Slides from a presentation at the Rochester Security Summit.

1. Tools and Techniques Related To
1

2.  RIT Alum
 Intrepidus Group
 Interlock Rochester
 Rochester 2600
 TOOOL
 BSidesROC
@antitree
antitree.com
2

3.  Android Introduction
 Tools For Hackers
 Analysis Techniques
 Examples
 How to be “secure”
3

4. Other, Honeycomb
Cupcake
1% Donut
6% 1%
2%
Blackberry,
9% Eclair
15%
Gingerbread
25%
iOS, 28% Android,
56%
Froyo
56%
4

6.  Linux 2.6
 Dalvik Virtual Machine – new instance for
each app
 DEX – Dalvik byte code
 APK - zip
 AndroidManifest.xml
Dalvik
Java APK
Byte Code
6

7. Linux
Angry Birds app_42
Dalvik VM Instances

8.  Intents – inter process communication
 Activities - screen
 Content Providers – sqlite3 database
 Services – background processes
 Broadcasts – send and receive info to other
apps
8

9. • Dynamic Network Analysis
• Static Code Review
• File System Auditing
9

10.  Android SDK
 ADB
 DDMS
 Emulator
 Apktool
 Smali/Baksmali
 Dex2jar
 Java Decompiler (e.g. JAD or JD-GUI)
 Mallory
 Burpsuite
 Wireshark
10

11.  Java source code vs Smali files vs DEX vs jar
vs pseudocode
 Android development
 Java
 Linux
11

12. 12

13.  Watch Traffic flow through a MITM
 Things to look for:
 Information being passed in the clear
 SSL usage and whether it’s done correctly
 Results of modifying requests and responses
 Authentication process
13

14. Wireless Router Emulator PPTP server
DDWRT/TOMATOE Android SDK PPTPD
Usually need a clunky device Sometimes doesn’t act the Dedicated server
way you want it
14

15. #!/bin/bash
# firewall script to intercept all traffic from ppp0 and redirect to local port
# all credit to the great algorythm
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -j REDIRECT -i ppp0 -p tcp --dport 80 -m tcp --to-ports
8080
iptables -t nat -A PREROUTING -j REDIRECT -i ppp0 -p tcp --dport 443 -m tcp --to-
ports 8080
15

16.  Wireshark
 Initial traffic fingerprinting
 Burpsuite
 Great for HTTP/S traffic
 Mallory
 Great for nonspecific protocols
16

17. 17

18.  Audit how data is stored
 Things to look for:
 Incorrect permissions
 Storage location (data, sdcard, asec)
 Tools
 Adb shell
 Standard linux commands
 [Root exploit and busybox]
18

19. 19

20. 20

21.  See how the app works through pseudocode
 Things to look for:
 Overall understanding of the app
 Cryptographic functions
 Debug/Testing functions
 Client side authentication
21

22.  Tools:
 Apktool d com.antitree.app
 Smali path/to/smali/files/
 Dex2jar out.dex
 Jd-gui out_dex2jar.jar
APK DEX Jar Pseudocode
Smali
22

23. Reverse engineering is neat

24. 24

25. 25

26. But what does it mean?
26

27.  Skype: 4/11
 Permissions error allowed a malicious app to
access contacts and personal information
 Google: 6/11
 Session information passed in the clear made it
susceptible to hijacking
 Dropbox: 8/11
 An attempt to share data granted any app to the
ability to make file public
27

28.  HTC: 10/11
 Spyware Logging app found to be accessible to
any app with the network connection permission
▪ GPS coordinates
▪ MEID, MDN
▪ phone logs
▪ MUCH more
 *#*#HTCLOG#*#*
28

29. 100,000 installations
29

30.  File System Permissions Set to 777
 Access saved sessions
 Modify included binaries
 Why: Lazy permissions
 How discovered: file system permission
review
30

31. SSHUNTUNNEL

32.  Shares information
 Controls permissions
 Tool: Android Manifest Auditor
Code Name: The Jaku
32

33. 33

34. 1. Insecure Data Storage
2. Weak Server Side Controls
3. Insufficient Transport Layer Protection
4. Client Side Injection
5. Poor Authorization and Authentication
6. Improper Session Handling
7. Security Decisions Via Untrusted Inputs
8. Side Channel Data Leakage
9. Broken Cryptography
10. Sensitive Information Disclosure
34

35.  Deploy mobile device management solution
 Zenprise, MobileIron, (Google?)
 Train your users – don’t give in
 Audit your devices
 Are users following best practices?
 What apps are installed?
 Require mobile security solution
 Lookout, WaveSecure, NetQin
35

36.  Audit your apps!
 Check permissions
 Check source code
 Analyze your traffic
 Think before you Root
 Security Software
 Remote wipe
 Malware detection
36

37. Coincidence?
37

38. Slides and app available at
www.antitree.com
38

39.  http://www.intrepidusgroup.com/insight/
 http://code.google.com/p/android-apktool/
 http://code.google.com/p/smali/
 http://code.google.com/p/dex2jar/
 http://java.decompiler.free.fr/?q=jdgui
 http://developer.android.com/sdk
39

40. 40