A rogue access point.
We're into the wireless category.
Rogue AP is stood up to look like a legitimate AP, and the purpose of that is
to collect user information where they mistakenly connect to the rogue AP.
I can walk into any public place with my phone, I will guarantee you within three
minutes, I can have at least one person connected to my phone as free public WiFi
and be collecting sensitive information in no time.
Ap Max spoofing.
We talked about mac address spoofing in the previous chapter.
Mac address spoofing is a lot of times
used to gain unauthorized access to a network where mac filtration is used.
All I do is spoof my mac address to match that of a legitimate client and I'm in.
Evil twin attacks are where you impersonate a legitimate access point
where you name your AP the same or something very similar.
The idea is a man in the middle attack or rogue AP.
Rogue AP, honey spot, honey pot, evil twin, they're all referring to roughly the
same thing, impersonating a legitimate access point.
Bluetooth attacks.
There's a lot less Bluetooth attacks these
days than there were years ago when Bluetooth was way more insecure.
Blue smacking, jacking, snarfing,
sniffing, bugging are all different flavors of Bluetooth attacks, but
Bluetooth, by today's standards, is a lot more secure than it was.
You've got no automatic pairing request or default pins, things like that.
It's gotten a lot more secure.
There's still a few attacks on it, don't get me wrong.
A lot of the old school attacks where it
was just open the season on Bluetooth, a lot of that stuff has been addressed.
Rfid attacks.
Rfid or radio frequency identification and near field communication attacks
are attacks on wireless readers or some processing.
You can use them to actually capture ID badges, things like that.
You can use them to subvert inventory tracking systems.
Near field communication, that's the thing that you use, like tap for pay on your
phone where you're within 10 centimeters of the reader.
But both of these are wireless, which lead to things like eaves dropping, data
modification, data corruption, or even man in the middle attacks.
Man in the middle attack on an NFC is a pretty close proximity attack.
In mobile devices, you've got all of the
same issues as you would have with a desktop.
One of the more notable is security issues arising from insufficient or lack of
vetting of apps in the official marketplace as for Android or for iOS.
When an application makes it into the app store or Google Play Store that is
malicious in nature, it's gotten through the vetting process and now it can cause
damage to other application's data or send sensitive data attackers.
This happens periodically.
It's pretty infrequent.
But with Android, for example,
you can out of the box, install applications from untrusted sources.
Might be taking your security in your own
hands by installing from untrusted sources.
Mobile spam.
Sms attack vectors have all the same bags of tricks as email attack vectors.
So mobile spam, phishing, and so forth is
just spam and phishing over SMS, plain and simple.
Hacking an Android device using Metasploit.
Metasploit is the de facto standard exploitation framework.
It can be used to attack Android in much the same way as any desktop, but
Metasploit can be used to create payloads and deliver those through different
exploit codes to a variety of devices, IoT, mobile or desktops or servers.