S MV -H UNTER : Large Scale, Automated Detection of SSL/TLS - - PowerPoint PPT Presentation

▶
s mv h unter large scale automated detection of ssl tls
SMART_READER_LITE
LIVE PREVIEW

S MV -H UNTER : Large Scale, Automated Detection of SSL/TLS - - PowerPoint PPT Presentation

Oct 01, 2022 251 likes •678 views

S MV -H UNTER : Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in Android Apps David Sounthiraraj Justin Sahs Garret Greenwood Zhiqiang Lin Latifur Khan University of Texas at Dallas February 26, 2014

slide-1
SLIDE 1

SMV-HUNTER: Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in Android Apps

David Sounthiraraj Justin Sahs Garret Greenwood Zhiqiang Lin Latifur Khan

University of Texas at Dallas

February 26, 2014

slide-2
SLIDE 2

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Problem Statement

◮ Many Android apps use SSL/TLS to transmit sensitive data ◮ Android allows developers to override the built-in validation

◮ Used to connect to servers whose certificates come from

non-standard Certificate Authorities (CAs)

◮ Used to avoid purchasing certificates for testing or user

acceptance environment

◮ Can lead to SSL Man-in-the-Middle Vulnerabilities (SMVs)

slide-3
SLIDE 3

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

SSL/TLS

In SSL/TLS, a server’s identity is verified by a certificate chain. A chain is valid if:

◮ Each certificate has not expired ◮ The root certificate of the chain is from a CA present in the

keystore

◮ Each certificate has a valid cryptographic signature from the CA

immediately after it in the chain Additionally, the certificate chain’s hostname must match the domain name being connected to (possibly with wildcards).

slide-4
SLIDE 4

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Example Vulnerability

A famous example is the Chase Banking App (CVE-2012-5810):

1 public final void checkServerTrusted(X509Certificate[] 2

paramArrayOfX509Certficate, String paramString)

3 { 4

if ((paramArrayOfX509Certficate != null) && (

5

paramArrayOfX509Certficate.length == 1))

6

paramArrayOfX509Certficate[0].checkValidity();

7

while (true)

8

{

9

return;

10

this.a.checkServerTrusted(

11

paramArrayOfX509Certficate,paramString);

12

}

13 }

(from (Georgiev et al., 2012))

slide-5
SLIDE 5

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Example Vulnerability

A famous example is the Chase Banking App (CVE-2012-5810):

1 public final void checkServerTrusted(X509Certificate[] 2

paramArrayOfX509Certficate, String paramString)

3 { 4

if ((paramArrayOfX509Certficate != null) && (

5

paramArrayOfX509Certficate.length == 1))

6

paramArrayOfX509Certficate[0].checkValidity();

7

while (true)

8

{

9

return;

10

this.a.checkServerTrusted(

11

paramArrayOfX509Certficate,paramString);

12

}

13 }

(from (Georgiev et al., 2012))

slide-6
SLIDE 6

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Approach

◮ Purely static analysis unreliable ◮ Purely dynamic analysis infeasible

◮ enumerate all possible UI interaction paths ◮ text input

◮ We propose a hybrid approach

◮ use static analysis to prune the search space for and provide valid

text to dynamic analysis

slide-7
SLIDE 7

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

System Overview

Static Analysis Dynamic Analysis

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-8
SLIDE 8

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

System Overview

Static Analysis Dynamic Analysis

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-9
SLIDE 9

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

System Overview

Static Analysis Dynamic Analysis

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-10
SLIDE 10

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

System Overview

Static Analysis Dynamic Analysis

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-11
SLIDE 11

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

System Overview

Static Analysis Dynamic Analysis

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-12
SLIDE 12

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

System Overview

Static Analysis Dynamic Analysis

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-13
SLIDE 13

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

System Overview

Static Analysis Dynamic Analysis

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-14
SLIDE 14

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

System Overview

Static Analysis Dynamic Analysis

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-15
SLIDE 15

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Static Analysis

...

Vulnerable Apps

Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation

slide-16
SLIDE 16

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Disassembly

...

Vulnerable Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation

◮ apktool to disassemble

the packaged compiled code into a human-readable format called Smali.

◮ Significantly faster and

more reliable than decompilation, especially when the code has been

  • bfuscated
slide-17
SLIDE 17

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Static SMV Detection

...

Vulnerable Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation

◮ Simply check whether the

X509TrustManager or HostNameVerifier interfaces have been

  • verridden

◮ Apps that do not override

these either do not use SSL

  • r use the built-in SSL

support without modification

slide-18
SLIDE 18

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Vulnerable Entry Point Identification

...

