evil maid on droids or why you should never loose your android - - PowerPoint PPT Presentation

▶
evil maid on droids
SMART_READER_LITE
LIVE PREVIEW

evil maid on droids or why you should never loose your android - - PowerPoint PPT Presentation

Jan 17, 2024 444 likes •1.31k views

evil maid on droids or why you should never loose your android smartphone @f0rki 2012-12-06 Agenda evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself 2 / 51 Agenda

slide-1
SLIDE 1

evil maid on droids

  • r why you should never loose your android smartphone

@f0rki 2012-12-06

slide-2
SLIDE 2

Agenda

evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself

2 / 51

slide-3
SLIDE 3

Agenda

evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself

3 / 51

slide-4
SLIDE 4

evil maids

wat?

4 / 51

slide-5
SLIDE 5

evil maids

wat?

  • 1. device left at hotel room

4 / 51

slide-6
SLIDE 6

evil maids

wat?

  • 1. device left at hotel room
  • 2. maid comes in

4 / 51

slide-7
SLIDE 7

evil maids

wat?

  • 1. device left at hotel room
  • 2. maid comes in
  • 3. maid installs malware, fetches data, etc.

4 / 51

slide-8
SLIDE 8

evil maids

wat?

  • 1. device left at hotel room
  • 2. maid comes in
  • 3. maid installs malware, fetches data, etc.
  • 4. ???

4 / 51

slide-9
SLIDE 9

evil maids

wat?

  • 1. device left at hotel room
  • 2. maid comes in
  • 3. maid installs malware, fetches data, etc.
  • 4. ???
  • 5. PROFIT!!!

4 / 51

slide-10
SLIDE 10

targets

laptop is classic target full disk encryption as mitigation 5 / 51

slide-11
SLIDE 11

targets

laptop is classic target full disk encryption as mitigation modify unencrypted bootloader/kernel 5 / 51

slide-12
SLIDE 12

targets

laptop is classic target full disk encryption as mitigation modify unencrypted bootloader/kernel secure boot as mitigation EFI SecureBoot on x86 PCs/Notebook Reduced access on embedded devices 5 / 51

slide-13
SLIDE 13

a new victim arises

6 / 51

slide-14
SLIDE 14

a new victim arises

picture: thx sofie <3

6 / 51

slide-15
SLIDE 15
slide-16
SLIDE 16

Agenda

evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself

8 / 51

slide-17
SLIDE 17

partition layout

/system: OS binaries and config, android, framework /data: user-installed apps, all user data boot: kernel, fs root / recovery: recovery system cache: dalvik cache, other cached data /sdcard /mnt/storage: music, videos, whatever . . .

Actual layout depends on device

9 / 51

slide-18
SLIDE 18

android boot process

for HTC/Qualcomm devices:

  • 1. baseband processor starts primary boot loader (PBL)

10 / 51

slide-19
SLIDE 19

android boot process

for HTC/Qualcomm devices:

  • 1. baseband processor starts primary boot loader (PBL)
  • 2. PBL starts secondary boot loader (SBL)

10 / 51

slide-20
SLIDE 20

android boot process

for HTC/Qualcomm devices:

  • 1. baseband processor starts primary boot loader (PBL)
  • 2. PBL starts secondary boot loader (SBL)
  • 3. app processor bootup – HBOOT bootloader

10 / 51

slide-21
SLIDE 21

android boot process

for HTC/Qualcomm devices:

  • 1. baseband processor starts primary boot loader (PBL)
  • 2. PBL starts secondary boot loader (SBL)
  • 3. app processor bootup – HBOOT bootloader
  • 4. HBOOT loads kernel/recovery

10 / 51

slide-22
SLIDE 22

security? – locked bootloaders

for HTC/Qualcomm devices:

  • 1. baseband processor starts primary boot loader (PBL)

verifies signature of sbl

  • 2. PBL starts secondary boot loader (SBL)

verifies baseband code and HBOOT

  • 3. app processor bootup – HBOOT bootloader
  • 4. HBOOT loads kernel/recovery

verifies signature on kernel/recovery

11 / 51

slide-23
SLIDE 23

bootloader unlocking

disables signature checking/verification in boot process allows booting of third-party code → yay, custom ROMS! 12 / 51

slide-24
SLIDE 24

bootloader unlocking

disables signature checking/verification in boot process allows booting of third-party code → yay, custom ROMS! bootloader unlocking using fastboot tool

f a s t b o o t oem unlock

usually does factory reset erases /data/ remove device settings (e.g. saved wifi passwords) might need some proprietary tool or an exploit for unlocking 12 / 51

slide-25
SLIDE 25

HTC S-ON/S-OFF

system, kernel, recovery is hardware-write-protected “temp root” – rooted phones will be unrooted at next boot bootloader unlocking – S-OFF submit device-specific token flash signed blob voids warranty unpublished exploit: revolutionary 13 / 51

slide-26
SLIDE 26

fastboot and co

fastboot “standard” protocol from AOSP implemented in app processor bootloader (e.g. HBOOT) can flash images to partitions can directly boot kernels

  • ther proprietary protocols/tools exist

nvflash for Tegra devices

  • ld Motorola: SBF + miniloader

flash images via usb-exported-ramdisk (archos)

  • etc. . .

