![ Audit how data is stored
Things to look for:
Incorrect permissions
Storage location (data, sdcard, asec)
Tools
Adb shell
Standard linux commands
[Root exploit and busybox]
18](https://image.slidesharecdn.com/androidmobilesecurityrss1052011-111006102805-phpapp02/85/Android-Hacking-18-320.jpg)
Android Hacking
- 1. Tools and Techniques Related To 1
- 2. RIT Alum Intrepidus Group Interlock Rochester Rochester 2600 TOOOL BSidesROC @antitree antitree.com 2
- 3. Android Introduction Tools For Hackers Analysis Techniques Examples How to be “secure” 3
- 4. Other, Honeycomb Cupcake 1% Donut 6% 1% 2% Blackberry, 9% Eclair 15% Gingerbread 25% iOS, 28% Android, 56% Froyo 56% 4
- 6. Linux 2.6 Dalvik Virtual Machine – new instance for each app DEX – Dalvik byte code APK - zip AndroidManifest.xml Dalvik Java APK Byte Code 6
- 7. Linux Angry Birds app_42 Dalvik VM Instances
- 8. Intents – inter process communication Activities - screen Content Providers – sqlite3 database Services – background processes Broadcasts – send and receive info to other apps 8
- 9. • Dynamic Network Analysis • Static Code Review • File System Auditing 9
- 10. Android SDK ADB DDMS Emulator Apktool Smali/Baksmali Dex2jar Java Decompiler (e.g. JAD or JD-GUI) Mallory Burpsuite Wireshark 10
- 11. Java source code vs Smali files vs DEX vs jar vs pseudocode Android development Java Linux 11
- 12. 12
- 13. Watch Traffic flow through a MITM Things to look for: Information being passed in the clear SSL usage and whether it’s done correctly Results of modifying requests and responses Authentication process 13
- 14. Wireless Router Emulator PPTP server DDWRT/TOMATOE Android SDK PPTPD Usually need a clunky device Sometimes doesn’t act the Dedicated server way you want it 14
- 15. #!/bin/bash # firewall script to intercept all traffic from ppp0 and redirect to local port # all credit to the great algorythm echo 1 > /proc/sys/net/ipv4/ip_forward iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A PREROUTING -j REDIRECT -i ppp0 -p tcp --dport 80 -m tcp --to-ports 8080 iptables -t nat -A PREROUTING -j REDIRECT -i ppp0 -p tcp --dport 443 -m tcp --to- ports 8080 15
- 16. Wireshark Initial traffic fingerprinting Burpsuite Great for HTTP/S traffic Mallory Great for nonspecific protocols 16
- 17. 17
- 18. Audit how data is stored Things to look for: Incorrect permissions Storage location (data, sdcard, asec) Tools Adb shell Standard linux commands [Root exploit and busybox] 18
- 19. 19
- 20. 20
- 21. See how the app works through pseudocode Things to look for: Overall understanding of the app Cryptographic functions Debug/Testing functions Client side authentication 21
- 22. Tools: Apktool d com.antitree.app Smali path/to/smali/files/ Dex2jar out.dex Jd-gui out_dex2jar.jar APK DEX Jar Pseudocode Smali 22
- 23. Reverse engineering is neat
- 24. 24
- 25. 25
- 26. But what does it mean? 26
- 27. Skype: 4/11 Permissions error allowed a malicious app to access contacts and personal information Google: 6/11 Session information passed in the clear made it susceptible to hijacking Dropbox: 8/11 An attempt to share data granted any app to the ability to make file public 27
- 28. HTC: 10/11 Spyware Logging app found to be accessible to any app with the network connection permission ▪ GPS coordinates ▪ MEID, MDN ▪ phone logs ▪ MUCH more *#*#HTCLOG#*#* 28
- 29. 100,000 installations 29
- 30. File System Permissions Set to 777 Access saved sessions Modify included binaries Why: Lazy permissions How discovered: file system permission review 30
- 31. SSHUNTUNNEL
- 32. Shares information Controls permissions Tool: Android Manifest Auditor Code Name: The Jaku 32
- 33. 33
- 34. 1. Insecure Data Storage 2. Weak Server Side Controls 3. Insufficient Transport Layer Protection 4. Client Side Injection 5. Poor Authorization and Authentication 6. Improper Session Handling 7. Security Decisions Via Untrusted Inputs 8. Side Channel Data Leakage 9. Broken Cryptography 10. Sensitive Information Disclosure 34
- 35. Deploy mobile device management solution Zenprise, MobileIron, (Google?) Train your users – don’t give in Audit your devices Are users following best practices? What apps are installed? Require mobile security solution Lookout, WaveSecure, NetQin 35
- 36. Audit your apps! Check permissions Check source code Analyze your traffic Think before you Root Security Software Remote wipe Malware detection 36
- 37. Coincidence? 37
- 38. Slides and app available at www.antitree.com 38
- 39. http://www.intrepidusgroup.com/insight/ http://code.google.com/p/android-apktool/ http://code.google.com/p/smali/ http://code.google.com/p/dex2jar/ http://java.decompiler.free.fr/?q=jdgui http://developer.android.com/sdk 39
- 40. 40