Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Core Security Introduces Penetration Testing Solution for Mobile Phones

Black Hat News

Black Hat News

Today at the Black Hat Conference in Las Vegas, Core Security announced CORE IMPACT Pro v12, the latest edition of its flagship penetration testing software that now replicates attacks on Android, BlackBerry and iPhone mobile devices. Core Security’s new mobile phone hacking capabilities pinpoint security exposures on these devices. By knowing where the holes are, enterprises can lock down their mobile infrastructures.

Core Impact Pro v12“The sophistication of recent online attacks makes it clear that criminals are successfully striking major enterprises at multiple stages across several attack vectors – including mobile,” said Mark Hatton, president and CEO of Core Security.

 By safely replicating sophisticated real-world attacks that pinpoint security holes in popular smartphone devices, CORE IMPACT Pro v12 can help organizations lock down their mobile infrastructures and help prevent leakage of sensitive enterprise data.

 Additionally, the latest release of CORE IMPACT Pro significantly advances the use of Rapid7’s Metasploit framework.

 CORE IMPACT Pro also added support for IPv6 environments, and provides assessment capabilities for all OWASP Top Ten Web application vulnerabilities.

“While a rapidly increasing amount of employees want to use the mobile device of their choice to access corporate email, applications and data, IT staff need to know the security risks posed by every device they grant access to networked resources,” said Chris Hazelton, research director, mobile and wireless, at the 451 Group.

New Features: CORE IMPACT Pro v12

· Evaluate Android, BlackBerry and iPhone mobile device security, prior to deployment

· Identify and prove critical exposures to data, just as deeply as criminals 

o   Retrieve phone call, SMS and MMS information

o   Download contacts

o   Gather GPS location data

· Assess end-user security awareness using common social engineering techniques

o   Phishing emails and texts

o   Web form impersonation

o   Fake wireless access points

o   Wireless Man-in-the-Middle (MITM) attacks 

·         Gain actionable data and reports on mobile device security

o   Required to mitigate financial, operational and reputational risks

Advanced Usage of Metasploit Exploits*

· Run Metasploit Framework exploits through any pivot point to remotely launch exploits against compromised systems, regardless of where they fall on the attack path revealed during testing

· Increased testing scope to reflect a broader range of attacks, by selecting and identifying Metasploit Framework exploits using built-in selection capabilities

· Deploy Core Security’s patented agent payload to take advantage of advanced post-exploitation and pivoting capabilities, based on exploits created by either Core Security or Metasploit Framework

· Encrypt all agent payload communications for penetration testing

Support for OWASP Top Ten, IPv6 and VPN Pivoting

·         Assessment capabilities that address all OWASP Top Ten Web application vulnerabilities

o   Includes cross-site request forgery, OS command injection, and unvalidated redirects and forwards

·         Security assessments that now target and attack over IPv6 systems

·         VPN pivoting on both Windows and Linux systems

o   Run vulnerability scanners and other complementary solutions against targeted systems

·         Enhanced anti-virus evasion

CORE IMPACT Pro v12 will be available in late Q3 2011.

Written By

Click to comment

Expert Insights

Related Content

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Cybercrime

A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.