Base platform • ARM core • Linux 2.6.3x kernel • Native Libraries • libc, WebKit, etc • Dalvik VM • Register-based VM • Runs dex bytecode • Applications • Developed in Java • Runs on Dalvik VM • Linux process 1-1
The Linux Kernel • Linux kernel = swiss cheese – Jailbreaks, aka local privesc, are plentiful – Mostly thanks to stealth/743C • Shameless plug! – If you care about kernel exploitation, come to:
Android Native Code • Dalvik VM != sandbox – Not limited to executing dex bytecode – Can pop out of the VM to execute native code – Any 3rd party app can root your phone by exploiting a kernel vulnerability via native code • Native code packaged within APKs – Android should do some code signing like iPhone – But it doesn't, so why limit execution of native code to build-time packaged modules?
RootStrap • Getting root is easy, but how do it most effectively as an attacker • Enter, RootStrap – Silent runtime fetching and execution of remote ARM payloads – Not really a bot..more of a general purpose distributed computing platform ;-)
Native ARM Code Delivery • Fetch index file – Lists available exploits and module names • Yank down ARM modules – Dumped to Android app private storage – eg. /data/data/org.rootstrap/files, not ./libs • Load via JNI and execute each payload – System.load(“.../files/root1.so”); – result = root1();
How to Build a Mobile Botnet • Build some fun legit-looking games / apps – Include RootStrap functionality – Periodically phone home to check for new payloads • As soon as new kernel vuln discovered, push out exploit payload – Before providers push out OTA patch – Trivial to win that race, slow OTA updates • Rootkit a bunch of phones!
A Wolf in Vampire's Clothing? • RootStrap app is boring and not sneaky – No one would intentionally download it – Need something legit looking to get a large install base • Hmm...what to do, what to do...
Andy and Jaime Don't Like It :-( • Still, 200+ downloads in under 24 hours • With a legit-looking app/game, you could collect quite an install base for RootStrap
Kernel Security Wrap-up • No excuses Google, it's 2011! – Harden your kernel / toolchain – Signed code restrictions a la iPhone • Supporting native code makes it worse – Packaging/install time: ok – Runtime native code delivery: not ok
Platform Security • There's a lot of “platform goo” in the middle between the kernel and applications • What to attack? – Not kernel, not apps! – How about permissions framework? • Permissions approval process – Intended to warn the user about potentially unsafe actions an app can perform
ACTUAL Market Flow • Google is a sneaky panda! – You don't actually download / install the app through the market application • When you click install in market app – Google servers push an out-of-band message down to you via persistent data connection – Triggers INSTALL_ASSET intent to start install – Intent handler fetches APK and installs
GTalkService Connection • Persistent data connection – Speaks XMPP – Same connection now used for C2DM push service • It's SSL, but... • If you MITM or C2DM spoof – Remote intent / app install • If you pop GTalkService servers – Push down code to all Android phones in the world
Market App Requests • What does the market app POST to the market server? • Can we spoof the same request and trigger an INSTALL_ASSET message and subsequent install?
Elements of a Install Request • We have the format of the request now! • Need to populate it with: – Lots of miscellaneous fields... – App ID: target app to be installed • Can be derived from dissecting market requests – Auth token: the hard part? • Turns out we can steal it from Android's AccountManager!
Bypassing Permissions Approval • Steal the “android” service token used by market from the AccountManager • Construct protobuf request to market servers for invoking an application installer • INSTALL_ASSET is pushed and app installed without any user prompt / permission approval • PoC disguised as an Angry Birds expansion app
pushed content to the browser – Centralization of apps & data – Always a push for MORE (ActiveX, applets, Flash) • Now, everyone gets their own app! – Code (not HTML) gets pushed to the endpoint – XKCD Viewer Broad Observations
Carrier Applications • “we trust you because you’re on our network” – Third-party Applications • SOMETIMES better than carrier apps – Incomplete support of open standards • Client-side data trust issues – admin=1 Broad Observations
can be a Binary RE ninja – ...and project timelines don’t allow for on-the-job training :-) • Sometimes the easiest way to understand an application is to look at its TRAFFIC • You need to be come the MITM – Just like WAPT, and Burp, WebScarab, etc. 48 Testing Techniques
Challenges! – Run the app in an emulator (boring) – Connect the phone to your own WAP • Uplink your WAP to your laptop with Internet sharing enabled – Run Wireshark – WiFi not always an option • Handset might not support WiFi • Application might require carrier network – Change server.carrier.com to testsite.com 49 Testing Techniques
client for Android • Originally written in Java, like most Android applications – Source available under Apache 2.0 license 21 Case Study: Foursquare Case Study: Foursquare
Foursquare API supports Basic Auth and OAuth… – OAuth includes signatures for transactions, helps prevent replay attacks, etc. – Guess which one foursquared uses Case Study: Foursquare
That’s right. HTTP Basic Auth…over plaintext transport • There’s a CWE for that! – CWE-311: Missing Encryption of Sensitive Data (including credentials) Case Study: Foursquare
Why is this a problem? – EVERYONE uses Foursquare • Well, maybe not you, but everyone else! – Most applications “prefer” WiFi to cell radio => trivial interception of creds • Funny enough, Foursquared has OAuth support – But it’s not actually used Case Study: Foursquare
application for storing and retrieving music, videos, documents, and more – Android, BREW, Blackberry, and fat web browser • Proprietary, binary-only 25 Case Study: Storage Application
Simple crash in storage quota viewer – Divide-by-zero error leads to DoS – Attacker must successfully intercept and modify server response for this to happen • A bit more difficult since this tends to occur over the carrier’s network, but WiFi is still an option Case Study: Storage Application
Diddling with “Digital Rights Management” – App supports sharing of video, audio, image content with your contacts – Enforces “DRM” on “protected” files • Often copyrighted or premium content – Enforcement occurs based on the value of an attribute in the file’s XML manifest • Yes, Virginia, that is under the user’s control Case Study: Storage Application
The “DRM” is basically enforced within the client, predicated on the response from the server – And that response can be intercepted and modified => “DRM” bypass • CWE-807: Reliance on Untrusted Inputs in a Security Decision – I like CWE, btw Case Study: Storage Application
other (malicious) apps can clobber widget content! – CWE-276: Incorrect Default Permissions – So we wrote a malicious app to do just that Case Study: App Framework
Lookout: World-Writable Files • Lookout installs with a world-writable config file and database – Independently discovered by Tavis Ormandy • Disable, lockout device, etc from any unprivileged app
• Tavis took it to the next level: – Backed up a custom shared lib, “liblookout.so” from a user-controlled directory – Restored into Lookout app's data/lib directory, overwriting legit “liblookout.so” – Security app → less secure phone Lookout: 0wned by Tavis
Lack of guidance, standards, practices makes developers reinvent the wheel – Or just make them think they need to • Neglecting the security lessons learned with “traditional” and web applications – Client-side trust – Access control issues – …and all of the other “basic” problems and mistakes of yore Application Security Wrapup
quine
kkamegawa
kzsuzuki
coosuke
rokuosan
.png){kind=icon}
pharma_x_tech
nagisa53
nishiuma
lycorptech_jp
mikanichinose
hakubishin3
oniak3ibm
rssytems
jacobian
reverentgeek
kastner
garrettdimon
nonsquared
marktimemedia
lauravandoore
brettharned
mraible
bluesmoon
chriscoyier
thoeni
