MAN IN THE BINDER: HE WHO CONTROLS IPC, CONTROLS THE DROID Everything Goes Through The Binder
A Hack in Three Acts Act I – Know Your Droid Act II – Atuack Your Droid Act III – Prepare Your Droid
Meet The Cast
The Authors Nitay Artenstein Idan Revivo Michael Shalyt
Victim App Name: Kituy Bank Occupatjon: Bank Applicatjon “U want KitCoins – we haz it”
n00b attacker Name: Kituy-ninja Occupatjon: Script kiddy “Mommy, can I rob this bank?”
Ninja Attacker Name: Paw of Death Occupatjon: Black belt ninja hacker “To rob a bank, you must fjrst become the bank”
System Services Name: System Service Occupatjon: Sittjng and waitjng to serve your needs These things run Android!
The Linux Kernel Name: $ echo `uname –r` Occupatjon: Holding the world on its shoulders since 1.1.1970 Feeling neglected now that system services get all the atuentjon on Android
The Binder Name: The Binder Occupatjon: All Powerful ? Mystery Character Everything Goes Through The Binder
Act I Know Your Droid
An Applicatjon’s Life On Windows Syscalls
An Applicatjon’s Life On Android ? Syscalls Syscalls Syscalls
Android – The Real Picture ? Syscalls Syscalls Everything Goes Through The Binder
Bank Applicatjon Process System Service Process • Binder has a userland DalvikVM DalvikVM component and a kernel applicatjon applicatjon System Service System Service one System services System services proxy proxy • The driver receives the libandroid_runtjme.so libandroid_runtjme.so Parcel via an ioctl syscall libandroid_runtjme.so /system/lib*.so libandroid_runtjme.so /system/lib*.so and sends it to the target libbinder.so /system/libbinder.so libbinder.so /system/libbinder.so kernel processes syscall parcel parcel /dev/tuy0 /dev/binder
What’s a Parcel?
A Short Recap Audio Manager Kituy Bank Process DalvikVM Parcels Syscalls Parcels libbinder.so libbinder.so
Everything Goes Through The Binder
Act II Attack Your Droid
Round I Key Logging
A n00b Atuacker’s View of The System ?
What Would The n00b Atuacker Do? !
What Would The n00b Atuacker Do? !
What Would The n00b Atuacker Do? !@#$
A Ninja Atuacker’s View of The System ? Everything Goes Through The Binder
What Would The Ninja Atuacker Do? !
Key Logger Demo
What Would The Ninja Atuacker Do? w00t
Round II Data Manipulatjon
A n00b Atuacker’s View of The System ? Actjvity Actjvity Actjvity
What Would The n00b Atuacker Do? Bye Kituy Bank , Hello Shi**y Bank !
What Would The n00b Atuacker Do? Bye Kituy Bank , Hello Shi**y Bank !@#$
A Ninja Atuacker’s View of The System Actjvity Manager ? Everything Goes Through The Binder
In-app data goes through Binder???
A Ninja Atuacker’s View of The System Actjvity Manager ?
What Would The Ninja Atuacker Do? Actjvity Manager !
A trillion dollars, anyone?
Data Manipulatjon Demo
What Would The Ninja Atuacker Do? w00t
Round III Interceptjng SMS
A n00b Atuacker’s View of The System ? Telephony Manager
What Would The n00b Atuacker Do? ! Just Ask Politely
What Would The n00b Atuacker Do? !@#$ Just Ask Politely
A Ninja Atuacker’s View of The System ? Telephony Manager Everything Goes Through The Binder
What Would The Ninja Atuacker Do? !
SMS internals • The Telephony Manager notjfjes the SMS app whenever an SMS is received • The app queries the TM’s database via Binder:
SMS internals • But what’s a Cursor object? • It’s a messy abstractjon of a response to a query
SMS internals • Surprise: Under the hood, it’s just a Unix fd • Now we’re in business!
What Would The Ninja Atuacker Do? w00t
Summary What Just Happened?
Atuacking The Binder • Hook libbinder.so at the point where it sends an ioctl to the kernel • Stealth: dozens of places to hook • But don’t you need root?
Atuacking The Binder Vulnerable to known rootjng exploits
Consider The Possibilitjes
Summary Features: • Versatjlity: one hook – multjple functjonalitjes. • App agnostjc: no need to RE apps. • Stealth: the Android security model limits 3 rd party security apps just like any other app.
Summary • This is NOT a vulnerability. It’s like man-in-the- browser, but for literally everything on Android. • Root is assumed. Rootjng won’t go away any tjme soon.
Rumors (You didn’t hear it from me…)
What are you trying to tell me? That I can get all permissions on a device? No. I’m trying to tell you that when you’re ready, you won’t have to
Act III Preparing Your Droid
Solutjons – for developers • Take control of your own process memory space. • Minimize the amount of data going to IPC, and encrypt what has to go.
Solutjons – for security industry • Scan fjles like it’s the 90’s. • Be brave – get root yourself: • Runtjme process scanning and monitoring. • Sofuware fjrewall (like Avast). • Binder fjrewall/anomaly detectjon. • Etc.
Further Reading [1] White paper: “Man in the Binder”, Artenstein and Revivo [2] “On the Reconstructjon of Android Malware Behaviors”, Fatori, Tam et al [3] “Binderwall: Monitoring and Filtering Android Interprocess Communicatjon”, Hausner
Recommend
More recommend
