moja ya zisizo kwanza huko nje 275 00:18:23,070 --> 00:18:25,490 unaweza kufikiria spyware. 276 00:18:25,490 --> 00:18:27,620 Ni kimsingi wapelelezi mtumiaji. 277 00:18:27,620 --> 00:18:30,470 Ni kukusanya barua pepe, ujumbe wa SMS. 278 00:18:30,470 --> 00:18:32,340 Ni zamu ya kipaza sauti. 279 00:18:32,340 --> 00:18:37,330 Ni mavuno kitabu mawasiliano, na inapeleka ni mbali na mtu mwingine. 280 00:18:37,330 --> 00:18:40,870 Aina hii ya spyware lipo kwenye PC, 281 00:18:40,870 --> 00:18:46,200 hivyo inafanya hisia kamili kwa ajili ya watu kujaribu kufanya hivyo kwenye vyombo vya muziki. 282 00:18:46,200 --> 00:18:53,230 >> Moja ya mifano ya kwanza ya hii ilikuwa mpango ujulikanao siri SMS Replicator. 283 00:18:53,230 --> 00:18:56,250 Ilikuwa ni katika Android Marketplace miaka michache iliyopita, 284 00:18:56,250 --> 00:18:59,960 na wazo ni kama alikuwa na upatikanaji wa mtu Android simu 285 00:18:59,960 --> 00:19:03,450 kwamba alitaka kupeleleza, hivyo labda ni mke wako 286 00:19:03,450 --> 00:19:07,600 yako au nyingine muhimu na unataka kupeleleza juu ya ujumbe wa maandishi yao, 287 00:19:07,600 --> 00:19:11,200 unaweza kushusha programu hii na kufunga na configure 288 00:19:11,200 --> 00:19:16,540 kutuma SMS ujumbe wa maandishi na wewe na nakala 289 00:19:16,540 --> 00:19:21,710 ya kila ujumbe wa SMS got. 290 00:19:21,710 --> 00:19:27,220 Hii ni wazi ni katika ukiukaji wa programu ya kuhifadhi suala la huduma, 291 00:19:27,220 --> 00:19:32,040 na hii ilikuwa kuondolewa kutoka Android Marketplace ndani ya masaa 18 ya kuwa ni huko, 292 00:19:32,040 --> 00:19:36,760 hivyo idadi ndogo sana ya watu walikuwa katika hatari kwa sababu ya hili. 293 00:19:36,760 --> 00:19:42,510 Sasa, nadhani kama mpango aliitwa kitu labda kidogo kidogo provocative 294 00:19:42,510 --> 00:19:48,690 kama siri SMS Replicator pengine ingekuwa kazi mengi zaidi. 295 00:19:48,690 --> 00:19:52,870 Lakini ilikuwa ni aina ya wazi. 296 00:19:52,870 --> 00:19:58,680 >> Moja ya mambo tunaweza kufanya ili kuamua kama programu na tabia hii kwamba hatutaki 297 00:19:58,680 --> 00:20:01,410 ni kukagua code. 298 00:20:01,410 --> 00:20:06,250 Hii ni kweli kwa kweli ni rahisi kufanya juu ya Android kwa sababu tunaweza decompile programu. 299 00:20:06,250 --> 00:20:11,050 On iOS unaweza kutumia disassembler kama IDA Pro 300 00:20:11,050 --> 00:20:17,190 kuangalia nini Apis programu ni wito na nini ni kufanya. 301 00:20:17,190 --> 00:20:20,680 Tuliandika binary yetu wenyewe tuli analyzer kwa kanuni zetu 302 00:20:20,680 --> 00:20:24,940 na sisi kufanya hivyo, na hivyo nini unaweza kufanya ni unaweza kusema 303 00:20:24,940 --> 00:20:30,490 haina kifaa kufanya chochote ambacho kimsingi ni upelelezi juu yangu au kufuatilia mimi? 304 00:20:30,490 --> 00:20:33,360 Na mimi na baadhi ya mifano hapa juu ya iPhone. 305 00:20:33,360 --> 00:20:41,440 Mfano huu kwanza ni jinsi ya kupata UUID kwenye simu. 306 00:20:41,440 --> 00:20:47,060 Hii ni kweli kitu ambacho Apple ana haki ya marufuku kwa maombi mapya, 307 00:20:47,060 --> 00:20:52,540 lakini maombi ya zamani ambayo unaweza kuwa mbio kwenye simu yako bado wanaweza kufanya hivyo, 308 00:20:52,540 --> 00:20:56,500 na ili kitambulisho kipekee inaweza kutumika kwa kufuatilia wewe 309 00:20:56,500 --> 00:21:00,440 katika matumizi mbalimbali. 310 00:21:00,440 --> 00:21:07,180 >> On Android, nina mfano hapa ya kupata eneo ya kifaa hiki. 311 00:21:07,180 --> 00:21:10,310 Unaweza kuona kwamba kama wito API ni huko programu kwamba ni kufuatilia, 312 00:21:10,310 --> 00:21:15,000 na unaweza kuona kama ni kupata eneo faini au eneo coarse. 313 00:21:15,000 --> 00:21:18,860 Na kisha juu ya chini hapa, nina mfano wa jinsi ya BlackBerry 314 00:21:18,860 --> 00:21:25,130 maombi wanaweza kupata ujumbe wa barua pepe katika Inbox yako. 315 00:21:25,130 --> 00:21:27,660 Hizi ni aina ya mambo unaweza kukagua kuona 316 00:21:27,660 --> 00:21:32,360 kama programu ni kufanya mambo hayo. 317 00:21:32,360 --> 00:21:38,320 pili kubwa ya jamii ya tabia malicious, na hii pengine ni jamii kubwa sasa, 318 00:21:38,320 --> 00:21:43,950 ni haraka ruhusa, premium ruhusa ujumbe wa SMS Nakala 319 00:21:43,950 --> 00:21:46,080 au malipo ya ruhusa. 320 00:21:46,080 --> 00:21:48,930 Kitu kingine kwamba kipekee kuhusu simu 321 00:21:48,930 --> 00:21:52,700 ni kifaa ni kitanzi kwa akaunti ya bili, 322 00:21:52,700 --> 00:21:55,960 na wakati shughuli kutokea kwenye simu 323 00:21:55,960 --> 00:21:58,510 inaweza kujenga mashtaka. 324 00:21:58,510 --> 00:22:00,700 Unaweza kununua vitu juu ya simu, 325 00:22:00,700 --> 00:22:04,390 na wakati kutuma ujumbe premium SMS wewe ni kweli kutoa fedha 326 00:22:04,390 --> 00:22:11,590 kwa mwenye akaunti ya namba ya simu juu ya upande mwingine. 327 00:22:11,590 --> 00:22:17,420 Haya yaliwekwa juu ya kupata quotes hisa au kupata horoscope yako ya kila siku au mambo mengine, 328 00:22:17,420 --> 00:22:21,680 lakini wao inaweza kuweka juu ili bidhaa kwa kutuma ujumbe SMS. 329 00:22:21,680 --> 00:22:26,970 Watu kutoa fedha kwa Shirika la Msalaba Mwekundu kwa kutuma ujumbe wa maandishi. 330 00:22:26,970 --> 00:22:30,650 Unaweza kutoa $ 10 kwa njia hiyo. 331 00:22:30,650 --> 00:22:34,190 >> Washambuliaji, nini tumefanya ni wao kuanzisha 332 00:22:34,190 --> 00:22:38,750 akaunti katika nchi za nje, na wao kuiweka katika zisizo 333 00:22:38,750 --> 00:22:42,840 kwamba simu kutuma ujumbe wa maandishi premium SMS, 334 00:22:42,840 --> 00:22:47,700 kusema, mara chache kwa siku, na mwishoni mwa mwezi wewe kutambua ve alitumia 335 00:22:47,700 --> 00:22:52,090 mamia au labda hata mamia ya dola, na wao kutembea mbali na fedha. 336 00:22:52,090 --> 00:22:57,280 Hii got hivyo mbaya kwamba hii ilikuwa jambo la kwanza Android 337 00:22:57,280 --> 00:23:00,760 Soko au Google mahali-ni Android Marketplace wakati huo, 338 00:23:00,760 --> 00:23:04,430 na ni sasa Google kucheza-Jambo la kwanza kwamba Google kuanza kuangalia kwa. 339 00:23:04,430 --> 00:23:08,700 Wakati Google kuanza kusambaza programu Android katika programu kuhifadhi zao 340 00:23:08,700 --> 00:23:11,350 walisema walikuwa si kwenda kuangalia kwa kitu chochote. 