Vulnerable Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation

◮ Each app can be started at

a number of entry points (called activities)

◮ Many entry points will not

trigger secure connections

◮ Trace backwards through

method calls to identify entry points that might trigger potential vulnerabilities

slide-19
SLIDE 19

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Smart Input Generation

...

Vulnerable Apps

Vulnerability Detection Disassembly Entry Point Identification

Smali Files Method Names

Smart Input Generation

◮ Apps often perform

validation on text input or convert text to other datatypes (e.g. integers)

◮ Intelligently provide input

based on:

◮ Input type annotations ◮ Type cast operations in

the code

slide-20
SLIDE 20

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Dynamic Analysis

...

Device & UI Automation MITM Proxy

Correlative Analysis Results

Internet

HTTPS Traffic HTTP Traffic HTTPS Traffic

slide-21
SLIDE 21

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Device Management

For completeness and scalability, our system must:

◮ Manage multiple emulators in parallel, ◮ Handle emulator crashes and other errors, ◮ Schedule and distribute app testing across running emulators, and ◮ Collect and manage log data including installation and

uninstallation details and network traffic.

slide-22
SLIDE 22

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Device Management

The device management component has two threads:

◮ Emulator Management ◮ App Scheduling

slide-23
SLIDE 23

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Device Management

The device management component has two threads:

◮ Emulator Management

◮ Maintains a pool of active and free emulators ◮ Monitors the state of each emulator, restarting ones that go

“offline” or crash

◮ App Scheduling

slide-24
SLIDE 24

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Device Management

The device management component has two threads:

◮ Emulator Management ◮ App Scheduling

◮ Executes UI Automation on each activity identified by static

analysis

◮ Handles errors that do not crash the emulator (e.g. app crashes) ◮ Logs installation/uninstallation timestamps and DNS queries

slide-25
SLIDE 25

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

UI Automation

Activity

UI Enumeration Smart Input Injection

Tap Event Processing

Tap Event Return Event State Change Detection No State Change State Change

slide-26
SLIDE 26

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

UI Automation

Activity

UI Enumeration Smart Input Injection

Tap Event Processing

Tap Event Return Event State Change Detection No State Change State Change

UI Automation System ViewServer WindowManager

Query UI Elements

slide-27
SLIDE 27

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

UI Automation

Activity

UI Enumeration Smart Input Injection

Tap Event Processing

Tap Event Return Event State Change Detection No State Change State Change

UI Automation System ViewServer UI Elements

Tap and Text events

slide-28
SLIDE 28

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

UI Automation

Activity

UI Enumeration Smart Input Injection

Tap Event Processing

Tap Event Return Event State Change Detection No State Change State Change

◮ The system uses WindowChange and FocusChange events

that are triggered when the interface changes

◮ Back button events are used to return to the target activity

◮ When a “non-cancellable” dialog appears that disables the back

button, events are generated to tap on “OK” or “Cancel” buttons

slide-29
SLIDE 29

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

MITM Proxy

◮ During UI automation, all HTTPS traffic is directed through a

proxy that provides illegitimate certificates for each connection

◮ Successful connections are logged

slide-30
SLIDE 30

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Correlative Analysis

◮ The MITM proxy only sees network traffic, cannot map

successful attacks to vulnerable apps

◮ The correlative analysis component matches attack timestamps

with application installation timestamps

◮ Identifies what apps were running during the attack

◮ DNS query logs are used to identify which app(s) were actually

attacked

slide-31
SLIDE 31

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Data Sets

Two datasets crawled from the Google Play market:

◮ DS1: 3,165 finance-related apps (using finance-specific query

terms)

◮ Banking apps more likely to use SSL/TLS

◮ DS2: 20,316 apps

◮ Contains apps with more complex UIs (e.g. games)

slide-32
SLIDE 32

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Data Set Distributions

10 20 30 40

% DS1

2.5 5.0 7.5 10.0

% DS2

A r c a d e & A c t i

  • n

B

  • k

s & R e f e r e n c e B r a i n & P u z z l e B u s i n e s s C a r d s & C a s i n

  • C

a s u a l C

  • m

i c s C

  • m

m u n i c a t i

  • n

E d u c a t i

  • n

E n t e r t a i n m e n t F i n a n c e H e a l t h & F i t n e s s L i b r a r i e s & D e m

  • s

L i f e s t y l e M e d i a & V i d e

  • M

e d i c a l M u s i c & A u d i

  • N

e w s & M a g a z i n e s P e r s

  • n

a l i z a t i

  • n

P h

  • t
  • g

r a p h y P r

  • d

u c t i v i t y R a c i n g S h

  • p

p i n g S

  • c

i a l S p

  • r

t s S p

  • r

t s G a m e s T

  • l

s T r a n s p

  • r

t a t i

  • n

T r a v e l & L

  • c

a l W e a t h e r

slide-33
SLIDE 33

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Static Analysis

◮ Time Requirements:

