security pie
play

Security & Pie Android 9.0 & APK Security Plan of Attack - PowerPoint PPT Presentation

Nov 21, 2022 •95 likes •672 views

Security & Pie Android 9.0 & APK Security Plan of Attack Start at the hardware Work up to Android OS Climb into the Play Store Discuss Application (APK) Connor Tumbleson Senior Software Engineer @Sourcetoad

  1. Security & Pie Android 9.0 & APK Security

  2. Plan of Attack ๏ Start at the hardware ๏ Work up to Android OS ๏ Climb into the Play Store ๏ Discuss Application (APK)

  3. 
 Connor Tumbleson Senior Software Engineer @Sourcetoad 
 Apktool Maintainer @iBotPeaches connortumbleson.com

  4. Some History ๏ Google I/O 2017 - 2 billion monthly devices Yearly CVEs (Android) ๏ Popular target 900 675 450 225 0 2015 2016 2017 2018 (Oct)

  5. The Mobile World ๏ Bank applications ๏ PayPal / Venmo ๏ Medical apps ๏ 2 Factor Authentication ๏ Travel + Lodging

  6. Hardware

  7. Starting Line: Hardware - SOC ๏ Broadcom - BCM ๏ Intel - Atom ๏ MediaTek - MT ๏ NVIDIA - Tegra ๏ Qualcomm - Snapdragon ๏ Samsung - Exynos

  8. Snapdragon - Qualcomm ๏ SPU - S ecure P rocessing U nit ๏ Isolated RAM/CPU/Power ๏ Vault-like ๏ TEE - T rusted E xecution E nvironment ๏ HLOS - H igh L evel O perating S ystem ๏ Trusted execution of code

  9. Android

  10. Android Platform ๏ Encryption ๏ Kernel ๏ Sandboxing ๏ SELinux ๏ Userspace ๏ Boot bit.ly/2SJI5xk

  11. Android Platform ๏ Monthly updates ๏ Security Patch level ๏ Easier to follow ๏ OEMs follow ๏ Or try too…

  12. Android Boot ๏ AVB - A ndroid V erified B oot ๏ Integrity of software during boot bit.ly/2rBWm3E

  13. Android Userspace - Before ASLR 0x1 - memory 
 ๏ Take some memory 0x2 - secrets 
 ๏ We want the secrets 0x3 - memory 
 ๏ Overflow 0x4 - app 
 ๏ Goal to take from 0x2 0x5 - memory 
 0x6 - memory 
 ๏ Retry. Retry. Retry. 0x7 - memory ๏ Profit.

  14. Android ASLR ??? - memory 
 ๏ A ddress ??? - memory 
 ๏ S pace ??? - app 
 ๏ L ayout ??? - memory 
 ๏ R andomization ??? - memory ??? - secrets 
 ??? - memory

  15. Android ASLR Example

  16. Android ASLR Example

  17. Android ASLR + DEP ๏ DEP - D ata E xecution P revention ๏ In short - Prevents stack execution ๏ ASLR randomizes a lot. ๏ Stack, Heap, Libs, Linker, Execs, etc

  18. Android SELinux ๏ S ecurity- E nhanced ๏ 20+ years old ๏ Created by NSA ๏ Separation of information ๏ Constantly upgraded

  19. Android SELinux - History ๏ 4.3 - Permissive “Warn, don’t block” ๏ 4.4 - Partially Enforced ๏ 5.0 - Fully Enforced ๏ 6.0 - Isolation between users ๏ 7.0 - Mediaserver ๏ 8.0 - Support with Treble

  20. Android 9.0 SELinux ๏ Per App Sandbox :) ๏ Non-Privileged Apps run in individual containers ๏ No more leaking data, if >= API 28 ๏ Share data via Content Providers Devs do this!

  21. Android Encryption ๏ Full Disk based (4.4 - Deprecated ) ๏ Entire disk with one key. ๏ File based (7.0) ๏ File based with different keys ๏ Metadata based (9.0) ๏ Everything else with single key

  22. Android 9.0 - Metadata Encryption ๏ What is everything else? ๏ Directory Layouts ๏ File sizes, permissions, creation time ๏ Key protected in Keymaster which is protected with A ndroid V erified B oot

  23. Hold up. What is Keymaster? ๏ Trusted environment for secrets. ๏ v1 - Access Controls for keys ๏ v2 - Version Binding ๏ v3 - ID Attestation (Serial, Name, IMEI) ๏ v4 - Strongbox (?)