341 00:23:11,350 --> 00:23:15,630 Tutaweza kuvuta programu mara moja tumekuwa taarifa wameweza kuvunjwa masharti yetu ya huduma, 342 00:23:15,630 --> 00:23:17,520 lakini sisi siyo kwenda kuangalia kwa kitu chochote. 343 00:23:17,520 --> 00:23:24,350 Naam, mwaka mmoja uliopita got mbaya na hii premium SMS ujumbe wa maandishi zisizo 344 00:23:24,350 --> 00:23:28,030 kwamba hii ni jambo la kwanza kabisa walianza kuangalia kwa. 345 00:23:28,030 --> 00:23:31,770 Kama programu inaweza kutuma ujumbe wa maandishi SMS 346 00:23:31,770 --> 00:23:34,750 wao zaidi manually se maombi kwamba. 347 00:23:34,750 --> 00:23:38,770 Wao kuangalia kwa APIs kwamba wito huu, 348 00:23:38,770 --> 00:23:40,580 na sasa tangu wakati huo Google ina wigo, 349 00:23:40,580 --> 00:23:46,900 lakini hii ilikuwa jambo la kwanza kwamba walianza kutafuta. 350 00:23:46,900 --> 00:23:50,690 >> Baadhi ya programu nyingine kwamba alifanya baadhi ujumbe wa maandishi SMS, 351 00:23:50,690 --> 00:23:56,980 hii Qicsomos Android, mimi nadhani ni kuitwa. 352 00:23:56,980 --> 00:24:02,670 Kulikuwa na tukio hili sasa juu ya simu ambapo hii CarrierIQ akatoka 353 00:24:02,670 --> 00:24:07,720 kama spyware kuweka kwenye kifaa na flygbolag, 354 00:24:07,720 --> 00:24:10,820 hivyo watu alitaka kujua kama simu zao mara katika mazingira magumu na hii, 355 00:24:10,820 --> 00:24:13,890 na hii ilikuwa programu ya bure kwamba majaribio hayo. 356 00:24:13,890 --> 00:24:17,520 Naam, bila shaka, nini programu hii alifanya alikuwa ni alimtuma premium SMS ujumbe wa maandishi, 357 00:24:17,520 --> 00:24:20,090 hivyo kwa kupima ili kuona kama wewe ni kuambukizwa na spyware 358 00:24:20,090 --> 00:24:24,930 ninyi kubeba zisizo kwenye kifaa chako. 359 00:24:24,930 --> 00:24:27,310 Tuliona kitu kimoja kutokea katika mwisho Super Bowl. 360 00:24:27,310 --> 00:24:33,180 Kulikuwa na toleo bogus ya Madden soka mchezo 361 00:24:33,180 --> 00:24:38,320 kwamba alimtuma premium SMS ujumbe wa maandishi. 362 00:24:38,320 --> 00:24:45,750 Ni kweli alijaribu kujenga mtandao bot pia kwenye kifaa. 363 00:24:45,750 --> 00:24:48,090 Hapa nina baadhi ya mifano. 364 00:24:48,090 --> 00:24:52,640 Inafurahisha kutosha, Apple alikuwa pretty smart, 365 00:24:52,640 --> 00:24:58,470 na hawana kuruhusu maombi ya kutuma ujumbe wa maandishi SMS wakati wote. 366 00:24:58,470 --> 00:25:00,350 Hakuna programu unaweza kufanya hivyo. 367 00:25:00,350 --> 00:25:03,530 Hiyo ndiyo njia kubwa ya kupata kuondoa tabaka zima la mazingira magumu, 368 00:25:03,530 --> 00:25:09,040 lakini juu ya Android unaweza kufanya hivyo, na bila shaka, juu ya BlackBerry unaweza kufanya hivyo pia. 369 00:25:09,040 --> 00:25:13,060 Ni jambo la kushangaza kwamba BlackBerry wote unahitaji ni ruhusa internet 370 00:25:13,060 --> 00:25:18,370 kutuma SMS ujumbe wa maandishi. 371 00:25:18,370 --> 00:25:21,580 >> Kitu kingine kweli kwamba sisi kuangalia kwa 372 00:25:21,580 --> 00:25:24,780 wakati sisi ni kuangalia kuona kama kitu fulani ni malicious ni tu aina yoyote ya 373 00:25:24,780 --> 00:25:28,100 shughuli ruhusa ya mtandao, kama kuangalia shughuli mtandao 374 00:25:28,100 --> 00:25:31,570 programu zinatakiwa kuwa na utendaji wake, 375 00:25:31,570 --> 00:25:35,380 na kuangalia shughuli hii nyingine mtandao. 376 00:25:35,380 --> 00:25:43,380 Labda programu, kufanya kazi, ina kupata data juu ya HTTP, 377 00:25:43,380 --> 00:25:47,500 lakini kama ni kufanya mambo juu ya barua pepe au SMS au Bluetooth au kitu kama hicho 378 00:25:47,500 --> 00:25:52,890 sasa programu ambayo inaweza uwezekano wa kuwa na malicious, hivyo hii ni kitu kingine unaweza kukagua kwa. 379 00:25:52,890 --> 00:26:00,430 Na juu ya hili slide hapa nina baadhi ya mifano ya hiyo. 380 00:26:00,430 --> 00:26:05,950 Jambo jingine kuvutia tuliona na zisizo kilitokea huko nyuma mwaka 2009, 381 00:26:05,950 --> 00:26:07,600 na ilivyotokea katika njia kubwa. 382 00:26:07,600 --> 00:26:11,390 Sijui kama kilichotokea sana tangu wakati huo, lakini ilikuwa ni programu 383 00:26:11,390 --> 00:26:15,140 kwamba impersonated programu nyingine. 384 00:26:15,140 --> 00:26:21,700 Kulikuwa na seti ya programu, na ilikuwa jina la 09Droid mashambulizi, 385 00:26:21,700 --> 00:26:29,770 na mtu aliamua kwamba kulikuwa na mengi ya ndogo, kikanda, benki midsize 386 00:26:29,770 --> 00:26:32,260 ambao hawakuwa na online maombi benki, 387 00:26:32,260 --> 00:26:36,870 hivyo walifanya nini mara wao kujengwa juu ya 50 online maombi ya benki 388 00:26:36,870 --> 00:26:39,410 kwamba wote walifanya mara kuchukua jina la mtumiaji na password 389 00:26:39,410 --> 00:26:42,190 na kuelekeza wewe tovuti. 390 00:26:42,190 --> 00:26:47,470 Na hivyo kuweka haya yote juu katika Google Marketplace, 391 00:26:47,470 --> 00:26:51,530 katika Android Marketplace, na wakati mtu searched ili kuona kama benki yao 392 00:26:51,530 --> 00:26:56,000 alikuwa maombi wangeweza kupata maombi bogus, 393 00:26:56,000 --> 00:27:01,230 ambayo zilizokusanywa sifa zao na kisha itaelekezwa yao kwa tovuti yao. 394 00:27:01,230 --> 00:27:06,640 njia ambayo hii kwa kweli akawa-programu walikuwa huko kwa wiki chache, 395 00:27:06,640 --> 00:27:09,050 na kulikuwa na maelfu na maelfu ya downloads. 396 00:27:09,050 --> 00:27:12,910 >> Njia hii alikuja mwanga alikuwa mtu alikuwa na tatizo 397 00:27:12,910 --> 00:27:15,740 na moja ya maombi, na wakamwita benki yao, 398 00:27:15,740 --> 00:27:18,390 na wakamwita msaada kwa wateja line benki yao, akasema, 399 00:27:18,390 --> 00:27:21,180 "Mimi kuwa na tatizo na maombi yako benki ya simu." 400 00:27:21,180 --> 00:27:23,460 "Je, unaweza kunisaidia nje?" 401 00:27:23,460 --> 00:27:26,540 Wakasema, "Hatuna maombi ya simu za kibenki." 402 00:27:26,540 --> 00:27:28,120 Ambayo ilianza uchunguzi. 403 00:27:28,120 --> 00:27:31,200 Benki kwamba wito Google, na kisha Google inaonekana na akasema, 404 00:27:31,200 --> 00:27:37,220 "Wow, mwandishi huyo ameandika maombi benki 50," na alichukua yao yote chini. 405 00:27:37,220 --> 00:27:43,410 Lakini kwa hakika hii inaweza kutokea tena. 406 00:27:43,410 --> 00:27:51,790 Kuna orodha ya benki zote mbalimbali hapa 407 00:27:51,790 --> 00:27:55,870 ambazo zilikuwa sehemu ya kashfa hii. 408 00:27:55,870 --> 00:28:02,050 Kitu kingine programu inaweza kufanya ni sasa UI ya programu nyingine. 