14 / 51

slide-27
SLIDE 27

Agenda

evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself

15 / 51

slide-28
SLIDE 28

assumptions

device has set a PIN/password/pattern else you are totally f**cked anyway face-unlock also sucks typical smartphone usage google, facebook, twitter account set up access to storage device not possible because of encryption hardware protection attacker can’t solder ;) 16 / 51

slide-29
SLIDE 29

Agenda

evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself

17 / 51

slide-30
SLIDE 30

prerequisites

stock ROM no adb no root 18 / 51

slide-31
SLIDE 31

pull sdcard

19 / 51

slide-32
SLIDE 32

pull sdcard

how?

pull sdcard dump everything 20 / 51

slide-33
SLIDE 33

pull sdcard

how?

pull sdcard dump everything

what?

personal data (pictures, music) apps2sd e.g. /sdcard/Android/data/ app backups probably nothing really critical company phone – company data??? 20 / 51

slide-34
SLIDE 34

what about nexus s?

there’s no sdcard! 21 / 51

slide-35
SLIDE 35

what about nexus s?

there’s no sdcard!

  • nly internal storage

accessible via media transfer protocol (mtp) access only when unlocked restricted access to data 21 / 51

slide-36
SLIDE 36

smudge patterns I

22 / 51

slide-37
SLIDE 37

smudge patterns II

23 / 51

slide-38
SLIDE 38
  • ld news. . . boring stuff. . .

24 / 51

slide-39
SLIDE 39

Agenda

evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself

25 / 51

slide-40
SLIDE 40

prerequisites

phone used personally and for development stock ROM no root adb enabled 26 / 51

slide-41
SLIDE 41

install malware

create and install malicious app pulling all possible data

adb i n s t a l l com . example . AngryBirdsStarTrek . apk

27 / 51

slide-42
SLIDE 42

install malware

create and install malicious app pulling all possible data

adb i n s t a l l com . example . AngryBirdsStarTrek . apk

still restricted access give malware every possible android permission still no access to most of /data/ no system or systemOrSignature level permissions pull personal data contacts/texts 27 / 51

slide-43
SLIDE 43

disabling keyguard via app

28 / 51

slide-44
SLIDE 44

disabling keyguard via app

KeyguardManager keyguardManager = ( KeyguardManager ) getSystemService ( Context .KEYGUARD_SERVICE) ; KeyguardLock mkeyguardLock = keyguardManager . newKeyguardLock ( " unlock " ) ; mkeyguardLock . disableKeyguard () ;

28 / 51

slide-45
SLIDE 45

disabling keyguard via app

KeyguardManager keyguardManager = ( KeyguardManager ) getSystemService ( Context .KEYGUARD_SERVICE) ; KeyguardLock mkeyguardLock = keyguardManager . newKeyguardLock ( " unlock " ) ; mkeyguardLock . disableKeyguard () ;

hitting back/home button might enable keyguard again depending on the device and the rom might also get you to launcher activity (=win!) 28 / 51

slide-46
SLIDE 46

disabling keyguard via app

KeyguardManager keyguardManager = ( KeyguardManager ) getSystemService ( Context .KEYGUARD_SERVICE) ; KeyguardLock mkeyguardLock = keyguardManager . newKeyguardLock ( " unlock " ) ; mkeyguardLock . disableKeyguard () ;

hitting back/home button might enable keyguard again depending on the device and the rom might also get you to launcher activity (=win!) solution: launch other activities/intents via our malicious app

so no problem ;)

28 / 51

slide-47
SLIDE 47

intercepting login credentials

  • 1. install custom ca cert
  • 2. set proxy in network settings
  • 3. launch intercepting proxy
  • 4. grab stuff

google auth token facebook token, password etc. 29 / 51

slide-48
SLIDE 48

intercepting login credentials

  • 1. install custom ca cert
  • 2. set proxy in network settings
  • 3. launch intercepting proxy
  • 4. grab stuff

google auth token facebook token, password etc. no cert errors, since we installed a trusted CA cert unfortunately not everything uses system proxy gapps, facebook work fine 29 / 51

slide-49
SLIDE 49

grabbing google auth token

using the mitmproxy tool

30 / 51

slide-50
SLIDE 50
slide-51
SLIDE 51

google backups

so we have the google auth token 32 / 51

slide-52
SLIDE 52

google backups

so we have the google auth token 32 / 51

slide-53
SLIDE 53

google backups

so we have the google auth token adding auth token to rooted phone

→ provides access to everything backed up to google (in plaintext)

32 / 51

slide-54
SLIDE 54

so still no root. . .

33 / 51

slide-55
SLIDE 55

so still no root. . .

  • well. . .

