CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
0 likes420 views
The document discusses various methods for identifying and exploiting vulnerabilities in Android mobile devices, covering topics such as privilege levels, exploiting installed applications, and bypassing lock screens. It highlights practical attacks, remote exploits, and issues with Android's implementation that can lead to unauthorized access or privilege escalation. Additionally, it addresses the potential to utilize tools like drozer and methods for maintaining access on compromised devices.
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
- 1. CNIT 128 Hacking Mobile Devices 8. Identifying and Exploiting Android Implementation Issues Part 2
- 2. Topics • Part 1 • Reviewing Pre-installed Applications • Exploiting Devices • Start through "Explanation of Privilege Levels" (up to p. 402)
- 3. Topics • Part 2 • Exploiting Devices • "Practical Physical Attacks" (p. 375) through • "Polaris Viewer Memory Corruption" (up to p. 402)
- 4. Topics • Part 3 • Exploiting Devices • "Injecting Exploits for JavaScript Interfaces" (p. 402) and following • Infiltrating User Data
- 6. Bypassing Lock Screen • Getting ADB Shell Access: Two Ways • USB Debugging • Unlocked Bootloaders
- 7. USB Debugging • adb shell • Usually turned off by default • Exposes data and can be used to install new packages • User must approve it • Not possible if screen is locked
- 8. Bug • In Android up to 4.4.2 • Navigating to energency dialer or lock screen camera • Allows the USB debugging authorization prompt • With the screen locked
- 9. Privilege Levels • /default.prop file controld ADB privileges • By default: ro.secure=1 • Adb runs as the shell user • If ro.secure=0 • Adb runs as root
- 10. ALLOW_ADBD_ROOT • From Android 4.3 onwards • ADB won't run as root unless it's compiled with the ALLOW_ADBD_ROOT flag • Even if rro.secure=0 • To get root, compile a custom version of adbd and overwrite the binary on the device
- 11. Unlocked Bootloaders • First boot phone into Fastboot mode • Hold down power and volume keys while turning on the phone • or adb reboot bootloader • Not possible with Genymotion, Nox, or Bluestacks • They have no recovery partition
- 12. Unlock Bootloader • Forces factory reset • Wipes all user data • To stop thieves
- 13. Unlocked Bootloader • If user unlocked it and left it unlocked • Boot into ClockworkMod Recovery ROM (not updated since 2014) • Get a root ADB shell
- 14. Bypassing Lock Screens • Using the DISABLE_KEYGUARD Permission • Allows an app to remove the lock screen • App code: KeyguardManager kgm = ((KeyguardManager)getSystemService("keyguard")); KeyGuardManager.KeyguardLock kgl = kgm.newKeyguardLock("mahh"); kgl.disableKeyguard(); Even though the KeyguardManager.KeyguardLock
- 15. Custom Drozer Agent drozer agent build --permission android.permission.DISABLE_KEYGUARD • Install agent with adb, launch it, and bypass screen lock • Works on Nox (Android 5.1.1) • Fails on Genymotion (Android 9.0)
- 16. Removing Key Files • Pattern lock screen uses data from • /data/system/gesure.key • PIN or password lock uses data from • /data/system/password.key • Removing these files disables lock screen entirely
- 17. Removing Key Files • But that requires running as system or root • Privilege escalation
- 18. Abusing Android Application Issues • On Android 4.3 and earlier, this intent unlocks the phone: shell@android:/ $ am start -n com.android.settings/ com.android.settings.ChooseLockGeneric --ez confirm_credentials false --ei lockscreen.password_type 0 --activity-clear-task Starting: Intent { flg=0x8000 cmp=com.android.settings/.ChooseLockGeneric (has extras) }
- 19. Using Logic Flaws that Don't Require Shell Access • Some actions are allowed when a phone is locked • Make emergency phone calls • Receive phone calls • Allow third-party apps to temporarily disable the lock screen • Or place an activity in front of it
- 20. Motorola Droid • Phone the locked device • Answer the call • Press Back button • Escape the lock screen
- 21. Viber • Messaging and calling app • Place a Viber call • Answer it • Press the back button multiple times • Escape the lock screen
- 22. Usng Legitimate Lock Screen Reset Functionality • Entering the PIN five times incorrectly • Connects to a linked Google account
- 23. Android Device Manager • Allows lock screen to be bypassed from a Google account • Not active by default--user must enable it
- 25. Remote Exploits • Launched over the Internet • Three modes of exploitation: • Loading a drozer JAR that loads a limited agent • Installing and starting a rogue drozer agent by abusing INSTALL_PACKAGES • Loading a drozer JAR that is passed Context
- 26. Browser Memory Corruption • The most technical method • Reverse shells via buffer overflow, etc. • Becoming rarer as the browser becomes more secure
- 27. Polaris Viewer Memory Corruption • Office and PDF file viewer • Pre-installed on some devices • Exploited in 2012 with a crafted DOCX file • Using a stack-based buffer overflow • App also had INSTALL_PACKAGES permission
- 29. Android Browser JavaScript Interface • All WebViews using JavaScriptInterface • And targeting API before 17 • Are vulnerable to code execution flaws • Includes all stock Android browsers on Android 4.1.1 and below • Can get Context and use full permissions of browser
- 30. Use Metasploit • Link Ch 8g
- 32. Privilege Escalation • Exynos driver exploit on some devices • Drozer has a exploit.mmap_abuse module • Tries to get root by abusing the map device operation • Similar to the exynos exploit • Very dangerous: may cause a kernel panic and reboot the device
- 33. Maintaining Access • Must install a special su binary bundled with Drozer, called "minimal su" • Allows every app to escalate to root • Without alerting the user
- 34. Man-in-the-Middle Exploits • Getting in the middie • Host a wireless network • ARP Poisoning • Use Burp
- 35. Man-in-the-Middle Exploits • Intercepting SSL requires the ability to get a root CA certificate • Only nation-states or very rich attackers • But many apps ignore this defense and allow MITM attacks anyway