409 00:28:02,050 --> 00:28:06,430 Wakati mbio inaweza pop up Facebook UI. 410 00:28:06,430 --> 00:28:09,540 Ni anasema una kuweka katika user name yako na password kuendelea 411 00:28:09,540 --> 00:28:15,090 au kuweka jina lolote user na password UI kwa ajili ya tovuti 412 00:28:15,090 --> 00:28:18,420 kwamba labda user inatumia tu kujaribu hila user 413 00:28:18,420 --> 00:28:21,340 ndani ya kuweka sifa zao in 414 00:28:21,340 --> 00:28:25,590 Hii ni kweli sambamba moja kwa moja ya mashambulizi ya email hadaa 415 00:28:25,590 --> 00:28:28,210 ambapo mtu anatuma ujumbe wa barua pepe 416 00:28:28,210 --> 00:28:33,050 na anatoa kimsingi UI bandia kwa ajili ya tovuti 417 00:28:33,050 --> 00:28:37,320 kwamba una kupata. 418 00:28:37,320 --> 00:28:41,590 >> Kitu kingine sisi kuangalia kwa katika kanuni malicious ni mfumo wa muundo. 419 00:28:41,590 --> 00:28:48,160 Unaweza kuangalia kwa wito wa kila API ambayo yanahitaji upendeleo mzizi 420 00:28:48,160 --> 00:28:50,870 kutekeleza kwa usahihi. 421 00:28:50,870 --> 00:28:56,160 Kubadilisha kifaa mtandao wa wakala itakuwa kitu kuwa maombi 422 00:28:56,160 --> 00:28:59,530 lazima kuwa na uwezo wa kufanya. 423 00:28:59,530 --> 00:29:03,030 Lakini kama maombi ina code huko kufanya hivyo 424 00:29:03,030 --> 00:29:05,960 unajua kwamba pengine ni maombi malicious 425 00:29:05,960 --> 00:29:09,620 au sana yenye uwezekano wa kuwa na maombi malicious, 426 00:29:09,620 --> 00:29:13,910 na hivyo gani kutokea ni kwamba programu ingekuwa baadhi ya njia ya kuongezeka kwa upendeleo. 427 00:29:13,910 --> 00:29:17,200 Ingekuwa baadhi kupanda upendeleo kutumia 428 00:29:17,200 --> 00:29:20,730 katika maombi, na kisha mara moja ilienea marupurupu 429 00:29:20,730 --> 00:29:23,800 ingekuwa kufanya mfumo wa marekebisho haya. 430 00:29:23,800 --> 00:29:28,010 Unaweza kupata zisizo kwamba ana haki kupanda 431 00:29:28,010 --> 00:29:32,550 katika hata bila kujua jinsi ya upendeleo kupanda 432 00:29:32,550 --> 00:29:37,960 kutumia kinaenda kutokea, na kwamba ni nzuri, njia rahisi 433 00:29:37,960 --> 00:29:41,220 kuangalia kwa zisizo. 434 00:29:41,220 --> 00:29:46,030 DroidDream labda kipande maarufu wa Android zisizo. 435 00:29:46,030 --> 00:29:50,530 Nadhani walioathirika wapatao 250,000 watumiaji zaidi ya siku chache 436 00:29:50,530 --> 00:29:52,810 kabla ya ilibainika. 437 00:29:52,810 --> 00:29:56,890 Wao repackaged 50 maombi bogus, 438 00:29:56,890 --> 00:30:00,370 kuziweka katika Android programu kuhifadhi, 439 00:30:00,370 --> 00:30:10,940 na kimsingi ni kutumika Android mapumziko ya gerezani code kuenea marupurupu 440 00:30:10,940 --> 00:30:16,380 na kisha kufunga amri na kudhibiti na kugeuka waathirika wote 441 00:30:16,380 --> 00:30:20,690 ndani ya bot wavu, lakini unaweza kuwa wanaona hii 442 00:30:20,690 --> 00:30:24,170 kama ungekuwa skanning maombi na kuangalia tu kwa 443 00:30:24,170 --> 00:30:32,230 API wito ambayo inahitajika mzizi ruhusa kutekeleza kwa usahihi. 444 00:30:32,230 --> 00:30:40,150 >> Na kuna mfano hapa nina ambayo ni kubadilisha wakala, 445 00:30:40,150 --> 00:30:46,380 na hii kwa kweli inapatikana tu kwenye Android. 446 00:30:46,380 --> 00:30:49,070 Unaweza kuona mimi nina kutoa mengi ya mifano juu ya Android 447 00:30:49,070 --> 00:30:53,990 sababu hii ni wapi zaidi ya kazi zisizo mazingira ni 448 00:30:53,990 --> 00:30:58,690 kwa sababu ni kweli rahisi kwa mshambulizi kupata kanuni malicious 449 00:30:58,690 --> 00:31:01,470 ndani ya Android sokoni. 450 00:31:01,470 --> 00:31:06,480 Ni hivyo si rahisi kufanya hivyo katika Apple App Store 451 00:31:06,480 --> 00:31:10,250 kwa sababu Apple inahitaji watengenezaji kujitambulisha 452 00:31:10,250 --> 00:31:12,790 na ishara code. 453 00:31:12,790 --> 00:31:20,340 Kweli kuangalia wewe ni nani, na Apple ni kweli kuchambua maombi. 454 00:31:20,340 --> 00:31:27,450 Hatuoni mengi ya zisizo kweli ambapo kifaa ni kupata kuathirika. 455 00:31:27,450 --> 00:31:32,250 Nami majadiliano kuhusu baadhi ya mifano ambapo ni kweli faragha hiyo kupata kuathirika, 456 00:31:32,250 --> 00:31:38,460 na kwamba ni nini kweli yanatokea kwenye kifaa Apple. 457 00:31:38,460 --> 00:31:44,090 Jambo jingine kuangalia kwa kificho malicious, kanuni hatari katika vifaa 458 00:31:44,090 --> 00:31:50,300 ni mantiki au wakati mabomu, na mabomu wakati pengine ni 459 00:31:50,300 --> 00:31:53,370 rahisi kuangalia kwa kuliko mantiki mabomu. 460 00:31:53,370 --> 00:31:57,030 Lakini pamoja na mabomu wakati, nini unaweza kufanya ni unaweza kuangalia kwa 461 00:31:57,030 --> 00:32:04,760 maeneo katika kanuni ambapo wakati ni kipimo au wakati kabisa ni inaonekana kwa 462 00:32:04,760 --> 00:32:08,190 kabla ya utendaji fulani katika programu kinachotokea. 463 00:32:08,190 --> 00:32:14,200 Na hii inaweza kufanyika kuficha shughuli kutoka kwa mtumiaji, 464 00:32:14,200 --> 00:32:17,510 hivyo kinatokea marehemu wakati wa usiku. 465 00:32:17,510 --> 00:32:24,350 DroidDream wanafanya shughuli zake zote 11:00-08:00 ndani ya muda 466 00:32:24,350 --> 00:32:30,650 kujaribu kufanya hivyo wakati mtumiaji anaweza kuwa na kutumia kifaa yao. 467 00:32:30,650 --> 00:32:38,680 >> Sababu nyingine ya kufanya hivyo ni kama watu kwa kutumia uchambuzi tabia ya maombi, 468 00:32:38,680 --> 00:32:43,430 mbio programu katika sandbox kuona nini tabia ya maombi ni, 469 00:32:43,430 --> 00:32:51,090 wanaweza kutumia wakati makao mantiki kufanya shughuli 470 00:32:51,090 --> 00:32:54,640 wakati programu ni si katika sandbox. 471 00:32:54,640 --> 00:33:01,520 Kwa mfano, programu duka kama Apple 472 00:33:01,520 --> 00:33:07,940 anaendesha maombi, lakini pengine si kukimbia kila maombi kwa ajili ya, kusema, siku 30 473 00:33:07,940 --> 00:33:10,550 kabla ya kuidhinisha, hivyo unaweza kuweka 474 00:33:10,550 --> 00:33:14,120 mantiki katika maombi yako kuwa alisema, sawa, tu kufanya kitu mbaya 475 00:33:14,120 --> 00:33:20,490 baada ya siku 30 yamepita na au baada ya siku 30 baada ya kuchapisha tarehe ya maombi, 476 00:33:20,490 --> 00:33:27,020 na ambayo inaweza kusaidia malicious code kujificha kutoka kwa watu ukaguzi kwa ajili yake. 477 00:33:27,020 --> 00:33:30,050 Kama makampuni kupambana na virusi ni kuendesha mambo katika sandboxes 478 00:33:30,050 --> 00:33:36,370 au maduka ya programu wenyewe ni hii inaweza kusaidia 479 00:33:36,370 --> 00:33:39,260 kujificha kwamba na kwamba ukaguzi. 