mobile code mining for discovery and exploits nullcongoa2013

Mobile Code Mining For Discovery and Exploits

Who Am I? Hemil Shah – [email protected]

Co-CEO & Director, Blueinfy Solutions

Past experience

eSphere Security, HBO, KPMG, IL&FS, Net SquareInterest

Web and mobile security researchPublished research

Articles / Papers – Packstroem, etc.Web Tools – wsScanner, scanweb2.0, AppMap, AppCodeScan, AppPrint etc.

Mobile Tools – FSDroid, iAppliScan, DumpDroid

[email protected] http://www.blueinfy.comBlog – http://blog.blueinfy.com/

Enterprise Technology Trend

2007. Web services would rocket from $1.6 billion in 2004 to $34 billion. [IDC]

2008. Web Services or Service-Oriented Architecture (SOA) would surge ahead. [Gartner]

2009. Enterprise 2.0 in action and penetrating deeper into the corporate environment

2010. Flex/HTML5/Cloud/API2012. HTML5/Mobile era.

Past, Present and Future

Cloud

2010

Focus

Mobile Infrastructure

www mail

intranetrouter

DMZ

Internet

VPN

Dial-up

Other Offices

Exchangefirewall

Database RAS

Mobile App Environment

WebServer

Static pages only(HTML,HTM, etc.)Web

Client

ScriptedWeb

EngineDynamic pages

(ASP,DHTML, PHP,CGI, etc.)

ASP.NET on .Net Framework,J2EE App Server,

Web Services,etc.

ApplicationServers

And IntegratedFramework

Internet DMZ Trusted

WWEEBB

SSEERRVVIICCEESS

Mobile

SOAP/JSON etc.

DB

X

Internal/Corporate

Mobile Apps

Mobile Changes

Application Infrastructure

Changing dimension Web Mobile(AI1) Protocols HTTP & HTTPS JSON, SOAP, REST etc. over

HTTP & HTTPS

(AI2) Information structures

HTML transfer JSON, JS Objects, XML, etc.

(AI3) Technology Java, DotNet, PHP, Python and so on

Cocoa, Java with Platform SDKs, HTML5

(AI4) Information Store/Process

Mainly on Server Side Client and Server Side

Mobile Changes

Security Threats

Changing dimension Web Mobile

(T1) Entry points Structured Scattered and multiple

(T2) Dependencies Limited Multiple technologies Information sources Protocols

(T3) Vulnerabilities Server side [Typical injections]

Web services [Payloads] Client side [Local Storage]

(T4) Exploitation Server side exploitation Both server and client side exploitation

Mobile Attacks

Insecure Storage

Insecure Storage

Why application needs to store data• Ease of use for the user• Popularity• Competition• Activity with single click• Decrease Transaction time• Post/Get information to/from Social Sites

9 out of 10 applications have this vulnerability

Insecure Storage

How attacker can gain access• Wifi • Default password after jail breaking (alpine)• Adb over wifi• Physical Theft• Temporary access to device

Insecure Storage

What information we usually find• Authentication Credentials• Authorization tokens• Financial Statements• Credit card numbers• Owner’s Information – Physical Address, Name,

Phone number• Social Engineering Sites profile/habbits• SQL Queries

Insecure Network Communication

Insecure Network Channel

• Easy to perform MiM attacks as Mobile devices uses untrusted network i.e open/Public WiFi, HotSpot, Carrier’s Network

• Application deals with sensitive data i.e. • Authentication credentials• Authorization token• PII Information (Privacy Violation) (Owner Name,

Phone number, UDID)

Insecure Network Channel

• Can sniff the traffic to get an access to sensitive data

• SSL is the best way to secure communication channel

• Common Issues• Does not deprecate HTTP requests• Allowing invalid certificates• Sensitive information in GET requests

Session token

Unauthorized Dialing/SMS

Unauthorized Dialing/SMS

• Social Engineering using Mobile Devices• Attacker plays with user’s mind• User installs application• Application sends premium rate SMS or a

premium rate phone call to unknown number• Used by Malware/Trojans

AndroidOS.FakePlayer

August 2010• Sends costly International SMS• One SMS Costs – 25 USD (INR 1250)• Application Sends SMS to –

• 3353 & 3354 numbers in Russia

GGTracker

June 2010• Another Application which sends International

SMS• One SMS Costs – 40 USD (INR 2000)• Application Sends Premium SMS to US

numbers

UI Impersonation

UI Impersonation

• Attack has been there since long• On a mobile stack, known as UI impersonation• Other names are Phishing Attack, ClickJacking• Attacker plays with user’s mind and try to

impersonate as other user or other application

UI Impersonation

• Victim looses credit card information or authentication credentials or secret

• One application can create local PUSH notification as it is created from apple store

• Flow in review process of AppStore – Anyone can name anything to their application

NetFlix

Oct -2011• Steals users “netflix” account information• Application shows error message to user

“Compatibility issues with the user’s hardware” when user enters username and password

• Once error message, application uninstalls itself

Activity Monitoring

Activity Monitoring

• Sending a blind carbon copy of each email to attacker

• Listening all phone calls• Email contact list, pictures to attacker• Read all emails stored on the device• Usual intension of Spyware/Trojans

Activity Monitoring

Attacker can monitor – • Audio Files• Video• Pictures• Location• Contact List• Call/Browser/SMS History• Data files

Android.Pjapps

Early 2010• Steal/Change users information• PjApps Application –

• Send and monitor incoming SMS messages• Read/write to the user's browsing history and bookmarks• Install packages and Open Sockets• Write to external storage• Read the phone's state

System Modification

System Modification

• Application will attempt to modify system configuration to hide itself (Historically this is known as ROOTKIT)

• Configuration changes makes certain attack possible i.e. – • Modifying device proxy to get user’s activity

monitoring• Configure BCC email sending to attacker

iKee – iPhone Worm

“ikee” iPhone WormChange root password Change wallpaper to Ricky Martin.

