Mobile Application Security Testing and Code Review 19 Nov 2013 - - PowerPoint PPT Presentation

▶
mobile application security
SMART_READER_LITE
LIVE PREVIEW

Mobile Application Security Testing and Code Review 19 Nov 2013 - - PowerPoint PPT Presentation

Feb 23, 2023 2.83k likes •3.77k views

Mobile Application Security Testing and Code Review 19 Nov 2013 Mobile and Smart Device Security 2013 Boston, MA Presen sented ted by: Francis Brown & Joe DeMesy Bishop Fox www.bishopfox.com Introductions VERY QUICKLY

slide-1
SLIDE 1

Mobile Application Security

Testing and Code Review

19 Nov 2013 – Mobile and Smart Device Security 2013 – Boston, MA Presen sented ted by: Francis Brown & Joe DeMesy Bishop Fox www.bishopfox.com

slide-2
SLIDE 2

Introductions

2

  • Hi, I’m Fran
  • Partner at Bishop Fox
  • You may remember me from such hacks as:
  • RFID Thief
  • Diggity Search Tool Suite
  • SharePoint Hacking

VERY QUICKLY…

slide-3
SLIDE 3

Introductions

3

  • Hi, I’m Joe
  • Sr. Security Analyst at Bishop Fox
  • I like Python, Linux, and cryptography
  • Phones / embedded devices are pretty cool too

VERY QUICKLY…

slide-4
SLIDE 4

Today We’re Covering

4

  • Attacks against mobile apps
  • Real world examples
  • Defense against the dark arts

HACKING MOBILE APPS

slide-5
SLIDE 5
  • Breaki

king ng iOS Apps

  • Static Analysis
  • Dynamic Analysis
  • Counter-measures
  • Breaki

king ng Andro roid id Apps

  • Static Analysis
  • Dynamic Analysis
  • Counter-measures

Agenda

5

TECHNICAL BRIEF

slide-6
SLIDE 6

App Security Requirements

6

  • Online finance
  • Point-of-sale
  • Streaming media and DRM
  • Mobile Device Management (MDM)

A FEW SCENARIOS

slide-7
SLIDE 7

OF APP SECURITY

The Golden Rule

7

slide-8
SLIDE 8

Users are Ev Evil il

8

  • They have complete control
  • Do not trust them
  • Design apps & APIs accordingly

EVERY LAST ONE OF ‘EM

slide-9
SLIDE 9

iOS Applications

9

STATIC ANALYSIS

slide-10
SLIDE 10
  • Jailbroken iOS Device
  • SSH Access (scp)
  • Mac & Xcode
  • HTTP Proxy
  • Burp Suite Free/Pro ($300)
  • Zed Attack Proxy
  • ARM Disassembler
  • Hopper ($50)
  • IDA Pro ($600+)

iOS Perquisites

10

WHAT YOU NEED TO START

slide-11
SLIDE 11

HTTP Proxy Setup

11

NETWORK ANALYSIS

slide-12
SLIDE 12

Burp Suite Setup

12

slide-13
SLIDE 13

Python –m SimpleHTTPServer

13

slide-14
SLIDE 14

Install You Own CA

14

slide-15
SLIDE 15

WiFi Settings > Proxy

15

slide-16
SLIDE 16

You’re Done!

16

WELL SORT OF…

slide-17
SLIDE 17

DECRYPTING BINARIES

AppStore Encryption

17

slide-18
SLIDE 18
  • Encrypted Binaries
  • AppStore
  • Clutch
  • Rasticrac
  • No Encryption
  • Provisioned Device
  • Test Flight, etc.

