Android e mobile security (for developers)

(1)

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License.

The OWASP Foundation

OWASP-Italy Day2012 Rome, 23° November 2012

Android e mobile security

(for developers)

Igor Falcomatà

CTO, Enforcer

(2)

• attività professionale:

• _{analisi delle vulnerabilità e}

penetration testing (~13 anni)

• _{security consulting}

• _formazione

• altro:

• _{sikurezza.org}

• _(F|Er|bz)lug

free advertising >

(3)

(4)

• Kernel

• Kernel Linux 2.6.x (Android 1, 2 e 3.x)

• Kernel Linux 3.0.x (Android 4.x)

• componenti e driver standard

• FS, processi, permessi, processi

• vulnerabilità standard ;)

• Componenti custom

• binder, ashmem, pmem, logger, wavelocks, OOM,

alarm timers, paranoid network security, gpio, ..

• android e vendor custom hw driver

(5)

• Sandbox (OS level)

• sandboxing con uid/gid linux + patch kernel (protected

API)

• 1 processo = 1 applicazione = 1 VM (+ componenti OS)

• protected API per accesso all'hw: camera, gps,

bluetooth, telefonia, SMS/MMS, connessioni di rete)

• root = root (full access)

• Librerie

• bionic libc (!= gnu libc, !posix)

• udev, WebKit, OpenGL, SQLite, crypto, .. (

& bugs

)

• Dalvik VM (!= JVM)

• Java Code -> dex bytecode

• custom Java libraries

(6)

• sandboxing con uid/gid linux + patch kernel (protected

API)

• 1 processo = 1 applicazione = 1 VM (+ componenti OS)

• protected API per accesso all'hw: camera, gps,

bluetooth, telefonia, SMS/MMS, connessioni di rete)

• root = root (full access)

• Librerie

• bionic libc (!= gnu libc, !posix)

• udev, WebKit, OpenGL, SQLite, crypto, .. (

& bugs

)

• Dalvik VM (!= JVM)

• Java Code -> dex bytecode

• custom Java libraries

• può lanciare codice nativo (syscall, ioctls, .. ) -> kernel

“Like all security features, the

Application Sandbox is not

unbreakable. However, to break

out of the Application Sandbox

in a properly configured device,

one must compromise the

security of the the Linux

kernel.”

“Like all security features, the

Application Sandbox is not

unbreakable. However, to break

out of the Application Sandbox

in a properly configured device,

one must compromise the

security of the the Linux

kernel.”

(7)

hot-spot user

desktop

ext. router

web server app backend db server

file server dep. server desktop desktop firewall access point BY0D user wifi user 3G user servizi in cloud

(8)

hot-spot user

desktop

ext. router _{file server}

dep. server desktop desktop firewall access point BY0D user wifi user 3G user servizi in cloud Mr. MobileMalicious

3

rd

_party

(9)

hot-spot user

desktop

ext. router

file server dep. server desktop desktop firewall access point BY0D user wifi user 3G user servizi in cloud Mr. MobileMalicious

3

rd

_party

• vettori:

• _chat

• _e-mail

• _{link su social network}

• _{MiTM / dns spoofing / ..}

• exploit:

• sito malicious ->

• app (pwned) ->

• kernel (pwned) ->

• r00t!!

(10)

hot-spot user

desktop

3

rd

_party

• classico “client side attack”:

• exploit app/lib

• _{(webkit, ..)}

• exec codice arbitrario

• _{-> kernel (syscall, ioctls, ..)}

• situazione no-win

• _{“non ci interessa”}

• però...:

• _{root -> controllo completo}

(11)

hot-spot user

desktop

ext. router

3

rd

_party

(12)

hot-spot user

desktop

3

rd

_party

(13)

hot-spot user

desktop

ext. router

3

rd

_party

• root -> controllo completo

• _{dati personali}

posta, documenti,

rubrica,calendario, ..

• intercettazioni

audio, video, messaging,

network, ..

• geolocalizzazione

foto, social network, ..