◮ Disassembly took 0.42 seconds per app, on average (compared to

276 seconds per app to decompile)

◮ Vulnerable Entry Point Identification took 3.63 seconds per app,

  • n average

◮ Smart Input Generation took 1.2 seconds per app, on average

◮ Of 260,395 activities, 8,713 were identified as potentially

vulnerable

slide-34
SLIDE 34

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Static Analysis

DS1 DS2 Vulnerable Apps 221 1322 Vulnerable Activities 1670 7043 Disassembly 23.5 minutes 2.4 hours Entry Point Identification 3.2 hours 20.5 hours Apps with Detectable Text Fields 87 417 Detected Text Fields 600 5599 Annotated Text Fields 289 3532 Type Casts 92 263 Space Requirements 26G 176G Smali Files 1.3 million 8.7 million

slide-35
SLIDE 35

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Dynamic Analysis

◮ Eight emulators running Android OS 4.1 to test the apps in

parallel

◮ The process took 18.81 hours (2.91 for DS1, 15.90 for DS2) ◮ We recorded 12 emulator crashes, and each emulator crashed or

went “offline” at least once

◮ Of the 8,713 tested entry points, 1,705 crashed on launch

◮ more likely in finance category apps, likely because of missing

login credentials

slide-36
SLIDE 36

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Vulnerable Apps

16 32 48 64 # Vuln. (DS1) 37.25 74.50 111.75 149.00 # Vuln. (DS2)

Number of Vulnerable Apps in Each Category

A r c a d e & A c t i

  • n

B

  • k

s & R e f e r e n c e B r a i n & P u z z l e B u s i n e s s C a r d s & C a s i n

  • C

a s u a l C

  • m

i c s C

  • m

m u n i c a t i

  • n

E d u c a t i

  • n

E n t e r t a i n m e n t F i n a n c e H e a l t h & F i t n e s s L i b r a r i e s & D e m

  • s

L i f e s t y l e M e d i a & V i d e

  • M

e d i c a l M u s i c & A u d i

  • N

e w s & M a g a z i n e s P e r s

  • n

a l i z a t i

  • n

P h

  • t
  • g

r a p h y P r

  • d

u c t i v i t y R a c i n g S h

  • p

p i n g S

  • c

i a l S p

  • r

t s S p

  • r

t s G a m e s T

  • l

s T r a n s p

  • r

t a t i

  • n

T r a v e l & L

  • c

a l W e a t h e r

slide-37
SLIDE 37

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Vulnerable Apps

5 10 15 20 % Vuln. (DS1) 3.75 7.50 11.25 15.00 % Vuln. (DS2)

Proportion of Each Category that is Vulnerable

A r c a d e & A c t i

  • n

B

  • k

s & R e f e r e n c e B r a i n & P u z z l e B u s i n e s s C a r d s & C a s i n

  • C

a s u a l C

  • m

i c s C

  • m

m u n i c a t i

  • n

E d u c a t i

  • n

E n t e r t a i n m e n t F i n a n c e H e a l t h & F i t n e s s L i b r a r i e s & D e m

  • s

L i f e s t y l e M e d i a & V i d e

  • M

e d i c a l M u s i c & A u d i

  • N

e w s & M a g a z i n e s P e r s

  • n

a l i z a t i

  • n

P h

  • t
  • g

r a p h y P r

  • d

u c t i v i t y R a c i n g S h

  • p

p i n g S

  • c

i a l S p

  • r

t s S p

  • r

t s G a m e s T

  • l

s T r a n s p

  • r

t a t i

  • n

T r a v e l & L

  • c

a l W e a t h e r

slide-38
SLIDE 38

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Vulnerable Apps

◮ This project was conducted over a one-year window, allowing us

to revisit vulnerable apps

◮ We attempted to re-download all 726 confirmed-vulnerable apps ◮ 14.6% were unavailable, and 76.17% were still vulnerable

slide-39
SLIDE 39

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Limitations/Future Work

◮ The dynamic analysis component can introduce false negatives

due to some limitations:

◮ Multi-Page input ◮ Advanced UI Operations (e.g. swipe, long touch) ◮ WebViews: embedded browser components that cannot be

analyzed by the ViewServer

slide-40
SLIDE 40

Introduction System Overview Static Analysis Dynamic Analysis Experiments Discussion

Conclusion

◮ Our system combines static and dynamic analysis techniques to

perform large-scale, automated SMV detection on Android

◮ We identified 726 confirmed-vulnerable apps (out of 23,481

apps, approx. 3%)

◮ Months later, more than 3 4 were still vulnerable

This material is based upon work supported by The Air Force Office of Scientific Research under Award No. FA-9550-12-1-0077.