After infected by “ikee“iPhone look like this

PII Information Leakage

PII Information Leakage

• Application usually have access to user’s private information i.e. Owner Name, Location, Physical Address, AppID, Phone Number

• This information needs to be handled very carefully as per the law in some countries

• Storing this information in plain text is not allowed in some countries

Hardcoded Secrets

Hardcoded Secrets

• Easiest way for developer to solve complex issues/functionality

• Attacker can get this information by either reverse engineering application or by checking local storage

Language Specific Issues

Language Specific Issues

• Application in iOS are developed in Objective-C language which is derived from classic C language

• Along with this derivation, it also derives security issues in C language i.e. overflow attacks

SQL Injection in Local database

SQL Injection in Local database

• Most Mobile platforms uses SQLite as database to store information on the device

• Using any SQLite Database Browser, it is possible to access database logs which has queries and other sensitive database information

• In case application is not filtering input, SQL Injection on local database is possible

Information in Common Services

Common Services

• KeyBoard, Clipboard are shared amongst all the applications.

• Information stored in clipboard can be accessed by all the application

• Sensitive information should not be allowed to copy/paste in the application

Server Side Issues

Server Side Issues

• Most Application makes server side calls to either web services or some other component. Security of server side component is equally important as client side

• Controls to be tested on the server side – Security Control Categories for Server Side Application– Authentication, Access Controls/Authorization, API misuse, Path traversal, Sensitive information leakage,

Server Side Issues

• Error handling, Session management, Protocol abuse, Input validations, XSS, CSRF, Logic bypass, Insecure crypto, DoS, Malicious Code Injection, SQL injection, XPATH and LDAP injections, OS command injection, Parameter manipulations, BruteForce, Buffer Overflow, HTTP response splitting, HTTP replay, XML injection, Canonicalization, Logging and auditing.

Mobile Top 10 - OWASP• Insecure Data Storage

• Weak Server Side Controls

• Insufficient Transport Layer Protection

• Client Side Injection

• Poor Authorization and Authentication

• Improper Session Handling

• Security Decisions Via Untrusted Inputs

• Side Channel Data Leakage

• Broken Cryptography

• Sensitive Information Disclosure

Decompiling Android Applications

Decompiling android application

• Using Apktool - http://code.google.com/p/android-apktool/

• Using Dex2Jar - http://code.google.com/p/dex2jar/

• Using aapt (Bundled with Android SDK)

Use Apktool to convert the XML to readable format

Android manifest file:

APK Tool

Use dex2jar to convert classes.dex file in the extracted folder to .class files

Use JAD to convert the class files into JAVA files

Dex2Jar and JAD

Aapt• Android Asset Packaging Tool

• Allows you to view , create and update Zip-compatible archives

View components in an apk:

Looking in to Code

Static Code Analysis

• Introduce in Mac OS X v10.6, XCode 3.2, Clang analyzer merged into XCode. • Memory leakage warning• Run from Build->Analyze• Innovative shows you complete flow of

object start to end• Configure as a automatic analysis during

build process


Potential Memory Leak


Dead store – variable never used


Uninitialized Variable


Type Size Mismatch


Object used after release

Code Analysis with AppCodeScan

• Semi automated tool• Ability to expand with custom rules• Simple tracing utility to verify and track

vulnerabilities• Simple HTML reporting which can be

converted to PDF

AppCodeScan

• Sophisticated tool consist of two components • Code Scanning• Code Tracer

• Allows you to trace back the variable• AppCodeScan is not complete automated

static code analyzer.• It only relies on regex and lets you find

SOURCE of the SINK

ScanDroid

• Ruby script to scan through source code (Pattern matching) for APIs

• Also takes care about reverse engineering application

• Make list of permissions• No code trace• No reporting

Rules in AppCodeScan

• Writing rules is very straight forward• In an XML file which is loaded at run time• This release has rules for iOS and Android for

- Local Storage, Unsafe APIs, SQL Injection, Network Connection, SSL Certificate Handling, Client Side Exploitation, URL Handlers, Logging, Credential Management and Accessing PII.

Sample Rules - Android

Android DEMO

Sample Rules - iOS

iOS DEMO

Debuggable flag in Android

• One of the key attribute in android manifest file• Under “application” section• Describes debugging in enabled• If “Debuggable”attribute is set o true, the application

will try to connect to a local unix socket “@jdwp-control”

• Using JDWP, It is possible to gain full access to the Java process and execute arbitrary code in the context of the debugable application

CheckDebuggable Script

• Checks in APK whether debuggable is enabled

• Script can be found at – http://www.espheresecurity.com/resourcestools.html

• Paper can be found at - http://www.espheresecurity.com/CheckDebuggable.pdf

Conclusion – Questions?

mobile code mining for discovery and exploits nullcongoa2013

Software