Binary Encryption

18

GETTING PLAIN-TEXT BINS

slide-19
SLIDE 19

Clutch

19

  • Decrypts iOS applications and repackages them
  • Saves apps in:

/var/root/Documents/Cracked

  • Saves apps as .ipa files (they’re just ZIPs)
  • Use: clutch <app name>

AWESOME TOOL

slide-20
SLIDE 20
  • Foobar.ipa
  • iTunesMetadata.plist
  • iTunesArtwork
  • Payload/
  • Foobar.app
  • Foobar
  • …

AppStore Archive Structure

20

GETTING PLAIN-TEXT BINS

slide-21
SLIDE 21

Bundle Identifier

21

ITUNES METADATA PLIST

slide-22
SLIDE 22

Static Analysis

22

IOS APP SECURITY

slide-23
SLIDE 23

Static Analysis

23

DUMPING CLASS INTERFACES

slide-24
SLIDE 24

class-dump-z

24

  • Dump class information from a Mach-O binary
  • Shows Objective-C classes, methods, properties
  • Useful for peering into iOS apps
  • Great for searching for keywords

ANOTHER AWESOME TOOL

slide-25
SLIDE 25

#import <XXUnknownSuperclass.h> // Unknown library @class NSString; @interface XXasymEncryptor : XXUnknownSuperclass { NSString* _publicKeyID; NSString* _privateKeyID; } @property(copy, nonatomic) NSString* privateKeyID; @property(copy, nonatomic) NSString* publicKeyID;

  • (id)privateQueryDict;
  • (id)publicQueryDict;
  • (void)decryptWithPrivateKey;
  • (void)encryptWithPublicKey;
  • (void)KeysPlease;
  • (id)decryptData:(id)data;
  • (id)encryptData:(id)data;
  • (id)init;

@end

slide-26
SLIDE 26

#import <XXUnknownSuperclass.h> // Unknown library @class NSString; @interface XXasymEncryptor : XXUnknownSuperclass { NSString* _publicKeyID; NSString* _privateKeyID; } @property(copy, nonatomic) NSString* privateKeyID; @property(copy, nonatomic) NSString* publicKeyID;

  • (id)privateQueryDict;
  • (id)publicQueryDict;
  • (void)decryptWithPrivateKey;
  • (void)encryptWithPublicKey;
  • (void)KeysPlease;
  • (id)decryptData:(id)data;
  • (id)encryptData:(id)data;
  • (id)init;

@end

slide-27
SLIDE 27

Jailbreak Detection

27

#import <Foundation/NSObject.h> @interface FoobarUtil : NSObject { } +(id)getMACUID; +(id)getMACBasedUID; +(id)hashDataToHexString:(char*)hexString length:(int)length; +(id)hashData:(id)data; +(id)iTunesMetadataPlist; +(BOOL)appIsCracked; +(BOOL)deviceIsJailbroken; +(int)deviceCPUFrequency;

slide-28
SLIDE 28

Jailbreak Detection

28

Me Metho hods

  • Fork()
  • Stat() / Lstat()
  • Cydia
  • /apt/
  • Etc
  • dyld_count()
  • dyld_get_image_name()

COMMON DETECTION METHODS

slide-29
SLIDE 29

ARM Assembly

29

slide-30
SLIDE 30

30

slide-31
SLIDE 31

31

slide-32
SLIDE 32

32

Pseudo Code

NO ASSEMBLY REQUIRED

slide-33
SLIDE 33

XOR is Not Obfuscation

33

slide-34
SLIDE 34

Dynamic Analysis

34

IOS APP SECURITY

slide-35
SLIDE 35

iOS Device Logs

35

  • Window > Organizer
  • Cmd + Shift + 2
  • Real-time logs 

XCODE DEVICE CONSOLE

slide-36
SLIDE 36

iOS Device Logs

36

WALL OF TEXT

slide-37
SLIDE 37

HOOKING MADE EASY

Mobile Substrate

37

slide-38
SLIDE 38

Mobile Substrate

38

OBJ-C RUNTIME MANIPULATION

  • Written by Jay Freeman “Saurik”
  • Dynamic library injection framework
  • Cydia “Tweaks”
  • Included with Cydia by default
slide-39
SLIDE 39

