This presentation relies on our RSA Conference US 17’ presentation, which got very good feedback from attendees. I’ll start by discussing different strategies of mobile containers - ranging from App-Based containers (e.g., SDK-based or through wrapping technologies) to OS-level containers. I’ll relate to inherent characteristics of these strategies – their merits but also shortcomings. I’ll then move on to focus on real-world mobile-security attacking techniques that target the premise of mobile containers’ value-prop: Enhanced Security and Separation of duties. This section will contain concrete threat & mitigation strategies taken from things we see “in the field”. Next, I’ll move to discussing the Android for Work framework – Google’s effort to provide a secure way to perform sensitive business activity, side-by-side with personal activity via Android devices starting Android 5. I’ll discuss the way the framework was built and focus on its premise of providing a secure separation between the personal (and non-guarded) profile and the business (and highly guarded) profile. At that point, I’ll uncover Skycure’s research of techniques (following a responsible and coordinated disclosure process with Google) that can break the secure separation by planting a seemingly innocent in the personal profile with “one leg” controlled by a remote attacker, and the “second leg” inside the presumably secure and separated business profile of Android for Work (we call it an “App-in-the-Middle” attack). I’ll do so by getting deeper into the mechanics of Android, and highlighting the capabilities (such as Accessibility and Notification APIs) that can be used maliciously by apps to mount attacks. The discussion will be accompanied with attack-simulation demonstrations. As a next step, I’ll show advanced attack concepts, such as utilizing Tapjacking in current Android versions, that can allow real-world mounting of App-in-the-Middle attacks. The presentation will conclude with concrete guidance to the audience about the actions they can take to mitigate their exposure.