• credenziali

siti, posta, VPN, .. → cloud

storage

(14)

desktop

dep. server desktop desktop firewall access point BY0D user wifi user Mr. MobileMalicious

(15)

desktop

ext. router

file server dep. server desktop desktop firewall access point BY0D user wifi user Mr. MobileMalicious

OOB covert channel

(UMTS/GPRS/SMS/..)

(16)

hot-spot user

desktop

dep. server desktop desktop firewall access point BY0D user wifi user servizi in cloud

(17)

hot-spot user

desktop

ext. router

file server dep. server desktop desktop firewall access point BY0D user wifi user servizi in cloud

(18)

hot-spot user

desktop

dep. server desktop desktop firewall access point BY0D user wifi user servizi in cloud Mr. WifiMiTM

(19)

hot-spot user

desktop

ext. router

file server dep. server desktop desktop firewall access point BY0D user wifi user servizi in cloud Mr. WifiMiTM

no HTTPS (ahi ahi ahi)

MiTM

Hot Spot

Rogue APs

(20)

hot-spot user

desktop

(21)

hot-spot user

desktop

ext. router

(22)

hot-spot user

desktop

• MiTM (browser)

• no SSL?

• traffic mangling

• SSL?

• utente “continua”?

• game over

(23)

hot-spot user

desktop

ext. router

• MiTM (app)

• _{no SSL?}

• _{traffic mangling}

• _SSL?

• _{app verifica cert?}

• OK!

• app non verifica cert?

(24)

hot-spot user

desktop

• game over = traffic mangling

• sniffing

• _credenziali

• _dati

• _{reverse engineering}

• _{traffico/protocolli}

• _{business logic}

• _{analisi API/URL}

• _{rogue/fake app}

• _{HTML-like c.s. attacks}

• _{injection JS & co.}

• _{client side injection}

(25)

(26)

(27)

hot-spot user

desktop

ext. router

download .apk

(install app)

(28)

hot-spot user

desktop

• .apk

• download

• _{market install}

• _{adb pull}

• estrazione

• _{dex2jar, apk-extractor, ..}

• analisi

• risorse, manifest, ..

• decompilazione

• _{jd-gui, ypjd, ..}

(29)

hot-spot user

desktop

ext. router

(30)

hot-spot user

desktop

(31)

hot-spot user

desktop

ext. router

(32)

hot-spot user

desktop

• .apk

• analisi business logic

• _{broken/no auth}

• _{broken/no session management}

• _{credenziali/certificati}

• URL/API “privati”

• _{HTTP/JSON/XMLRPC/WS/..}

• _{SQL Injections}

• _{Path Traversal}

• _{Broken/no auth/session m.}

• ...

• _{custom/altri protocolli}

• _{reverse engineering}

•

(33)

hot-spot user

desktop

ext. router

(34)

hot-spot user

desktop

http://www.example.com/app/privateapi?user=paperino

http://www.example.com/app/privateapi?user=pluto

(35)

hot-spot user

desktop

ext. router

http://www.example.com/app/privateapi?user=paperino&pass=moo

http://www.example.com/app/privateapi?user=pluto'--&pass=boh

(36)

(37)

(38)

(39)

(40)

• sorgenti (AOSP), docs, SDK, NDK, emulatore, ..

• .apk → decompilazione, reversing, debug

• aggiornamenti OS, app e market alternativi

• permessi delle applicazioni “delegati” agli utenti

• Linux Kernel, ~ Linux userspace e librerie (e bug)

• exploit mitigation techniques (fail) (< 2.3, <

4.0.3)

• OOB “covert” channel (umts/gprs, SMS, ..)

(41)

• dati personali

(posta, documenti, rubrica,

calendario, ..)

• intercettazioni

(audio, video, messaging, network, ..)

• geolocalizzazione

(foto, social network, ..)

• credenziali

(siti, posta, VPN, ..)

→ cloud storage

• HTML-like client side attacks

• EvilApp want to eat your soul.. Install? YES!!!

• BY0D (Bring Your 0wned Device)

• banking OTP ($$)

(42)

• business logic esposta (client-side)

• -> device -> credenziali -> back-end

• -> device -> storage -> back-end

• credenziali e certificati hard-coded (.apk)

• no/lazy input validation

• no/broken authentication & session

management

(43)

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License.