480 00:33:39,260 --> 00:33:43,020 Sasa, hasara ya kwamba ni rahisi kupata na uchambuzi static, 481 00:33:43,020 --> 00:33:46,170 hivyo kweli ukaguzi code unaweza kuangalia kwa maeneo yote 482 00:33:46,170 --> 00:33:54,010 ambapo maombi vipimo wakati na kukagua njia hiyo. 483 00:33:54,010 --> 00:33:58,850 Na hapa nina baadhi ya mifano juu ya haya majukwaa 3 tofauti 484 00:33:58,850 --> 00:34:05,640 jinsi muda inaweza kuchunguzwa kwa na programu maker 485 00:34:05,640 --> 00:34:10,520 ili kujua nini kuangalia kwa kama wewe ni ukaguzi wa programu statically. 486 00:34:10,520 --> 00:34:14,570 >> Mimi tu akaenda kwa njia ya rundo zima la shughuli mbalimbali malicious 487 00:34:14,570 --> 00:34:18,969 kwamba tumeona katika pori, lakini ambayo ndio ni imefikia zaidi? 488 00:34:18,969 --> 00:34:23,940 Kuwa utafiti huo kutoka North Carolina State Simu ya Mkono Genome Project 489 00:34:23,940 --> 00:34:28,560 kuchapishwa baadhi ya data, na kulikuwa na kimsingi maeneo 4 490 00:34:28,560 --> 00:34:32,850 kwamba waliona ambapo kuna mengi ya shughuli. 491 00:34:32,850 --> 00:34:35,370 37% ya programu alifanya upendeleo kupanda, 492 00:34:35,370 --> 00:34:38,429 hivyo walikuwa na baadhi ya aina ya mapumziko ya gerezani code huko 493 00:34:38,429 --> 00:34:42,070 ambapo walijaribu kuenea marupurupu hata wao wenyewe wasiweze 494 00:34:42,070 --> 00:34:48,360 wala amri API mbio kama mfumo wa uendeshaji. 495 00:34:48,360 --> 00:34:52,520 45% ya programu huko nje alifanya premium SMS, 496 00:34:52,520 --> 00:34:57,260 hivyo kwamba asilimia kubwa kuwa ni kujaribu moja kwa moja Faidisha. 497 00:34:57,260 --> 00:35:02,640 93% alifanya udhibiti wa kijijini, hivyo walijaribu kuanzisha bot wavu, simu bot wavu. 498 00:35:02,640 --> 00:35:08,990 Na 45% kuvuna kutambua habari 499 00:35:08,990 --> 00:35:16,230 kama namba za simu, UUIDs, GPS eneo, akaunti user, 500 00:35:16,230 --> 00:35:22,870 na hii inaongeza hadi zaidi ya 100 kwa sababu wengi zisizo anajaribu kufanya baadhi ya mambo haya. 501 00:35:22,870 --> 00:35:27,070 >> Mimi nina kwenda kubadili nusu ya pili na majadiliano juu ya code udhaifu. 502 00:35:27,070 --> 00:35:29,480 Hii ni nusu ya pili ya shughuli hatari. 503 00:35:29,480 --> 00:35:33,450 Hii ni pale ambapo kimsingi developer ni kufanya makosa. 504 00:35:33,450 --> 00:35:37,210 developer halali kuandika programu halali 505 00:35:37,210 --> 00:35:41,830 ni kufanya makosa au ni wajinga wa hatari ya simu jukwaa. 506 00:35:41,830 --> 00:35:44,780 Wao si tu kujua jinsi ya kufanya programu salama Mkono, 507 00:35:44,780 --> 00:35:47,700 au wakati mwingine developer haina huduma juu ya kuweka user katika hatari. 508 00:35:47,700 --> 00:35:50,850 Wakati mwingine sehemu ya biashara zao mfano inaweza kuwa 509 00:35:50,850 --> 00:35:54,610 kuvuna mtumiaji habari binafsi. 510 00:35:54,610 --> 00:35:58,090 Hiyo ni aina ya jamii nyingine, na kwamba ni kwa nini baadhi ya hii malicious 511 00:35:58,090 --> 00:36:03,200 dhidi ya kuanza halali kwa damu juu ya sababu kuna tofauti ya maoni 512 00:36:03,200 --> 00:36:10,440 kati ya kile mtumiaji anataka na nini mtumiaji anaona hatari 513 00:36:10,440 --> 00:36:13,050 na nini developer maombi anaona hatari. 514 00:36:13,050 --> 00:36:18,380 Bila shaka, siyo data maombi developer katika kesi zaidi. 515 00:36:18,380 --> 00:36:22,030 >> Na kisha hatimaye, njia nyingine hii hutokea ni developer wanaweza kiungo katika 516 00:36:22,030 --> 00:36:28,600 maktaba pamoja ambayo ina udhaifu au tabia hii hatari ndani yake 517 00:36:28,600 --> 00:36:32,480 unbeknownst kwao. 518 00:36:32,480 --> 00:36:37,060 jamii ya kwanza ni data nyeti kuvuja, 519 00:36:37,060 --> 00:36:40,030 na huu ni wakati programu kukusanya taarifa 520 00:36:40,030 --> 00:36:44,980 kama eneo, habari kitabu cha anwani, mmiliki habari 521 00:36:44,980 --> 00:36:48,000 na kuzituma kwamba mbali kifaa. 522 00:36:48,000 --> 00:36:53,050 Na mara moja ni mbali kifaa, hatujui nini kinatokea na habari kwamba. 523 00:36:53,050 --> 00:36:57,170 Ni inaweza kuhifadhiwa insecurely na developer maombi. 524 00:36:57,170 --> 00:37:02,070 Tumeona watengenezaji maombi kupata kuathirika, 525 00:37:02,070 --> 00:37:05,820 na data kwamba wao ni kuhifadhi anapata kuchukuliwa. 526 00:37:05,820 --> 00:37:10,970 Hii ilitokea miezi michache iliyopita developer chini katika Florida 527 00:37:10,970 --> 00:37:21,660 ambapo idadi kubwa ya-ni iPad UUIDs na majina kifaa 528 00:37:21,660 --> 00:37:25,270 walikuwa kuvuja kwa sababu mtu, nadhani ilikuwa ni majina, 529 00:37:25,270 --> 00:37:29,460 alidai kufanya hivyo, kukatika ndani ya watumishi developer huu 530 00:37:29,460 --> 00:37:34,920 na kuiba mamilioni ya iPad UUIDs 531 00:37:34,920 --> 00:37:37,390 na majina ya kompyuta. 532 00:37:37,390 --> 00:37:40,260 Si habari zaidi hatari, 533 00:37:40,260 --> 00:37:46,820 lakini nini kama kwamba alikuwa uhifadhi wa majina ya utumiaji na nywila 534 00:37:46,820 --> 00:37:48,170 na anwani ya nyumbani? 535 00:37:48,170 --> 00:37:51,100 Kuna kura ya programu kwamba kuhifadhi aina hiyo ya habari. 536 00:37:51,100 --> 00:37:53,230 hatari ni pale. 537 00:37:53,230 --> 00:37:56,620 >> Kitu kingine ambayo yanaweza kutokea ni kama developer haina kutunza 538 00:37:56,620 --> 00:38:01,370 kupata data channel, na kwamba mazingira magumu nyingine kubwa mimi nina kwenda kwa majadiliano juu, 539 00:38:01,370 --> 00:38:05,160 data kwamba ni kupelekwa katika wazi. 540 00:38:05,160 --> 00:38:09,040 Kama mtumiaji ni juu ya umma mtandao Wi-Fi 541 00:38:09,040 --> 00:38:12,330 au mtu ni sniffing internet mahali fulani 542 00:38:12,330 --> 00:38:19,260 njiani data kuwa ni kuwa wazi. 543 00:38:19,260 --> 00:38:23,790 Mmoja maarufu sana kesi ya hii kuvuja habari kilichotokea na Pandora, 544 00:38:23,790 --> 00:38:27,250 na hili ni jambo sisi utafiti katika Veracode. 