Recomendados
Recomendados
Mais conteúdo relacionado
Destaque
Destaque (6)
Semelhante a Zarafa SummerCamp 2012 - Android Workshop
Semelhante a Zarafa SummerCamp 2012 - Android Workshop (20)
Mais de Zarafa
Mais de Zarafa (20)
Último
Último (20)
Zarafa SummerCamp 2012 - Android Workshop
- 1. Freek Kauffmann Paul Lammertsma Workshop Build an app that reveals security holes on Android
- 2. Before we start 1. Connect to the open wireless network 2. Android setting: allow non-market applications 3. Download AIDE from Google Play
- 7. APPS!
- 8. Android • What are the security principles of Android? – POSIX based (Linux) – User IDs and File Access – Permissions – Application signing (identifies developer) – Sandboxing (application isolation)
- 9. Android • Implications of rooting your device? – You can modify the Operating System – You can replace all applications – Access all application data – Grant/revoke permissions – Send data to and from the phone • Others (malicious software?) can do the same!*
- 10. Android • Facebook SDK exploit (April, David Poll) – Logcat – Let’s hack this!
- 11. We’ll make an app that… • Steals Facebook login from bonafide apps – Draw Something Free – Hootsuite – Facebook Marketplace (Oodle) – Soundhound – LauncherPro – Sleepy Jack – Airport City, Diamonds Blaze and others by Game Insight
- 13. https://github.com/pflammertsma/FacebookThief.git continues on next slide…
- 15. Facebook Thief Tap to enable the background service
- 16. Freek Kauffmann Paul Lammertsma freek.kauffmann@itq.nl paul@pixplicity.com
Notas do Editor
- ZSC speakers / speakersonly
- 2:We’ll be installing an app outside of Google Play (because we’re building it from source!); don’t forget to restore the setting after the workshop
- Sindsdien allerlei apps – van lollig tot onmogelijkRepudo – speelse app – KLM wereldweken, uniek nummer van Anouk, gratis Android telefoonSmart calls – Voorbeeld van het onmogelijkeSlechte Dekking – Spierballen van Android
- *) although most rooting methods install Superuser, an app that shows a permission prompt when a `su` command executes
- David Poll (Parse.com): “Logcat is not a safe place to put sensitive data, but it's easy to mistakenly assume that only developers will see this.”
- Audience: test any app that uses Facebook to log in (i.e. Facebook app)
- Copy the link, don’t visit it!Don’t forget it’s ‘https’Don’t forget the ‘.git’ at the endMind the capitalization