  24. Android 9.0 - Strongbox ๏ Physical separate CPU ๏ Secure Storage ๏ True Random ๏ Tamper resistant ๏ Side channel protection

  25. Android 9.0 - CFI ๏ C ontrol F low I ntegrity ๏ As of 2016, 86% of vulnerabilities on Android are memory safety related. ๏ So what is it? bit.ly/2CkX4IP

  26. CFI - Example Program wrong login return correct ๏ Basic program ๏ Fail login, must retry. ๏ If successful, move onward.

  27. CFI - Example Program (Attacker) wrong login return correct execute

  28. CFI - Example Program (Attacker) wrong login return correct ๏ CFI knows execute

  29. Android 9.0 - CFI ๏ Disallows changes to original control flow ๏ 9.0 - Enabled in components & kernel ๏ Requires L ink- T ime O ptimization ๏ Tough with shared libraries

  30. Android Platform - Conclusion ๏ Protection of Data ๏ Strong storage ๏ Self Protection (Kernel) ๏ Enforcement (SELinux) ๏ Verified Boot

  31. Google PlayStore

  32. PlayStore - Lets talk PHA ๏ P otentially H armful A pplication ๏ Google Play Protect ๏ Finds lost devices ๏ Blocks deceptive websites ๏ Detects and removes PHA s

  33. So what is a PHA ? ๏ Nothing good. ๏ Fraud ๏ Phishing ๏ Trojan ๏ Spyware ๏ Ransomware

  34. Known PHA s (2017 Report) ๏ Chamois - sms fraud + botnet ๏ IcicleGum - spyware ๏ BreadSMS - sms fraud ๏ JamSkunk - toll fraud ๏ ExpensiveWall - sms fraud ๏ BambaPurple - toll fraud + ads

  35. PHA - Chamois ๏ Largest PHA to date. ๏ Multiple stages ๏ Features ๏ Generating invalid traffic (ads) ๏ Automatic app installs ๏ SMS fraud (premium texts) bit.ly/2Cs57U1

  36. SafetyNet

  37. Google’s SafetyNet Overview ๏ Marketed as… ๏ Verify Apps API ๏ Google Play Protect ๏ The brains: SafetyNet ๏ Features: always changing

  38. SafetyNet Internals ๏ Thanks to @ikoz (John Kozyrakis) ๏ Researches SafetyNet for years ๏ koz.io <— plenty of blogs about it ๏ First we need to get the binary.

  39. SafetyNet Download (Research) bit.ly/2CrO98i

  40. SafetyNet Explained ๏ Runs under G oogle M obile S ervices ๏ Google involved for M achine L earning ๏ Updates outside of OEM ๏ Complex ๏ Module based

  41. SafetyNet Modules ๏ default_packages ๏ proxy ๏ su_files ๏ setuid_files ๏ settings ๏ selinux_status ๏ locale ๏ apps ๏ ssl_handshake ๏ logcat ๏ sslv3_fallback ๏ attest

  42. SafetyNet Modules… ๏ system_ca_cert ๏ phone sky ๏ gmscore ๏ internal_logs ๏ event_log ๏ app_ops ๏ device_state ๏ snet_network ๏ mount_options ๏ snet_verify_apps ๏ app_dir_wr ๏ and more…

  43. SafetyNet - So what are those? ๏ su_files - Checks for SU binaries ๏ ssl_handshake - Detects MITM ๏ mx_record - Detects spoofed DNS ๏ google_page_info - Detects JS injection ๏ proxy - Detects known bad locations

  44. SafetyNet - DroidGuard ๏ Secret Weapon - DroidGuard ๏ Native blob of magic ๏ Tough to RE ๏ Growing with features ๏ Anti-malware ๏ Not talked about a lot. Quite hidden

  45. Applications (APKs)

  46. APK Basics ๏ Think ZIP file. ๏ Collection of resources and source ๏ Assets, libraries, etc ๏ One big package isolated for each app.

  47. APK Basics - Just unzip it!

  48. APK Basics - or Apktool it!

  49. AXML vs XML

  50. Apktool - Reverse Engineering APKs ๏ Open source. Free. ๏ Decodes AXML, 9patch and dex files. ๏ Thanks to smali project

  51. APK Internals ๏ . dex - source files (Java) ๏ . arsc - resources (strings, layouts, themes) ๏ libs - native libraries ๏ res - images, raw, xml, etc ๏ and more.