545 00:38:27,250 --> 00:38:33,200 Sisi habari kwamba kulikuwa na-Nadhani ilikuwa ni Tume ya Shirikisho la Biashara 546 00:38:33,200 --> 00:38:35,310 uchunguzi kinachoendelea na Pandora. 547 00:38:35,310 --> 00:38:39,830 Sisi akasema, "Nini kinaendelea huko juu? Hebu kuanza kuchimba ndani ya Pandora maombi." 548 00:38:39,830 --> 00:38:46,690 Na nini sisi kuamua mara Pandora maombi zilizokusanywa 549 00:38:46,690 --> 00:38:51,270 jinsia yako na umri wako, 550 00:38:51,270 --> 00:38:56,660 na pia kupatikana GPS eneo lako, na Pandora maombi 551 00:38:56,660 --> 00:39:00,200 alifanya hivyo kwa nini walisema na sababu halali. 552 00:39:00,200 --> 00:39:05,360 muziki wao walikuwa wanacheza-Pandora ni programu-muziki Streaming 553 00:39:05,360 --> 00:39:07,530 muziki wao walikuwa wanacheza ilikuwa tu leseni nchini Marekani, 554 00:39:07,530 --> 00:39:13,020 hivyo alikuwa na kuangalia kwa kuzingatia mikataba leseni zao kwamba walikuwa 555 00:39:13,020 --> 00:39:17,240 kwa muziki kwamba mtumiaji mara nchini Marekani. 556 00:39:17,240 --> 00:39:25,070 Pia alitaka kwa kuzingatia ushauri wa wazazi 557 00:39:25,070 --> 00:39:33,790 karibu lugha watu wazima katika muziki, 558 00:39:33,790 --> 00:39:37,500 na hivyo ni mpango wa hiari, lakini walitaka kuzingatia kwamba 559 00:39:37,500 --> 00:39:43,010 na si kucheza wazi lyrics kwa watoto 13 na chini. 560 00:39:43,010 --> 00:39:46,280 >> Walikuwa sababu halali kwa ajili ya kukusanya data hii. 561 00:39:46,280 --> 00:39:49,160 Programu zao walikuwa ruhusa ya kufanya hivyo. 562 00:39:49,160 --> 00:39:52,000 Watumiaji walidhani huu ulikuwa halali. Lakini ni nini kilichotokea? 563 00:39:52,000 --> 00:39:55,810 Wanaohusishwa katika maktaba 3 au 4 mbalimbali ad. 564 00:39:55,810 --> 00:39:59,140 Sasa wote wa maktaba ghafla haya yote ad 565 00:39:59,140 --> 00:40:02,970 ni kupata upatikanaji wa habari hii. 566 00:40:02,970 --> 00:40:05,830 maktaba ad, kama ukiangalia code katika maktaba ad 567 00:40:05,830 --> 00:40:08,430 wanachokifanya ni kila maktaba ad anasema 568 00:40:08,430 --> 00:40:11,340 "Je, programu yangu na ruhusa ya kupata GPS eneo?" 569 00:40:11,340 --> 00:40:14,890 "Oh, ni gani? Sawa, niambie GPS eneo." 570 00:40:14,890 --> 00:40:16,620 Kila moja ad maktaba gani kwamba, 571 00:40:16,620 --> 00:40:19,740 na kama programu hana GPS ruhusa 572 00:40:19,740 --> 00:40:23,460 itakuwa si kuwa na uwezo wa kupata, lakini kama itakuwa hivyo, itakuwa kupata. 573 00:40:23,460 --> 00:40:26,240 Hii ni pale ambapo mtindo wa biashara ya maktaba ad 574 00:40:26,240 --> 00:40:31,160 ni kinyume na faragha ya mtumiaji. 575 00:40:31,160 --> 00:40:34,980 Na kumekuwa na masomo huko nje kwamba kusema kama unajua umri 576 00:40:34,980 --> 00:40:38,430 ya mtu na unajua eneo lao 577 00:40:38,430 --> 00:40:42,530 ambapo wao kulala usiku, kwa sababu una GPS yao kuratibu 578 00:40:42,530 --> 00:40:46,030 wakati wao labda ni kulala, kujua hasa mtu huyo ni 579 00:40:46,030 --> 00:40:50,230 kwa sababu unaweza kuamua ambayo mwanachama wa kaya ni mtu huyo. 580 00:40:50,230 --> 00:40:54,780 Kweli hii ni kutambua na matangazo 581 00:40:54,780 --> 00:40:59,530 hasa wewe ni nani, na inaonekana kama ilikuwa halali. 582 00:40:59,530 --> 00:41:02,800 Mimi nataka tu Streaming yangu ya muziki, na hii ni njia pekee ya kupata. 583 00:41:02,800 --> 00:41:05,370 >> Naam, sisi wazi hii. 584 00:41:05,370 --> 00:41:08,030 Tuliandika hili katika nyadhifa kadhaa blog, 585 00:41:08,030 --> 00:41:13,280 na aligeuka kuwa mtu kutoka gazeti la Rolling Stone 586 00:41:13,280 --> 00:41:18,810 kusoma moja ya blog posts yetu na aliandika blog zao katika Rolling Stone kuhusu hilo, 587 00:41:18,810 --> 00:41:22,120 na siku ya pili Pandora walidhani ilikuwa ni wazo nzuri 588 00:41:22,120 --> 00:41:27,600 kuondoa maktaba ad kutoka maombi yao. 589 00:41:27,600 --> 00:41:31,270 Mbali kama mimi kujua wao ni tu-wanapaswa kupongezwa. 590 00:41:31,270 --> 00:41:35,770 Nadhani wao ni tu freemium ya aina ya programu ambayo imefanya hivi. 591 00:41:35,770 --> 00:41:38,660 Nyingine programu zote freemium kuwa na tabia hiyo, 592 00:41:38,660 --> 00:41:41,780 hivyo nimepata kufikiri kuhusu aina gani ya data wewe ni kutoa 593 00:41:41,780 --> 00:41:48,330 maombi hayo freemium kwa sababu ni wote kwenda matangazo. 594 00:41:48,330 --> 00:41:53,390 Ikulu pia alifanya utafiti kuhusu maktaba pamoja na akasema, 595 00:41:53,390 --> 00:41:57,100 "Hebu kuangalia nini pamoja maktaba ni maktaba ya juu pamoja," na hii ilikuwa data. 596 00:41:57,100 --> 00:41:59,420 >> Wao kuchambuliwa 53,000 programu, 597 00:41:59,420 --> 00:42:01,900 na namba 1 pamoja maktaba mara Admob. 598 00:42:01,900 --> 00:42:06,060 Ni kweli katika 38% ya maombi huko nje, 599 00:42:06,060 --> 00:42:08,800 hivyo 38% ya maombi unatumia 600 00:42:08,800 --> 00:42:11,250 ni uwezekano kuvuna maelezo yako ya kibinafsi 601 00:42:11,250 --> 00:42:16,650 na kupeleka kwa mitandao ad. 602 00:42:16,650 --> 00:42:19,350 Apache na Android walikuwa 8% na 6%, 603 00:42:19,350 --> 00:42:22,960 na kisha hawa wadogo wengine chini chini, Matangazo ya Google, Flurry, 604 00:42:22,960 --> 00:42:26,600 Kundi la mji na Milenia Media, 605 00:42:26,600 --> 00:42:30,500 haya ni makampuni yote ad, na kisha, Inafurahisha kutosha, 606 00:42:30,500 --> 00:42:33,500 4% wanaohusishwa katika maktaba Facebook 607 00:42:33,500 --> 00:42:38,870 pengine kufanya uthibitisho kwa njia ya kuungana 608 00:42:38,870 --> 00:42:40,810 hivyo programu hii inaweza kuthibitisha Facebook. 609 00:42:40,810 --> 00:42:44,660 Lakini hiyo pia ina maana shirika Facebook udhibiti wa code 610 00:42:44,660 --> 00:42:49,010 kwamba mbio katika 4% ya Android programu ya simu huko nje, 611 00:42:49,010 --> 00:42:53,490 na wao kupata data yote programu ambayo ina ruhusa ya kupata katika. 612 00:42:53,490 --> 00:42:57,170 Kimsingi Facebook anajaribu kuuza nafasi ya matangazo. 613 00:42:57,170 --> 00:43:00,120 Hiyo ni biashara zao mfano. 614 00:43:00,120 --> 00:43:02,920 >> Kama ukiangalia mazingira hii nzima na ruhusa hizi 615 00:43:02,920 --> 00:43:07,740 na maktaba pamoja kuanza kuona kwamba 616 00:43:07,740 --> 00:43:13,850 una mengi ya hatari katika maombi eti halali. 