Bypassing Mobile Protections

Besides SP - 2022
Trilha Cybersecurity Girls

Transcript

1. Comunidade de mulheres em Cybersecurity 1
2. Bypassing Mobile Protections DAIANE SANTOS
3. Disclaimer: The content presented here is my responsibility and has nothing to do with the opinions of my employer.
4. Disclaimer 2: The content presented here is only created for educational purposes.
5. 02 01 whoami mobile timeline 03 owasp mobile top 10 04 protections 05 bypasses 06 contact what we have for today Agenda
6. Daiane Santos Mobile Security Engineer @ Nubank CTF Player and Captain @ RATF Autist AH/SD Enthusiast of Neuroscience I like chess whoami
7. 1987 Calls Mobira Cityman 900 First GSM (2G) phone Calls SMS 1992 1996 Vibrate Mode GSM SMS Calls 2000 FM Radio Opera mini web browser Camera Voice Recorder Vibrate Mode GSM (3G) SMS Calls 2007 First iPhone Apps A lot of new features Timeline Nokia 2110 Motorola StarTAC Nokia 3310 iPhone 2G
10. Reverse Engineering
11. Change .apk for .zip And you're be able to see all the folders, AndroidManifest, etc. easy "hack"
12. API calls or endpoints understanding the way some security controls are implemented root detection -> SuperUser hardcoded sensitive information inside the code backdoor accounts, API keys and secrets, passwords... interesting strings points of encryption and obfuscation so we can decrypt and de-obfuscate What we are looking for?
13. Activities: Broadcast receivers: Services: Components that provide a screen with which users can interact. Components that receive and respond to broadcast messages from other apps or from the operating system. Components that perform operations in the background. What we are looking for?
14. AndroidManifest.xml
15. MobSF
16. Frida.re
17. What we can do?
18. Magisk
19. MagiskSU: Magisk Modules: MagiskBoot: Zygisk: Provide root access for applications Modify read-only partitions by installing modules The most complete tool for unpacking and repacking Android boot images Run code in every Android applications' processes What we can do?
20. What we can do?
21. Contact me: @Wh0isdxk Questions