  52. APK Signatures ๏ 1.0 - JAR Signature ๏ ??? (security fixes) ๏ 7.0 - APK Signature Block v2 ๏ 9.0 - APK Signature Block v3

  53. APK “Master Key” Woes ๏ APKs unzipped on Android ๏ Bug after bug ๏ Led to v2

  54. Android 9.0 - v3 Signature ๏ Key Rotation ๏ Update keys as part of APK update ๏ Think company acquiring app ๏ Minor, big change was v2

  55. In Closing ๏ Take those monthly updates ๏ Stay within the Play Store ๏ Leave those slow OEMs behind

  56. Thanks! @iBotPeaches connortumbleson.com

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides
Security Security as term, Possible Security violations Authentication Criteria for

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides
CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides
Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann &amp; Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides
1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday &amp; Friday, 9:00 10:30 William Stallings

670 views • 19 slides
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides
Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides
Security 101 Definition of Information Security Information security is the protection of

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides
Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides
Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides
Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides
Learning from a Piece of Pie Pierre-Andr Chiappori Olivier Donni Ivana Komunjer Universit

Learning from a Piece of Pie Pierre-Andr Chiappori Olivier Donni Ivana Komunjer Universit

Learning from a Piece of Pie Pierre-Andr Chiappori Olivier Donni Ivana Komunjer Universit de Dauphine 1. Introduction Economic applications of the Nash solution: The bargaining game between the management and the workers, possibly rep-

940 views • 46 slides
Classr oom Manage me nt E llie F e nton De pa rtme nt o f Mo de rn L a ng ua g e s a nd L

Classr oom Manage me nt E llie F e nton De pa rtme nt o f Mo de rn L a ng ua g e s a nd L

Classr oom Manage me nt E llie F e nton De pa rtme nt o f Mo de rn L a ng ua g e s a nd L ing uistic s Da nny Ba ke r De pa rtme nt Sta tistic s Pr e se ntation Outline I ntro duc tio ns/ I c e b re a ke r Diffe re nt a spe c

457 views • 33 slides
The Facts David Onder &amp; Alison Joseph SAIR 2012 1 9608 students Masters

The Facts David Onder &amp; Alison Joseph SAIR 2012 1 9608 students Masters

Its Not About Pie When It Comes To The Facts David Onder &amp; Alison Joseph SAIR 2012 1 9608 students Masters Comprehensive Mountain location Residential and Distance 2 Eye on the pies Which is the largest in Year 1 -

819 views • 50 slides
CS-5630 / CS-6630 Visualization Design Guidelines; Tasks Alexander Lex alex@sci.utah.edu [xkcd]

CS-5630 / CS-6630 Visualization Design Guidelines; Tasks Alexander Lex alex@sci.utah.edu [xkcd]

CS-5630 / CS-6630 Visualization Design Guidelines; Tasks Alexander Lex alex@sci.utah.edu [xkcd] Design Critique / Redesign https://goo.gl/lHWp4x Sunday Star Times, 2012 Quantity encoded by diameter, not area! Fixing that: R. Cunliffe,

930 views • 61 slides
Deadline Effects in a Competitive Bargaining Model Simon Board Jeff Zwiebel UCLA Stanford

Deadline Effects in a Competitive Bargaining Model Simon Board Jeff Zwiebel UCLA Stanford

Introduction Model Analysis Alternating The End Deadline Effects in a Competitive Bargaining Model Simon Board Jeff Zwiebel UCLA Stanford March, 2014 Introduction Model Analysis Alternating The End Motivation Competitive bargaining

747 views • 23 slides
Lecture 12 Chapter 9 Plots, Graphs, and Pictures Determining What Display is Appropriate

Lecture 12 Chapter 9 Plots, Graphs, and Pictures Determining What Display is Appropriate

Lecture 12 Chapter 9 Plots, Graphs, and Pictures Determining What Display is Appropriate Dos and Donts of Statistical Pictures Examples Choosing the Right Display Display type depends on variable types: 1 measurement

484 views • 16 slides
interaction models talking generally From Formalism to Physicality, Alan Dix, UPC

interaction models talking generally From Formalism to Physicality, Alan Dix, UPC

interaction models talking generally From Formalism to Physicality, Alan Dix, UPC North, 30 April 2008 interaction models generic models of classes of system mainly to aid understanding of general issues e.g.

469 views • 10 slides
Fair partition of a convex planar pie Roman Karasev 1 joint work with Arseniy Akopyan 2 and Sergey

Fair partition of a convex planar pie Roman Karasev 1 joint work with Arseniy Akopyan 2 and Sergey

Fair partition of a convex planar pie Roman Karasev 1 joint work with Arseniy Akopyan 2 and Sergey Avvakumov 2 1 Moscow Institute of Physics and Technology 2 IST Austria Tehran, April, 2019 The problem statement Question (Nandakumar and Ramana

531 views • 36 slides

More recommend