We’ve got Mobile Device Management, BYOD is not a risk for us!” “Our proxy filters all outbound traffic, no one is getting a shell out ever!” Companies are putting a lot of faith in these security mechanisms to stop the threats of mobile devices. In this talk we put those big claims to the test and look at ways to bypass security restrictions on and using mobile devices. For example, that proxy that stops all outbound traffic unless its in the Internet Explorer process authenticated against the domain? Why not just send your shell back to an exploited mobile device in the environment and have it pass the shell out via SMS? Demo gods will be tempted and all code will be released as modules for Smartphone Pentest Framework.