617 00:43:13,850 --> 00:43:19,360 kitu kimoja sawa kwamba kilichotokea na Pandora 618 00:43:19,360 --> 00:43:22,340 kilichotokea na maombi ya kuitwa Njia, 619 00:43:22,340 --> 00:43:27,660 na njia walidhani walikuwa kuwa na manufaa, watengenezaji kirafiki. 620 00:43:27,660 --> 00:43:32,160 Walikuwa tu kujaribu kukupa uzoefu mkubwa user, 621 00:43:32,160 --> 00:43:37,810 na aligeuka kuwa bila kusababisha user au kuwaambia user kitu chochote- 622 00:43:37,810 --> 00:43:40,400 na hii ilitokea juu ya iPhone na juu ya Android, 623 00:43:40,400 --> 00:43:44,420 Pandora programu ilikuwa juu ya iPhone na Android- 624 00:43:44,420 --> 00:43:48,890 kwamba njia ya maombi ilikuwa grabbing yako yote kitabu cha anwani 625 00:43:48,890 --> 00:43:52,830 na kuweka kwa njia tu wakati imewekwa na mbio maombi, 626 00:43:52,830 --> 00:43:55,840 na hawakuwa na kuwaambia kuhusu hili. 627 00:43:55,840 --> 00:43:58,750 Wao walidhani ni kweli na manufaa kwa wewe 628 00:43:58,750 --> 00:44:04,040 kuwa na uwezo wa kushiriki na watu wote katika anwani yako ya kitabu 629 00:44:04,040 --> 00:44:06,920 kwamba wewe ni kutumia njia ya maombi. 630 00:44:06,920 --> 00:44:09,490 >> Naam, ni wazi njia wazo hili lilikuwa kubwa kwa kampuni yao. 631 00:44:09,490 --> 00:44:13,510 Si kubwa sana kwa mtumiaji. 632 00:44:13,510 --> 00:44:19,020 Una kufikiri kwamba ni jambo moja kama labda kijana 633 00:44:19,020 --> 00:44:23,700 ni kutumia hii ya maombi na kadhaa wa marafiki zao ni huko, 634 00:44:23,700 --> 00:44:29,360 lakini nini kama ni Mkurugenzi Mtendaji wa kampuni kwamba installs njia 635 00:44:29,360 --> 00:44:33,170 na kisha kwa ghafla kitabu yao yote anwani ni huko juu? 636 00:44:33,170 --> 00:44:38,310 Wewe ni kwenda kupata mengi ya kuwasiliana uwezekano wa thamani habari 637 00:44:38,310 --> 00:44:40,920 kwa mengi ya watu. 638 00:44:40,920 --> 00:44:44,500 mwandishi kutoka New York Times, unaweza kuwa na uwezo wa kupata namba ya simu 639 00:44:44,500 --> 00:44:47,380 kwa marais wa zamani kutoka kitabu yao ya mitaani, 640 00:44:47,380 --> 00:44:54,780 hivyo ni wazi mengi ya habari nyeti anapata kuhamishiwa kwa kitu kama hiki. 641 00:44:54,780 --> 00:44:58,090 Kulikuwa na kama flap kubwa kuhusu hili kwamba njia msamaha. 642 00:44:58,090 --> 00:45:01,610 Wao iliyopita programu zao, na hata wanashikiliwa Apple. 643 00:45:01,610 --> 00:45:06,950 Apple akasema, "Sisi ni kwenda kwa nguvu wachuuzi programu haraka watumiaji 644 00:45:06,950 --> 00:45:12,650 kama wao wanaenda kukusanya kitabu cha anwani yao yote. " 645 00:45:12,650 --> 00:45:15,360 >> Inaonekana kama nini kinatokea hapa ni 646 00:45:15,360 --> 00:45:19,430 wakati kuna moja ukiukaji kubwa ya faragha na inafanya vyombo vya habari 647 00:45:19,430 --> 00:45:21,680 sisi kuona mabadiliko huko nje. 648 00:45:21,680 --> 00:45:23,230 Lakini bila shaka, kuna mambo mengine huko nje. 649 00:45:23,230 --> 00:45:27,440 Maombi LinkedIn mavuno kalenda yako entries, 650 00:45:27,440 --> 00:45:34,530 lakini Apple haina user ilisababisha juu ya hilo. 651 00:45:34,530 --> 00:45:38,030 Entries kalenda inaweza kuwa na habari nyeti katika wao pia. 652 00:45:38,030 --> 00:45:40,000 Ambapo ni wewe kwenda kuchora mstari? 653 00:45:40,000 --> 00:45:43,960 Hii ni kweli aina ya mahali kutoa 654 00:45:43,960 --> 00:45:47,640 ambapo kuna kweli hakuna kiwango nzuri huko nje 655 00:45:47,640 --> 00:45:51,990 kwa watumiaji wa kuelewa wakati habari zao ni kwenda kuwa katika hatari 656 00:45:51,990 --> 00:45:57,820 na wakati wao ni kwenda kujua ni zinazochukuliwa. 657 00:45:57,820 --> 00:46:03,040 Tuliandika programu katika Veracode aitwaye Adios, 658 00:46:03,040 --> 00:46:08,350 na kimsingi ni kuruhusiwa wewe uhakika programu katika iTunes yako directory 659 00:46:08,350 --> 00:46:12,550 na kuangalia maombi yote kwamba walikuwa kuvuna full anwani yako ya kitabu. 660 00:46:12,550 --> 00:46:19,760 Na kama unaweza kuona kwenye orodha hii hapa, hasira ndege, 661 00:46:19,760 --> 00:46:21,590 AIM, AroundMe. 662 00:46:21,590 --> 00:46:24,050 Kwa nini hasira ndege haja anwani yako ya kitabu? 663 00:46:24,050 --> 00:46:29,160 Sijui, lakini haina namna fulani. 664 00:46:29,160 --> 00:46:32,310 >> Hili ni jambo ambalo wengi, wengi maombi kufanya. 665 00:46:32,310 --> 00:46:34,780 Unaweza kukagua kanuni kwa ajili ya hii. 666 00:46:34,780 --> 00:46:38,660 Kuna APIs kichele kwa iPhone, Android na BlackBerry 667 00:46:38,660 --> 00:46:42,120 kupata katika kitabu cha anwani. 668 00:46:42,120 --> 00:46:48,520 Unaweza kweli kwa urahisi kukagua kwa hii, na hii ni kile sisi alifanya katika Adios maombi yetu. 669 00:46:48,520 --> 00:46:52,320 jamii ijayo, salama nyeti Takwimu Uhifadhi, 670 00:46:52,320 --> 00:46:55,670 ni kitu ambapo watengenezaji kuchukua kitu kama siri au idadi ya akaunti 671 00:46:55,670 --> 00:46:58,530 au password na kuhifadhi katika wazi juu ya kifaa. 672 00:46:58,530 --> 00:47:02,310 Hata mbaya, wapate kuhifadhi katika eneo kwenye simu 673 00:47:02,310 --> 00:47:06,820 ambayo ni ya kimataifa kupatikana, kama kadi ya SD. 674 00:47:06,820 --> 00:47:11,320 Unaweza kuona hii mara nyingi zaidi juu ya Android kwa sababu Android inaruhusu kwa kadi SD. 675 00:47:11,320 --> 00:47:13,200 Vifaa IPhone hawana. 676 00:47:13,200 --> 00:47:17,900 Lakini sisi hata nikaona hii kutokea katika CitiGroup maombi. 677 00:47:17,900 --> 00:47:25,450 Benki maombi yao online kuhifadhiwa idadi ya akaunti ya insecurely, 678 00:47:25,450 --> 00:47:28,120 tu katika wazi, ili kama wewe waliopotea kifaa chako, 679 00:47:28,120 --> 00:47:30,670 kimsingi walipoteza akaunti yako ya benki. 680 00:47:30,670 --> 00:47:36,000 Hii ni kwa nini mimi binafsi si kufanya benki juu ya iPhone yangu. 681 00:47:36,000 --> 00:47:43,710 Nadhani ni hatari sana hivi sasa kufanya aina hii ya shughuli. 682 00:47:43,710 --> 00:47:45,950 >> Skype alifanya kitu kimoja. 683 00:47:45,950 --> 00:47:49,870 Skype, bila shaka, ina akaunti ya usawa, user name na password 684 00:47:49,870 --> 00:47:51,030 kwamba kupata kwamba mizani. 