Performing a vulnerability assessment on Windows Tablets?

Question

How does a security auditor perform a vulnerability assessment for Windows Tablets including Surface RT tablets deployed ones and any management application that comes pre-installed with it?

Also, there are tablets, which comes without Surface and these versions are generally the same Windows OS (Desktop OS). How does one access security testing for these?

My entire point is how should an auditor go about performing a vulnerability assessment for these tablets, what are the necessary pointers he/she should access and are there any online resources for this task - maybe test cases, or a checklist?

Answer 1

It depends on how indepth the auditor wants to go or more correctly what is in scope for the audit.

I would start with the standard port scan looking at standard windows services that are open. You will more than likely find non-standard services open and these are more than likely applications added on top of the OS (Vendor/3rd party apps). These are ripe for fuzzing.

Next use a sniffer (I use wireshark) to look at the traffic in either wired or wireless mode. Look for insecure connections or broadcast advertisements of a devices name and capabilities. If its wired you may need something like this network tap (http://hakshop.myshopify.com/collections/accessory/products/throwing-star-lan-tap-pro) to sniff the traffic.

Next evaluate the system physically. What ports are available and what is required to lock/unlock the device. Some fingerprint scanners can be spoofed. USB/Network/Proprietary ports have their own problems.

Next up take stock of the wireless options. Does it have Wifi/BT/GSM? Does it have anything else like NFC? Each of these protocols have there own attacks. For instance check to see if Wifi does Probe Requests for previous networks it has joined. If so this can give you a list of places the tablet has been (generally bad for executives and such).

Next login to the tablet and perform a standard Windows assessment. After that look for software added specifically for the tablet. Look for ways that battery saving features may be exploited to by pass security.

I would pull any tablet specific software off and run it through a disassembler and look for insecure code, master keys, or insecure network connections.

Since a lot of tablets integrate some sort of cloud service look at what is in place, how it determines what data to sync and use your sniffer to verify it is done securely.

For each of these steps you should look for both built-in or 3rd party mitigations. For instance you can configure MS not to be so chatty on the network.

Depending on how much/little you do you should find a few problems and solutions for them. That would make a nice assessment report while informing the reader the risk level of tablet computing.

Answer 2

For the main part, configuration assessments of windows tablets are exactly the same as for standard windows builds and the approaches and resources would be the same (e.g. CIS security benchmarks). The only likely unique point for a tablet review would be the presence/absence of hardware features like TPM chips which can support full disk encryption.

Windows RT as run on the surface is a slightly different case as it is a more locked down version of windows, but it still has a command line and powershell, so it would be possible to assess the configuratio of the device in largely the same way as you would assess a standard windows build.

There are some potential differences in terms of manageability (e.g. Windows RT cannot be domain joined) but whether those are relevant depends on the specific organisation requirements, so the best approach here would be to lay out specific requirements and then manually assess against each one.

From a black-box review perspective (e.g. using tools like Nmap and Nessus) the approach would be the same as for any system.