Automated Security Analysis of Android & iOS Applications with Mobile Security Framework - c0c0n 2015
Download as pptx, pdf7 likes26,488 views
Ajin Abraham presents the Mobile Security Framework, an open source tool for automating security analysis of Android and iOS mobile applications. It performs static analysis on application binaries and source code to detect vulnerabilities. It also includes dynamic analysis capabilities like monitoring network traffic, system calls and application data during runtime. The tool is hosted locally and does not send any data to the cloud. The talk demonstrates the tool's static and dynamic analysis features and provides examples of vulnerabilities it has discovered in real world applications. Future plans are discussed to add additional testing capabilities and improve the tool. Users are encouraged to download, test and contribute to the open source project.
Automated Security Analysis of Android & iOS Applications with Mobile Security Framework - c0c0n 2015
- 1. Ajin Abraham Automated Security Analysis of Android & iOS Applications with Mobile Security Framework
- 2. About Me Application Security Engineer, Yodlee Author of OWASP Xenotix XSS Exploit Framework, Mobile Security Framework. Co-Organizer of X0RC0NF. Blog about Security: http://opensecurity.in
- 4. The Takeaways A Free and Open Source Tool Mobile App Pentesters/Malware Analysts - How to make your life easier. Developers – Build secure mobile Apps by detecting vulnerabilities at earlier stages of development. For the Rest – Some new Information.
- 5. WTF is it? Mobile Security Framework is an open source mobile application (Android/iOS) automated pentesting framework capable of performing static and dynamic security analysis*. Android iOS
- 6. Hosted in your environment. Your application and data is never send to the cloud.
- 7. Basic Requirements iOS • Python 2.7 • Django 1.8 • Oracle Java - JDK 1.7+ • Oracle VirtualBox • Mac Android • Python 2.7 • Django 1.8 • Oracle Java - JDK 1.7+ • Oracle VirtualBox
- 8. Static Analyzer Mobile Security Framework INPUT OUTPUT REPORT
- 9. Static Analysis Android Binary INFORMATION GATHERING DECOMPILE TO JAVA & SMALI PERMISSION ANALYSIS MANIFEST ANALYSIS JAVA CODE ANALYSIS ANDROID API INFO FILE ANALYSIS URLS, EMAIL, FILES, STRINGS, ANDROID COMPONENTS REPORT GENERATION
- 10. Static Analysis Android Source INFORMATION GATHERING DECOMPILE TO JAVA & SMALI PERMISSION ANALYSIS MANIFEST ANALYSIS JAVA CODE ANALYSIS ANDROID API INFO FILE ANALYSIS URLS, EMAIL, FILES, STRINGS, ANDROID COMPONENTS REPORT GENERATION
- 11. DEMO Static Analysis of APK Static Analysis of Zipped Source Code
- 12. Static Analysis iOS - Binary BASIC INFORMATION BINARY ANALYSIS FILE ANALYSIS LIBRARIES REPORT GENERATION iOS - Source BASIC INFORMATION CODE ANALYSIS iOS API INFORMATION FILE ANALYSIS URL, EMAIL, FILES, LIBRARIES REPORT GENERATION
- 13. DEMO Static Analysis of IPA Binary Static Analysis of Zipped Source Code
- 14. Dynamic Analyzer Mobile Security Framework INPUT Android VM REPORT OUTPUT
- 15. Dynamic Analyzer - Architecture Dynamic Analyzer AGENTS Install and Run APK HTTP(S) Proxy Invoke Agents in VM Results HTTP(S) Traffic Android VM Application Data Agent Collected Information Start HTTP(S) Web Proxy
- 16. Dynamic Analysis SCREENSHOT CAPTURE HTTP(S) TRAFFIC LOGCAT and DUMPSYS DYNAMIC API MONITOR DYNAMIC URLS and EMAILS MONITOR APPLICATION DATA DUMPER FILE ANALYSIS ON APPLICATION DATA REPORT GENERATION UNDER DEVELOPMENT
- 17. DEMO Dynamic Analysis of Android Application
- 18. Some Real World Results Mobile Security Framework – Bypassing PIN in Whisper Android Application - http://opensecurity.in/mobile- security-framework-bypassing-pin-in-whisper-android- application/ AppLock MITM Password Reset Vulnerability - http://opensecurity.in/applock-mitm-password-reset- vulnerability/
- 19. AppLock MITM Password Reset Vulnerability DEMO
- 21. Future Plans Looks like people are interested!
- 22. In Aplha Dev Web Service Testing/REST API testing for Hybrid Applications. Dynamic Analysis Support for Real Android and iOS Devices. Anti VM/Sandbox Detection Bypass. IDOR and Cross Talk Detection support in Proxy. Better Front End. DB Support. Scheduled Scans.
- 23. What you can do? Download, Test, Contribute Source: https://github.com/ajinabraham/YSO-Mobile- Security-Framework Issues: https://github.com/ajinabraham/YSO-Mobile- Security-Framework/issues
- 24. QA @ajinabraham [email protected] http://opensecurity.in Thanks • Bharadwaj Machiraju • Anto Joseph • Tim Brown • Thomas Abraham • Graphics/Image Owners