685 00:47:51,030 --> 00:48:00,080 Walikuwa kuhifadhi taarifa zote hizo wazi kwenye simu. 686 00:48:00,080 --> 00:48:05,760 Mimi na baadhi ya mifano hapa ya kujenga files 687 00:48:05,760 --> 00:48:10,310 kwamba hawana ruhusa ya kulia au kuandika kwa disc 688 00:48:10,310 --> 00:48:17,260 na si kuwa na encryption yoyote kutokea kwa ajili hiyo. 689 00:48:17,260 --> 00:48:20,190 Eneo hili la pili, salama nyeti Data Transmission, 690 00:48:20,190 --> 00:48:24,450 Nimekuwa alluded hii mara chache, na kwa sababu ya umma Wi-Fi 691 00:48:24,450 --> 00:48:27,770 hii ni kitu ambacho programu kabisa haja ya kufanya, 692 00:48:27,770 --> 00:48:31,250 na hii pengine ni nini tunaona kwenda vibaya zaidi. 693 00:48:31,250 --> 00:48:34,920 Napenda kusema-kwa kweli, mimi nadhani data halisi, 694 00:48:34,920 --> 00:48:38,120 lakini ni karibu nusu ya maombi ya simu 695 00:48:38,120 --> 00:48:41,780 screw up kufanya SSL. 696 00:48:41,780 --> 00:48:43,910 Wao si tu kutumia APIs kwa usahihi. 697 00:48:43,910 --> 00:48:47,970 I mean, kila nimepata kufanya ni kufuata maelekezo na matumizi ya APIs, 698 00:48:47,970 --> 00:48:54,720 lakini wao kufanya mambo kama si kuangalia kama kuna cheti batili mwishoni mwa mengine, 699 00:48:54,720 --> 00:49:02,120 si kuangalia kama upande wa pili ni kujaribu kufanya mashambulizi itifaki downgrade. 700 00:49:02,120 --> 00:49:07,200 >> Watengenezaji, wanataka kupata checkbox yao, sawa? 701 00:49:07,200 --> 00:49:11,910 Mahitaji yao ni kutumia hii ya kuuza. Wameweza alitumia kuuza. 702 00:49:11,910 --> 00:49:14,800 mahitaji ni si kwa kutumia hii kuuza salama, 703 00:49:14,800 --> 00:49:19,680 na hivyo hii ni kwa nini maombi yote kwamba matumizi ya SSL ya kupata data 704 00:49:19,680 --> 00:49:23,470 kama ni kuwa zinaa mbali kifaa kweli wanahitaji kuwa kukaguliwa 705 00:49:23,470 --> 00:49:28,950 kuhakikisha kwamba ilikuwa kutekelezwa kwa usahihi. 706 00:49:28,950 --> 00:49:32,850 Na hapa nina baadhi ya mifano ambapo unaweza kuona maombi 707 00:49:32,850 --> 00:49:37,400 wanaweza kutumia HTTP badala ya HTTPS. 708 00:49:37,400 --> 00:49:40,510 Katika baadhi ya matukio programu kuanguka nyuma HTTP 709 00:49:40,510 --> 00:49:44,250 kama HTTPS si kazi. 710 00:49:44,250 --> 00:49:49,070 Mimi na mwingine wito hapa juu ya Android ambapo wameweza walemavu kuangalia cheti, 711 00:49:49,070 --> 00:49:51,700 hivyo mtu-katika-katikati mashambulizi yanaweza kutokea. 712 00:49:51,700 --> 00:49:56,370 cheti batili utakubaliwa. 713 00:49:56,370 --> 00:50:01,920 Hizi ni kesi zote ambapo washambuliaji ni kwenda kuwa na uwezo wa kupata 714 00:50:01,920 --> 00:50:07,150 sawa Wi-Fi uhusiano kama user na upatikanaji wa data wote 715 00:50:07,150 --> 00:50:11,650 hiyo kupelekwa juu ya mtandao. 716 00:50:11,650 --> 00:50:15,970 >> Na hatimaye, jamii mwisho mimi na hapa ni password hardcoded na funguo. 717 00:50:15,970 --> 00:50:21,470 Sisi kwa kweli kuona mengi ya watengenezaji kutumia huo coding style 718 00:50:21,470 --> 00:50:25,900 kwamba wao walifanya walipokuwa kujenga maombi mtandao wa kompyuta, 719 00:50:25,900 --> 00:50:29,700 hivyo ni kujenga Java server maombi, na wao ni hardcoding muhimu. 720 00:50:29,700 --> 00:50:31,940 Naam, wakati wewe ni kujenga maombi server, yeah, 721 00:50:31,940 --> 00:50:34,240 hardcoding ni muhimu si wazo nzuri. 722 00:50:34,240 --> 00:50:36,290 Ni vigumu kubadilika. 723 00:50:36,290 --> 00:50:40,700 Lakini si mabaya hivyo katika upande server kwa sababu ambaye ana upatikanaji wa upande server? 724 00:50:40,700 --> 00:50:43,140 Tu watawala. 725 00:50:43,140 --> 00:50:48,100 Lakini kama wewe kuchukua code sawa na wewe kuyamimina juu ya maombi ya simu 726 00:50:48,100 --> 00:50:52,550 sasa kila mtu ambaye ana kuwa maombi ya simu ina upatikanaji wa muhimu kwamba hardcoded, 727 00:50:52,550 --> 00:50:56,380 na sisi kweli kuona hii mara nyingi, na mimi na baadhi ya takwimu 728 00:50:56,380 --> 00:51:00,920 juu ya jinsi ya mara nyingi tunaona hili kutokea. 729 00:51:00,920 --> 00:51:04,940 Ni kweli alikuwa katika mfano kificho kwamba MasterCard kuchapishwa 730 00:51:04,940 --> 00:51:06,850 juu ya jinsi ya kutumia huduma yao. 731 00:51:06,850 --> 00:51:11,860 mfano code ilionyesha jinsi gani tu kuchukua password 732 00:51:11,860 --> 00:51:14,850 na kuiweka katika kamba hardcoded haki pale, 733 00:51:14,850 --> 00:51:19,380 na tunajua jinsi ya watengenezaji upendo na nakala na kuweka code snippets 734 00:51:19,380 --> 00:51:22,360 wakati wao ni kujaribu kufanya kitu, hivyo nakala na kuweka code snippet 735 00:51:22,360 --> 00:51:28,450 kwamba alitoa kama mfano, na una maombi salama. 736 00:51:28,450 --> 00:51:31,490 >> Na hapa tuna baadhi ya mifano. 737 00:51:31,490 --> 00:51:35,840 Hii ni moja ya kwanza ni moja sisi kuona mengi ambapo wao hardcode 738 00:51:35,840 --> 00:51:40,510 data haki katika URL kwamba anapata alimtuma. 739 00:51:40,510 --> 00:51:45,120 Wakati mwingine tunaona kamba password password =. 740 00:51:45,120 --> 00:51:49,060 Hiyo ni pretty rahisi ya kuchunguza, au kamba password juu ya BlackBerry na Android. 741 00:51:49,060 --> 00:51:53,680 Ni kweli pretty rahisi kuangalia kwa sababu karibu kila mara 742 00:51:53,680 --> 00:51:57,030 developer majina variable hiyo kufanya password 743 00:51:57,030 --> 00:52:02,290 baadhi ya tofauti ya password. 744 00:52:02,290 --> 00:52:05,200 Mimi alieleza kuwa sisi kufanya uchambuzi tuli katika Veracode, 745 00:52:05,200 --> 00:52:11,790 hivyo tumekuwa kuchambuliwa mia kadhaa maombi Android na iOS. 746 00:52:11,790 --> 00:52:15,160 Tumekuwa kujengwa mifano kamili ya kwao, na sisi ni uwezo wa Scan yao 747 00:52:15,160 --> 00:52:19,280 kwa udhaifu tofauti, hasa udhaifu nilikuwa kuzungumza juu, 748 00:52:19,280 --> 00:52:21,050 na mimi na baadhi ya data hapa. 749 00:52:21,050 --> 00:52:24,320 68.5% ya programu Android sisi inaonekana katika 750 00:52:24,320 --> 00:52:28,590 amevunja code cryptographic, 751 00:52:28,590 --> 00:52:33,240 ambayo kwa ajili yetu, sisi hawezi kuchunguza kama alifanya crypto yako mwenyewe mara kwa mara, 752 00:52:33,240 --> 00:52:38,980 si kwamba ni wazo nzuri, lakini hii ni kweli kwa kutumia APIs kuchapishwa 753 00:52:38,980 --> 00:52:42,530 kwamba ni juu ya jukwaa lakini kufanya nao kwa namna 754 00:52:42,530 --> 00:52:46,680 kwamba crypto itakuwa katika mazingira magumu, 68.5. 