Obj-C Message Passing

39

iOS App Objective-C Call Native C Call Run Code

slide-40
SLIDE 40

Obj-C Message Passing

40

iOS App Mobile Substrate Objective-C Call Native C Call Run Code

Our code runs here

slide-41
SLIDE 41

Class Dump Example

41

IMPLEMENTING THE ATTACK

@class NSString; @interface DeviceSecurity: { BOOL _jbstatus; } @property(assign, nonatomic) BOOL jbstatus; +(BOOL)isJailbroken; @end

slide-42
SLIDE 42

Class Dump Example

42

IMPLEMENTING THE ATTACK

@class NSString; @interface DeviceSecurity: { BOOL _jbstatus; } @property(assign, nonatomic) BOOL jbstatus; +(BOOL)isJailbroken; @end

slide-43
SLIDE 43

Tweak Syntax

43

IMPLEMENTING THE ATTACK

#import “substrate.h” %hook DeviceSecurity

  • (BOOL) isJailbroken {

%log; // Logos built-in logging return NO; // Return FALSE } %end

slide-44
SLIDE 44

Generating Function Hooks

44

LOG ALL THE THINGS

$ class-dump-z FoobarApp –H $ ./ios-hooker.py --target Foobar.h –g –s –l [*] Successfully parsed 1 of 1 file(s) [*] Generated 120 function hook(s) [*] Hooks written to: Tweak.xm (8954 bytes) $ make package

slide-45
SLIDE 45

GIVES YOU SUPERPOWERS

Cycript

45

slide-46
SLIDE 46

Cycript Magic

46

  • JavaScript REPL
  • JavaScript + Cycript

language extensions

  • Objective-C runtime is

merged into the REPL

  • Attach to running apps

IOS HACKER’S BEST FRIEND

slide-47
SLIDE 47

Cycript

47

ALIEN BLUE APP

slide-48
SLIDE 48

Cycript

48

IOS HACKER’S BEST FRIEND

iphone:~root# cycript –p AlienBlue cy# cy# UIApp @"<UIApplication: 0x8ba2c0>" cy# cy# UIApp.keyWindow.delegate @"<CustomNavigationController: 0x836900>” cy#

slide-49
SLIDE 49

Cycript Extended

49

IOS HACKER’S BEST FRIEND

$ ./slcycript AlienBlue [+] Launching cycript wrapper... [+] Attaching to process AlienBlue with PID 4831 [+] Importing JavaScript helper functions, please wait... cy# cy# ui(UIApp.keyWindow, "Reddits") <UILabel: 0x82f0d0; frame = (132 12; 55 21); text = 'Reddits'; clipsToBounds = YES; userInteractionEnabled = NO; layer = <CALayer: 0x82f190>>

slide-50
SLIDE 50

Cycript Extended

50

IOS HACKER’S BEST FRIEND

cy# label = new Instance(0x82f0d0) @"<UILabel: 0x82f0d0; frame = (132 12; 55 21); text = 'Reddits'; clipsToBounds = YES; userInteractionEnabled = NO; layer = <CALayer: 0x82f190>>" cy# cy# label.text @"Reddits" cy# label.text=@"Diggs" @"Diggs" cy#

slide-51
SLIDE 51

Cycript Extended

51

IOS HACKER’S BEST FRIEND

cy# hexdump(label.text,64) " c8 02 20 3f 8c 07 00 06 05 44 69 67 67 73 00 00 .........Diggs.. 12 48 65 6c 76 65 74 69 63 61 4e 65 75 65 2d 42 .HelveticaNeue.B 6f 6c 64 00 00 00 00 00 00 00 00 00 00 00 00 00 old............. c8 02 20 3f ad 07 00 01 b0 2b 84 00 12 00 00 00 ................ " cy# cy# [ label setHidden: 1 ] cy#

slide-52
SLIDE 52

MDM Security Policy

52

slide-53
SLIDE 53

DE DEMO MONSTRA NSTRATION TION

Cycript & iOS Mobile Substrate

53

slide-54
SLIDE 54

REALISTIC CONSIDERATIONS

Recommendations

54

slide-55
SLIDE 55

Defense Against Dark Arts

55

EXPECTO PATRONIS

  • Mobile security can be defeated
  • It comes down to context and difficulty
  • For example…
slide-56
SLIDE 56

iOS Recommendations

56

HARDENING YOUR APP

  • 1. Assembly and/or C
  • 2. Inline functions
  • 3. Obj-C obfuscation
  • 4. Certificate pinning
  • 5. Change release
  • Metaforic – Commercial
  • AppMinder – BSD Licensed

a) http://appminder.nesolabs.de/

slide-57
SLIDE 57

Free ‘n Easy Obfuscation

57

DEFENSIVE SHELLCODE

slide-58
SLIDE 58

Android Applications

58

STATIC ANALYSIS

slide-59
SLIDE 59

APK PACKAGES

Google Play Store

59

slide-60
SLIDE 60
  • APKs are signed, not encrypted
  • APK Extractor
  • Direct Download

