please, please, please defend your mobile apps!
Post on 14-Jun-2015
211 Views
Preview:
DESCRIPTION
TRANSCRIPT
#ISC2CongressStrengthening Cybersecurity Defenders
Please, Please, PLEASE! Defend Your Mobile Apps!
Jerod Brennen, CISSPCTO & Principal Security Consultant, Jacadis
2 #ISC2Congress
Agenda
» A Little Understanding Goes a Long Way» Mobile App Defense 101» Attacking Your Own Apps» Vetting Apps» Resources
4 #ISC2Congress
Understand Your Environment
» What development methodologies do we follow?» What programming languages do we use?» What risk/security frameworks do we follow?» What third-party libraries do we use?» What stages in the development process require
approval from the security team?
5 #ISC2Congress
Understand Your Platforms
» iOS» Android» BlackBerry» Windows
6 #ISC2Congress
Three Four Key Security Checks
» Defined Security Requirements– Project Plan– RFP, Contracts, etc.
» Source Code Security Reviews– Manual Reviews– Reverse Binaries
» Security Tests in QA• Positive AND Negative
Test Cases
» Analysis of “Deployed” Apps• Automated Scans• Manual Analysis
7 #ISC2Congress
Source Code Reviews (OWASP)» Methodology (v1.1, current)
• Preparation• Security Code Review in the SDLC• Security Code Review Coverage• Application Threat Modeling• Code Review Metrics
» Methodology (v2.0, in development)• Preparation• Application Threat Modeling• Understanding Code Layout/Design/Architecture• Reviewing by Technical Control• Reviewing by Vulnerability• Security Code Review for Agile Development
8 #ISC2Congress
QA Security Test Cases
» Positive AND Negative
» Top 10 Negative Test Cases• Embedded Single Quote• Required Data Entry• Field Type Test• Field Size Test• Numeric Bounds Test• Numeric Limits Test• Date Bounds Test• Date Validity• Web Session Testing• Performance Changes
List from http://www.sqatester.com/methodology/Top10NegativeTestCases.htm
9 #ISC2Congress
Application Analysis
» Automated scanning tools and manual analysis
» OWASP Testing Guide (v3)• Information Gathering• Configuration Management Testing• Authentication Testing• Session Management Testing• Authorization Testing• Business Logic Testing• Data Validation Testing• Testing for Denial of Service• Web Services Testing• AJAX Testing
» 42+ Secure Mobile Development Best Practices (viaForensics)
10 #ISC2Congress
OWASP Top 10 Mobile Risks
Image from https://www.owasp.org/index.php/OWASP_Mobile_Security_Project#tab=Top_Ten_Mobile_Risks
11 #ISC2Congress
Image from https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet
iOS AppSec Cheat Sheet
12 #ISC2Congress
» Download from app store• Mac OS X 10.7 Lion: ~/Music/iTunes/iTunes
Media/Mobile Applications/• Mac OS X 10.6: ~/Music/iTunes/Mobile
Applications/• Windows 7: C:\Users\Username\My Music\iTunes\
iTunes Media\Mobile Applications\
» Extract app to folder using 7-zip» Manually examine the files using
Notepad++ or prgrep» Look for sensitive info (integration points)
• Connection strings• Calls to Internet-facing web services• Calls to other local resources
Deconstructing .ipa Files
13 #ISC2Congress
iOS Target Files
File name/extension Description
.sinf Apple iOS digital rights management file
.supp Apple iOS file (archives)
.plist Apple property list XML file
.nib Apple Interface Builder user interface resources
.sqlite SQL Lite database file
AppName <no extension> App file itself
ChangeLog <no extension> No! Bad developer! Bad!
PkgInfo <no extension> 4b package type + 4b app signature
14 #ISC2Congress
» Download from app store• Copy .apk file from rooted Android device to
laptop via USB cable• Send .apk file from non-rooted Android
device to Dropbox via APK Extractor• Alternately, you can download some .apk
files from .apk archive sites
» Extract app to folder using 7-zip» Manually examine the files using
Notepad++ or prgrep» Look for sensitive info (integration
points)• Connection strings• Calls to Internet-facing web services• Calls to other local resources
Deconstructing .apk Files
15 #ISC2Congress
Android Target Files
File name/extension Description
Assets <folder> All your base are belong in here
Lib <folder> .so files (third party libraries)
META-INF <folder> .rsa, .fs, manifest.mf (hash values + certs = integrity)
Res <folder> XML files and supporting graphics (how the app draws the interface)
Templates <folder> Licenses, release notes, etc.
AndroidManifest.xml Info that the device needs before it can run the app
classes.dex Dalvik Executable (Exterminate! Exterminate!)
resources.arsc Compiled application resources (strings, images, etc.)
16 #ISC2Congress
Man-in-the-Middle
» Plug laptop into wired network connection» Created an ad hoc wireless network on laptop» Connect mobile device to ad hoc wireless network» Start Wireshark on laptop
• Capture ALL packets between mobile device and server
» Use mobile device as a normal end user» Analyze Wireshark traffic
• Unencrypted credentials• Unencrypted account information• Connection strings to servers (including third parties)
» Alternately, use a proxy like Mallory (TCP) or Charles/Burp (HTTP)
17 #ISC2Congress
Running iRET» Jailbreak your iDevice» Install supporting
utilities» Install the target app
on jailbroken iDevice» Open iRET app» Open the target app» Browse to http://deviceip:5555 from your laptop
Supporting Utilities» oTool» dumpDecrypted» Sqlite» Theos» Keychain_dumper» file» plutil» Class-dump-z
iOS Reverse Engineering Toolkit
18 #ISC2Congress
Vetting an App
» Encrypted communications
» Encrypted storage» Use of UUID» Analytics and ad
services» Location services» Data sharing
capabilities– Bluetooth
» Access to…• Address book• Calendar• Reminder• Photos• Microphone• Social media services• Lock screen images• Cloud-based file sharing
services
19 #ISC2Congress
Vetting Support
20 #ISC2Congress
Resources
» Wireshark• http://www.wireshark.org/
» SQLite Database Browser• http://sourceforge.net/projects/sqlitebrowser/
» iPhone Backup Analyzer• http://www.ipbackupanalyzer.com/
» iOS Reverse Engineering Toolkit• http://blog.veracode.com/2014/03/introducing-the-ios-revers
e-engineering-toolkit/
• https://www.veracode.com/iret-ios-reverse-engineering-toolkit
» Charles Web Debugging Proxy• http://www.charlesproxy.com/
21 #ISC2Congress
Resources
» AXMLPrinter2• https://code.google.com/p/android4me/downloads/list
» Android SDK + Android Developer Tools (ADT bundle)• http://developer.android.com/sdk/index.html
» dex2jar• https://code.google.com/p/dex2jar/
» Java Decompiler (JD-GUI)• http://jd.benow.ca/
» Step-by-Step Guide to Decompiling Android Apps• http
://slandail.net/step-by-step-guide-to-decompiling-android-apps/
22 #ISC2Congress
Resources
» Clueful• http://www.cluefulapp.com/
» viaProtect• https://www.viaprotect.com/
» Malwarebytes• https://www.malwarebytes.org/mobile/
» Lookout• https://www.lookout.com/
» MyPermissions• http://mypermissions.com/
23 #ISC2Congress
Questions?
Jerod Brennen, CISSPCTO & Principal Security Consultant, Jacadis
LinkedIn: http://www.linkedin/com/in/slandailTwitter: https://twitter.com/slandail
http://www.jacadis.com/contact@jacadis.com
top related