Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
[WeAreDevelopers World Conference] Reversing An...
Search
Marc Obrador
June 30, 2021
Programming
0
590
[WeAreDevelopers World Conference] Reversing Android Apps
Marc Obrador
June 30, 2021
Tweet
Share
More Decks by Marc Obrador
See All by Marc Obrador
[Droidcon London 2023] REST in Peace: A Journey Through API Protection
marcobrador
0
88
[Droidcon Berlin 2023] Obfuscation in Mobile Apps
marcobrador
0
1.2k
[mDevCamp 2020] Reversing Android Apps
marcobrador
3
2.7k
Introduction to Mobile App Security
marcobrador
2
370
[ICE71 CyberSecurity Networking Night] Mobile App Security: A developer's introduction
marcobrador
0
770
[GDG BCN 2019] Introduction to Android App Security
marcobrador
1
870
[DroidCon Lisbon 2019] Intro to Android App Security
marcobrador
2
440
Other Decks in Programming
See All in Programming
GitHub Actionsのキャッシュと手を挙げることの大切さとそれに必要なこと
satoshi256kbyte
5
390
Kotlin2でdataクラスの copyメソッドを禁止する/Data class copy function to have the same visibility as constructor
eichisanden
1
140
外部システム連携先が10を超えるシステムでのアーキテクチャ設計・実装事例
kiwasaki
1
230
Boost Performance and Developer Productivity with Jakarta EE 11
ivargrimstad
0
870
VR HMDとしてのVision Pro+ゲーム開発について
yasei_no_otoko
0
100
[PyCon Korea 2024 Keynote] 커뮤니티와 파이썬, 그리고 우리
beomi
0
110
シールドクラスをはじめよう / Getting Started with Sealed Classes
mackey0225
3
400
CPython 인터프리터 구조 파헤치기 - PyCon Korea 24
kennethanceyer
0
250
のびしろを広げる巻き込まれ力:偶然を活かすキャリアの作り方/oso2024
takahashiikki
1
410
とにかくAWS GameDay!AWSは世界の共通言語! / Anyway, AWS GameDay! AWS is the world's lingua franca!
seike460
PRO
1
550
Outline View in SwiftUI
1024jp
1
160
Golang と Erlang
taiyow
8
1.9k
Featured
See All Featured
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
31
2.7k
Building Your Own Lightsaber
phodgson
102
6.1k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
27
4.2k
A Philosophy of Restraint
colly
203
16k
Stop Working from a Prison Cell
hatefulcrawdad
267
20k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
167
49k
Adopting Sorbet at Scale
ufuk
73
9k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
46
2.1k
Building Better People: How to give real-time feedback that sticks.
wjessup
363
19k
Building a Scalable Design System with Sketch
lauravandoore
459
33k
Imperfection Machines: The Place of Print at Facebook
scottboms
264
13k
10 Git Anti Patterns You Should be Aware of
lemiorhan
654
59k
Transcript
Reversing Android Apps
Marc Obrador Lead Architect @ Build38 Barcelona
[email protected]
@marcobrador /in/marc-obrador
None
Source: https://en.wikipedia.org/wiki/Reverse_engineering It’s illegal (in the EU)!
None
Josep Bernad iOS Albert Sunyer UI
Artà is in Mallorca ABF takes place (usually) in June
COVID-19 pushed it to … ?
None
Get to know the app Step 0
Get to know the app
Get to know the app
Get to know the app
Get to know the app
Static Analysis Step 1
Static Analysis
Getting the APK
Decompiling the app https://ibotpeaches.github.io/Apktool/ $ brew install apktool
Decompiling the app
None
None
None
None
None
Let’s keep looking around
Wait… “discount codes”?
App users get a discount for events
None
Let’s take a closer look…
None
HTTP Basic Authorisation = Base64(“username:password”)
None
HTTP Basic Authorisation = Base64(“username:password”) username = “string1” xor “string2”
pasword = “string3” xor “string2”
None
Protecting against static analysis ProGuard is a good start… for
regular apps • It’s just method renaming and code shrinking • Tools for reversing ProGuard exist: http://apk-deguard.com/ Other (paid) alternatives exist for obfuscation Writing sensitve code in native (NDK) is a good idea
Dynamic Analysis Step 2
Dynamic Analysis
Dynamic Analysis
Network Sniffing a.k.a MITM
Network Sniffing https://www.charlesproxy.com/
Setting Up Charles Proxy
Setting Up Charles Proxy
Setting Up Charles Proxy
First attempt…
First attempt…
Setting Up Charles Proxy
Setting Up Charles Proxy
Let’s try again…
None
None
None
None
None
• Use certificate pinning • Implement Root/Debugger/Emulator/Hooking Framework detection •
Try to detect app tampering Protecting against dynamic analysis
Using Certificate Pinning Source: https://developer.android.com/training/articles/security-config
Tampering with the App Step 3
Assuming the app implemented Certificate Pinning…
$ adb install “Downloads/Artà Beer Festival_v1.2.5_apkpure.com.apk” Performing Streamed Install Success
$ adb shell am start com.marcobrador.android.artabeerfestival/.SplashActivity Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category .LAUNCHER] cmp=com.marcobrador.android.artabeerfestival/.SplashActivity }
Let’s try to remove it
None
None
None
Time to give it a try!
None
None
Preventing Repackaging
Looks like we are done here Looks like we are
done here
This code can be removed, too!
Closing Thoughts
None
None
None
Thank you!