SLIDE 1
DeepSec 2014
Cheating Platform on Android Milan Gabor & Danijel Grah / W - - PowerPoint PPT Presentation
Cheating Platform on Android Milan Gabor & Danijel Grah / W - - PowerPoint PPT Presentation
Creating a kewl and simple Cheating Platform on Android Milan Gabor & Danijel Grah / W hoAreW e > Just two guys from Slovenia > Having fun breaking stuff > Love to play with apps > BSidesLV, DEF CON W all of Sheep,
SLIDE 2
SLIDE 3
DeepSec 2014
Famous . si people
SLIDE 4
DeepSec 2014
Famous . si people
SLIDE 5
DeepSec 2014
Agenda
> Android mobile apps > Analysis (static, dynamic) > Vaccinating APK, Android > DEMO > DEMO > DEMO > The end
SLIDE 6
DeepSec 2014
SLIDE 7
DeepSec 2014
Status 2013/ 2014
SLIDE 8
DeepSec 2014
SLIDE 9
DeepSec 2014
Our story
SLIDE 10
DeepSec 2014
> YES, we can! > W e want something that works! > W e want to test mobile apps!
SLIDE 11
DeepSec 2014
> Living inside of APK > Changing and accesing variables > Executing code at runtime > Effectively and easy to use > Java based
SLIDE 12
DeepSec 2014
Demo/ Video
SLIDE 13
DeepSec 2014
> Java code is obfuscated > Static analysis > Dynamical analysis > W hat if > Hard time
SLIDE 14
DeepSec 2014
SLIDE 15
DeepSec 2014
Testing app/ 1
> Get the APK > Unpack > Decompile > Check code > Identify important segments
SLIDE 16
DeepSec 2014
Demo 1
SLIDE 17
DeepSec 2014
Testing app/ 2
> Start simulator with proxy > Install app in emulator or device > Use W ireshark, Fiddler &/ || Zap &/ || Burp to monitor network > Run app > See logs, dump, crashes, files
SLIDE 18
DeepSec 2014
Request
SLIDE 19
DeepSec 2014
Reply
SLIDE 20
DeepSec 2014
Dictionary
> Dynamical analysis > Reflection > BeanShell > Combination of static/ dynamic
SLIDE 21
DeepSec 2014
Reflection
> " Reflection" is a language' s ability to inspect and dynamically call classes, methods, attributes, etc. at runtime. > Java looking Java
SLIDE 22
DeepSec 2014
BeanShell
> Java Interpreter > Scripting Language > Small > Embeddable / Extensible > A natural scripting language for Java
SLIDE 23
DeepSec 2014
SLIDE 24
DeepSec 2014
SLIDE 25
DeepSec 2014
SLIDE 26
DeepSec 2014
Vaccine
SLIDE 27
DeepSec 2014
. / vaccine i game. apk
SLIDE 28
DeepSec 2014
. / vaccine i game. apk
SLIDE 29
DeepSec 2014
. / vaccine i game. apk
SLIDE 30
DeepSec 2014
Vaccine UI
SLIDE 31
DeepSec 2014
Disclaimer
This presentation was created for educational purposes. W e will not take any responsibility for any action you cause using the information shown in this
- presentation. Please do not contact us
with blackhat type hacking requests. Thanks!
Original taken from: http: / / www. lo0. ro/
SLIDE 32
DeepSec 2014
Demo(s)
. / vaccine -i android. apk -p 8888
SLIDE 33
DeepSec 2014
SLIDE 34
DeepSec 2014
SLIDE 35
DeepSec 2014
SLIDE 36
DeepSec 2014
Dictionary
> ADBI, DDI > Zygote > Shared libraries > Hooking > JNI and native functions
SLIDE 37
DeepSec 2014
Injecting vaccine at runtime
> > Prepared shared library with DDI framework > Zygote > W hen Zygote specializes the shared libary is loaded into target proces and executed > (hooks) android. app. Activity onStart method > Native methods loads classes from / data/ dalvi- cache/ vaclasses. dex (Vaccine service, Beanshell) > Native method gives execution over to original method > Connect and use Vaccine as before
SLIDE 38
DeepSec 2014
Demo
> Is it possible to inject Vaccine into Google Apps at runtime?
SLIDE 39
DeepSec 2014
Pros/ cons APK Android
> APK
» No need for rooted phone » Untrusted sources » Download, modify, upload
> Android
» No need for APK modification » Rooted phone » Injecting shared libs (more skills needed)
SLIDE 40
DeepSec 2014
SLIDE 41
DeepSec 2014
Possible usage
> Not only for Android > Reflection is still NOT dead > Tested with Oracle Foms > Have idea to use it with other Java apps/ applets (Minecraft maybe)
> SIMPLE and Ultimate cheating platform
SLIDE 42
DeepSec 2014
Final thoughts
> One script, small GUI tool (never be finished) > Help testers, researchers (hackers, cheaters) > Open for suggestions, improvements, comments
SLIDE 43
DeepSec 2014
SLIDE 44
DeepSec 2014
- www. github. com/ viris