755 00:52:46,680 --> 00:52:49,870 Na hii ni kwa ajili ya watu unatuma maombi yao kwa kweli kwa sababu 756 00:52:49,870 --> 00:52:53,730 wao nadhani ni wazo nzuri ya kufanya usalama kupima. 757 00:52:53,730 --> 00:52:56,960 Hawa ni watu kwamba pengine ni kwamba ni kufikiri salama tayari, 758 00:52:56,960 --> 00:52:59,540 hivyo pengine hata zaidi. 759 00:52:59,540 --> 00:53:02,690 >> Mimi hakuwa na majadiliano juu ya udhibiti line kulisha sindano. 760 00:53:02,690 --> 00:53:07,640 Ni kitu sisi kuangalia kwa, lakini si kwamba hatari ya suala hilo. 761 00:53:07,640 --> 00:53:15,390 Kuvuja taarifa, hii ni wapi data nyeti ni kupelekwa kifaa mbali. 762 00:53:15,390 --> 00:53:19,270 Tuligundua kwamba katika 40% ya maombi. 763 00:53:19,270 --> 00:53:23,540 Wakati na hali hizo ni mbio masuala ya hali ya aina, kawaida ni vigumu kutumia, 764 00:53:23,540 --> 00:53:26,170 hivyo mimi si kuzungumza juu ya kwamba, lakini sisi inaonekana saa yake. 765 00:53:26,170 --> 00:53:28,750 23% walikuwa SQL masuala ya sindano. 766 00:53:28,750 --> 00:53:32,020 mengi ya watu hawajui kuwa mengi ya maombi 767 00:53:32,020 --> 00:53:35,880 kutumia kidogo kidogo SQL database tarehe ya mwisho ya nyuma yao ya kuhifadhi data. 768 00:53:35,880 --> 00:53:40,430 Naam, kama data kwamba wewe ni grabbing juu ya mtandao 769 00:53:40,430 --> 00:53:43,800 ina masharti SQL sindano mashambulizi ndani yake 770 00:53:43,800 --> 00:53:45,970 mtu anaweza maelewano kifaa kupitia huo, 771 00:53:45,970 --> 00:53:49,800 na hivyo nadhani sisi kupata karibu 40% ya matumizi ya mtandao na tatizo hili, 772 00:53:49,800 --> 00:53:52,840 ambayo ni kubwa janga tatizo. 773 00:53:52,840 --> 00:53:55,740 Tunaona kuwa ni 23% ya muda katika programu ya simu 774 00:53:55,740 --> 00:54:02,030 na kwamba pengine kwa sababu wengi zaidi ya matumizi ya mtandao kutumia SQL kuliko Mkono. 775 00:54:02,030 --> 00:54:05,580 >> Na kisha sisi bado kuona baadhi ya msalaba-site scripting, masuala ya ruhusa, 776 00:54:05,580 --> 00:54:09,400 na kisha usimamizi credential, hiyo ni ambapo una password yako hardcoded. 777 00:54:09,400 --> 00:54:14,540 Katika 5% ya maombi tunaona kwamba. 778 00:54:14,540 --> 00:54:17,970 Na kisha tuna baadhi ya data juu ya iOS. 779 00:54:17,970 --> 00:54:20,180 81% na masuala ya kosa utunzaji. 780 00:54:20,180 --> 00:54:23,130 Hii ni zaidi ya tatizo code ya shaba, 781 00:54:23,130 --> 00:54:28,010 lakini 67% na masuala ya cryptographic, hivyo si kama kabisa mbaya kama Android. 782 00:54:28,010 --> 00:54:32,440 Labda APIs ni rahisi kidogo, kanuni mfano kidogo bora juu ya iOS. 783 00:54:32,440 --> 00:54:35,420 Lakini bado asilimia kubwa sana. 784 00:54:35,420 --> 00:54:39,040 Tulikuwa na 54% na taarifa kuvuja, 785 00:54:39,040 --> 00:54:42,080 juu ya 30% na makosa ya usimamizi wa buffer. 786 00:54:42,080 --> 00:54:45,930 Hiyo ni mahali ambapo kuna inaweza uwezekano wa kuwa rushwa kumbukumbu suala hilo. 787 00:54:45,930 --> 00:54:50,350 Ni zinageuka kuwa si kwamba kama mengi ya tatizo kwa ajili ya matumizi 788 00:54:50,350 --> 00:54:56,450 juu ya iOS kwa sababu code yote ina saini, 789 00:54:56,450 --> 00:55:02,210 hivyo ni vigumu kwa mshambulizi kutekeleza code holela juu ya iOS. 790 00:55:02,210 --> 00:55:07,880 Kanuni ya shaba, directory traversal, lakini kisha sifa usimamizi hapa 14.6%, 791 00:55:07,880 --> 00:55:09,250 hivyo mbaya zaidi kuliko juu ya Android. 792 00:55:09,250 --> 00:55:13,240 Tuna watu si utunzaji nywila kwa usahihi. 793 00:55:13,240 --> 00:55:15,790 Na kisha makosa numeric na buffer kufurika, 794 00:55:15,790 --> 00:55:22,680 hizo ni zaidi kwenda kuwa masuala code quality juu ya iOS. 795 00:55:22,680 --> 00:55:26,110 >> Hiyo ilikuwa ni kwa ajili ya kuwasilisha yangu. Mimi sijui kama tuko nje ya wakati au la. 796 00:55:26,110 --> 00:55:29,540 Sijui kama kuna maswali yoyote. 797 00:55:29,540 --> 00:55:33,220 [Kiume] swali haraka kote kugawanyika na soko Android. 798 00:55:33,220 --> 00:55:36,240 Apple angalau anamiliki patching. 799 00:55:36,240 --> 00:55:40,780 Wao kufanya kazi nzuri ya kupata ni huko nje ambapo chini ya hivyo katika nafasi Android. 800 00:55:40,780 --> 00:55:44,280 Wewe karibu haja jailbreak simu yako kukaa sasa 801 00:55:44,280 --> 00:55:46,660 na kutolewa kwa ya sasa ya Android. 802 00:55:46,660 --> 00:55:50,960 Yeah, hiyo ni tatizo kubwa na hivyo kama unadhani kuhusu- 803 00:55:50,960 --> 00:55:52,280 [Kiume] Kwa nini hawawezi kurudia hivyo? 804 00:55:52,280 --> 00:55:55,610 >> Oh, haki, hivyo swali ni nini kuhusu kugawanyika 805 00:55:55,610 --> 00:56:00,410 ya mfumo wa uendeshaji kwenye jukwaa Android? 806 00:56:00,410 --> 00:56:05,890 Jinsi gani yanayoathiri riskiness ya vifaa hayo? 807 00:56:05,890 --> 00:56:09,700 Na ni kweli ni tatizo kubwa kwa sababu kinachotokea ni 808 00:56:09,700 --> 00:56:15,110 vifaa wakubwa, wakati mtu anakuja na mapumziko ya gerezani kwa kifaa hicho, 809 00:56:15,110 --> 00:56:19,960 kimsingi kwamba upendeleo kupanda, na mpaka kwamba mfumo wa uendeshaji ni updated 810 00:56:19,960 --> 00:56:25,350 zisizo yeyote anaweza kisha kutumia kwamba mazingira magumu maelewano kabisa kifaa, 811 00:56:25,350 --> 00:56:30,200 na kile sisi ni kuona juu ya Android ni ili kupata mfumo mpya wa uendeshaji 812 00:56:30,200 --> 00:56:34,690 Google ina kuweka nje ya mfumo wa uendeshaji, na kisha vifaa mtengenezaji 813 00:56:34,690 --> 00:56:39,390 ina Customize yake, na kisha carrier ina Customize na kutoa hiyo. 814 00:56:39,390 --> 00:56:43,070 Una kimsingi sehemu 3 kuhamia hapa, 815 00:56:43,070 --> 00:56:47,210 na ni kugeuka kutoka kwamba flygbolag hawana huduma, 816 00:56:47,210 --> 00:56:50,400 na vifaa wazalishaji hawana huduma, na Google si prodding yao ya kutosha 817 00:56:50,400 --> 00:56:54,430 kufanya kitu chochote, hivyo kimsingi zaidi ya nusu ya vifaa huko nje 818 00:56:54,430 --> 00:57:00,590 na mifumo ya uendeshaji ambayo haya upendeleo kupanda udhaifu katika wao, 819 00:57:00,590 --> 00:57:08,440 na hivyo kama wewe kupata zisizo kwenye simu yako ni zaidi ya tatizo. 820 00:57:08,440 --> 00:57:10,350 >> Okay, asante sana. 821 00:57:10,350 --> 00:57:12,310 [Applause] 822 00:57:12,310 --> 00:57:14,310 [CS50.TV]