Android Packages

60

EASILY ACQUIRED

slide-61
SLIDE 61
  • Root’d Device
  • Cydia Substrate
  • ADT Eclipse Bundle
  • Procyon
  • Dex2jar
  • Substrate Plug-in
  • HTTP Proxy
  • Burp Suite Free/Pro ($300)
  • Zed Attack Proxy

Android Perquisites

61

WHAT YOU NEED TO START

slide-62
SLIDE 62

Decompile the Bytecode

62

BYTECODE REFLECTION

dex2jar <App>.apk

slide-63
SLIDE 63

Dex2jar & Procyon

63

MORE THAN JUST INTERFACES

$ dex2jar Foobar.apk dex2jar foobar.apk -> Foobar-dex2jar.jar $ procyon –jar Foobar-dex2jar.jar –o src/ Decompiling com/foobar/Parser... Decompiling com/foobar/XMLWriter... …

slide-64
SLIDE 64

Decompiled Java Code

64

MORE THAN JUST INTERFACES

slide-65
SLIDE 65

Dynamic Analysis

65

ANDROID RUNTIME

slide-66
SLIDE 66

Android Zygote

66

slide-67
SLIDE 67

SUBSTRATE FOR ANDROID

Cydia Substrate

67

slide-68
SLIDE 68

Class Hook Example

68

IMPLEMENTING THE ATTACK

Class to hook Method to hook

slide-69
SLIDE 69

Class Hook Example

69

IMPLEMENTING THE ATTACK

slide-70
SLIDE 70

Class Hook Example

70

IMPLEMENTING THE ATTACK

slide-71
SLIDE 71

Class Hook Example

71

IMPLEMENTING THE ATTACK

slide-72
SLIDE 72

Class Hook Example

72

IMPLEMENTING THE ATTACK

slide-73
SLIDE 73

Class Hook Example

73

IMPLEMENTING THE ATTACK

slide-74
SLIDE 74

ADT’s Logcat

74

ANOTHER BEAUTIFUL WALL OF TEXT

Filter by tag

slide-75
SLIDE 75

DE DEMO MONSTRA NSTRATION TION

Android Substrate

75

slide-76
SLIDE 76

REALISTIC CONSIDERATIONS

Recommendations

76

slide-77
SLIDE 77

Android Recommendations

77

HARDENING YOUR APP

  • 1. NDK + assembly and/or C
  • 2. Inline functions
  • 3. Avoid kernel calls if possible
  • 4. Java bytecode obfuscation
  • 5. Certificate pinning
  • Java Obfuscator
slide-78
SLIDE 78

ON MOBILE SECURITY

Conclusions

78

slide-79
SLIDE 79

Management Not Security

79

BYOD VERTICAL CLOUD INTEGRATION

  • MDM is Mobile Device Management
  • Client-side enforcement
  • Devices lie

lie

slide-80
SLIDE 80

Mobile Security

80

IN A NUTSHELL

  • Do NOT make security decisions on a mobile device
  • But if you must…
slide-81
SLIDE 81

Client-side Enforcement

81

IF YOU MUST…

  • Your architecture is probably broken
  • Fix that instead
  • But if the business model dictates that you must…
  • Perhaps the revenue model depends on it
  • Perhaps you have to integrate with legacy code
  • Perhaps there’s some other crazy reason for on-device

security

slide-82
SLIDE 82

Questions & Thank You

82

http://github.com/moloch-- @bishopfox

Bishop

  • p Fox – see for more info:

http://www.bishopfox.com/

slide-83
SLIDE 83

Image Sources

  • Binary Image -

http://foter.com/f/photo/6949896929/479717 0191/