Reverse Engineering Android Applications

Download Reverse Engineering Android Applications

Post on 15-Jul-2015

246 views

Category:

Mobile

5 download

Embed Size (px)

TRANSCRIPT

<ul><li><p>Reverse Engineering Android Applications</p><p>Daniele Altomaredaniele.altomare@sysmosoft.com</p><p>@danielealtomare</p></li><li><p>CURRENT SECURITY STATUS</p><p>According to the Google Android Security 2014 Final Report:</p><p> Over 1 billion devices run Google Play which conducts 200 million security scans ofdevices per day.</p><p> Fewer than 1% (up to 10 million devices) of Android devices had a Potentially Harmful App(PHA) installed in 2014. Fewer than 0.15% of devices that only install from Google Play hada PHA installed.</p><p> The overall worldwide rate of Potentially Harmful Application (PHA) installs decreased bynearly 50% between Q1 and Q4 2014.</p><p> SafetyNet checks over 400 million connections per day for potential SSL issues.</p><p> Android and its partners responded to 79 externally reported security issues, and over25,000 applications in Google Play were updated following security notifcations fromGoogle Play.</p><p> Rooted Android devices contain 2x more malware.</p></li><li><p>OWASP TOP 10 MOBILE RISKSOpen Web Application Security Project is an open community dedicated toenabling organizations to conceive, develop, acquire, operate, and maintainapplications that can be trusted.</p><p>M1: Weak Server Side ControlsM2: Insecure Data StorageM3: Insufficient Transport Layer ProtectionM4: Unintended Data LeakageM5: Poor Authorization and AuthenticationM6: Broken CryptographyM7: Client Side InjectionM8: Security Decisions Via Untrusted InputsM9: Improper Session HandlingM10: Lack of Binary Protections</p></li><li><p>LACK OF BINARY PROTECTION</p><p>Threat Agents Application Specifc Analyze and reverse engineer applicationcode, then modify it.</p><p>Attack Vectors ExploitabilityMediumUse a set of tools to reverse engineer thecode and modify it using malware toperform some hidden functionality.</p><p>Security Weakness</p><p>PrevalenceCommon</p><p>It is extremely common for apps to bedeployed without binary protection.</p><p>DetectabilityEasy</p><p>It is diffcult to detect that an adversary hasreverse engineered an apps code.</p><p>Technical Impacts ImpactSevereThe majority of mobile apps do not preventreverse engineering.</p><p>Business Impacts Application / BusinessSpecifc</p><p>Typical business impacts: Confdential Data Theft Unauthorized Access and Fraud Brand and Trust Damage Revenue Loss and Piracy Intellectual Property Theft User Experience Compromise</p></li><li><p>PROCESS</p><p>Profling StaticanalysisDynamicanalysis Tampering</p><p>Gather initial informationabout the targetapplication:</p><p> Info about developer Application</p><p>dependencies Use of particular</p><p>SDKs, libraries or webservices</p><p> Permissions list</p><p>Analyze code and data of theapplication without actuallyexecuting it.</p><p>Identify hard-coded values suchas URIs, keys or credentials.</p><p>Decompile the APK withapktool to get access to thesource code (smali format) andapplication XMLs (such as theAndroidManifest and layouts).</p><p>Use AndroGuard to get moreinsight and information aboutthe application.</p><p>Execute the application in aninstrumented or monitoredversion to get more preciseinformation on its behavior:</p><p> Monitor network traffic Monitor processes Search for data left on the</p><p>file system</p><p>Code manipulation orinjection.</p><p>This can be performedmodifying directly the smalifiles or using one of theseframeworks:- Soot- Javassist- AspectJ</p></li><li><p>ANATOMY OF AN APK</p><p>APK format is an extension of the Java JAR format, which is an extension of the ZIP fle.AndroidManifest.xmlclasses.dexresources.arscassetslibresMETA-INF</p><p>which declares package name, version, components, and other metadata of theapplication.</p><p>executable code of the application in DEX format for the Dalvik VM.</p><p>packages all compiled resources of the application such as strings and styles. </p><p>raw assets of the application (fonts, videos, music fles, ...).</p><p>native libraries used by application through JNI interface.</p><p>application resources (strings, animations, images, layouts, ...).</p><p>package manifest fle and code signatures.</p></li><li><p>DEMO</p><p>Demo application:https://github.com/fasteque/VoxxedTicino2015</p><p>StaticanalysisAPK TamperingIdentify points of interest:- root detection- fle downloadAPK</p><p>- bypass root detection- download fle on the public storageNo source code!</p></li><li><p>QUICK WINS Obfuscate and shrink your code using one of the many</p><p>Java/Android obfuscators available in the market.They convert all variable and method names into one or two character strings and some alsochange the flow of the code.It will not stop hackers from understanding your code but it will make it harder.</p><p> ProGuard is free, ships with the Android SDK and is easy toenable.</p><p> However ProGuard is not enough, it mostly scrambles identifers.An alternative is DexGuard (commercial), an enhanced version ofProguard.It supports encryption for strings, classes, native libraries and assets, XML resources obfuscationand many other features.</p></li><li><p>QUICK WINS Dynamic bytecode loading.</p><p>Additional bytecode can be loaded at runtime using the DexClassLoader: a class loader that loadsclasses from .jar and .apk fles containing a classes.dex entry. This can be used to execute codenot installed as part of an application .It can be encrypted in the original APK and stored as an asset or downloaded at runtime.</p><p> Integrity checks at runtime.Validate the signature of the application.</p><p> Use the NDK to protect your business logic and data.Obfuscators only protect you from decompiling an APK but not from disassembling it.</p></li><li><p>DO NOT ROOT YOUR DEVICE!You give malware the rights to execute harmful code... programmatically too:Runtime.getRuntime().exec(...);</p><p>Remove the lock pattern security protectionshell@android:/data # cd /data/systemshell@android:/data/system # rm gesture.key</p><p>Copy application databases manuallyfind . -name "*.db" -type f -exec cp {} /mnt/sdcard/DB_COPY \;</p></li><li><p>FINAL TIPS Protect your sensitive data using SQLCipher, an open source</p><p>encrypted SQLite database.</p><p> Do I want to let my application run on rooted devices?</p><p> Do not underestimate security of your app</p><p> Think about which security level you really need</p><p> Implement best practices</p><p> Review, test and audit your code</p><p> Always check your APK package fle before release.</p></li><li><p>THANK YOU!</p><p>Slide 1Slide 2Slide 3Slide 4Slide 5Slide 6Slide 7Slide 8Slide 9Slide 10Slide 11Slide 12</p></li></ul>