33 / 51

slide-56
SLIDE 56

so still no root. . .

  • well. . . get root!

root via adb restore by Bin4ry (for Android 4.0 and 4.1) mempodroid ZergRush Gingerbreak . . . 33 / 51

slide-57
SLIDE 57

Agenda

evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself

34 / 51

slide-58
SLIDE 58

prerequisites

rooted phone custom ROM, recovery adb access 35 / 51

slide-59
SLIDE 59
  • well. . .

. . . you are totally screwed!

36 / 51

slide-60
SLIDE 60
  • well. . .

. . . you are totally screwed!

36 / 51

slide-61
SLIDE 61

the attack

adb p u l l / data / data / adb p u l l / system / data /

37 / 51

slide-62
SLIDE 62

the attack

adb p u l l / data / data / adb p u l l / system / data /

credentials wifi passwords all data install malware/rootkits for future use 37 / 51

slide-63
SLIDE 63

the attack

adb p u l l / data / data / adb p u l l / system / data /

credentials wifi passwords all data install malware/rootkits for future use 37 / 51

slide-64
SLIDE 64

prerequisites

rooted phone custom ROM, custom recovery no adb access 38 / 51

slide-65
SLIDE 65

no adb access

  • k so no adb access

39 / 51

slide-66
SLIDE 66

no adb access

  • k so no adb access

but custom recovery (e.g. clockworkmod) 39 / 51

slide-67
SLIDE 67

no adb access

  • k so no adb access

but custom recovery (e.g. clockworkmod) remember the bootloader stuff? bootloader is usually unlocked we can boot/execute arbitrary code :) 39 / 51

slide-68
SLIDE 68

reboot menu

40 / 51

slide-69
SLIDE 69

no reboot menu

drain power load again boot into recovery via shortcuts e.g. volume down + power button (HTC Desire S) 41 / 51

slide-70
SLIDE 70

installing rootkits via recovery

recoveries allow flashing update.zip usually used to flash new ROMs most have usb mass storage mode for sdcard enabled 42 / 51

slide-71
SLIDE 71

typical update.zip structure

43 / 51

slide-72
SLIDE 72

the attack

  • 1. write rootkit running as system service
  • 2. reboot phone to recovery
  • 3. install rootkit via update.zip
  • 4. reboot phone to normal OS
  • 5. exfiltrate all data over network

44 / 51

slide-73
SLIDE 73

the attack

  • 1. write rootkit running as system service
  • 2. reboot phone to recovery
  • 3. install rootkit via update.zip
  • 4. reboot phone to normal OS
  • 5. exfiltrate all data over network

44 / 51

slide-74
SLIDE 74

prerequisites

rooted phone (custom ROM) no custom recovery no adb access unlocked bootloader 45 / 51

slide-75
SLIDE 75

modify boot/recovery partition

boot image contains kernel and init scripts kernel-based rootkit (complicated) malicious init scripts (easier) use fastboot to flash boot.img or directly boot into kernel

f a s t b o o t f l a s h boot boot . img

  • r: flash custom recovery and use previous vector via update.zip

46 / 51

slide-76
SLIDE 76

Agenda

evil maids detour: the android boot process attack scenarios unrooted phones adb access rooted phones protecting yourself

47 / 51

slide-77
SLIDE 77

how to protect yourself?

don’t root your phone/flash custom roms 48 / 51

slide-78
SLIDE 78

how to protect yourself?

don’t root your phone/flash custom roms just kidding ;) 48 / 51

slide-79
SLIDE 79

how to protect yourself?

don’t root your phone/flash custom roms just kidding ;) just don’t loose your phone. . . use encryption if possible lock bootloader again, if possible use stock recovery without options to flash zip unfortunately no really good solution AdbdSecure app screen locked: adb off screen unlocked: adb on 48 / 51

slide-80
SLIDE 80
  • well. . .

. . . you are still totally screwed!

49 / 51

slide-81
SLIDE 81
  • well. . .

. . . you are still totally screwed!

49 / 51

slide-82
SLIDE 82

thx for the attention!

50 / 51

slide-83
SLIDE 83

thx for the attention! scared? ;)

50 / 51

slide-84
SLIDE 84

thx for the attention! scared? ;) questions?

50 / 51

slide-85
SLIDE 85

references

“Physical Drive-By Downloads” by @thekos “Android Modding for the Security Practitioner” by Dan Rosenberg “Smudge Attack on Smartphone Touch Screens” by Aviv et. al. Phone2Phone adb

https://github.com/kosborn/p2p-adb/

http://tjworld.net/wiki/Android/HTC/Vision/BootProcess http://wiki.opticaldelusion.org/wiki/Motoactv Root with adb restore by Bin4ry (works on 4.X)

http://forum.xda-developers.com/showthread.php?t=1886460

http://www.uni-ulm.de/en/in/mi/staff/koenings/catching-authtokens.html

credits also go to: @theKos, @djrbliss, #droidsec, the modding community and everyone else I ripped of ;)

51 / 51