Unde Understandi nding+O ng+Ope pen+P n+Ports+i +in+A n+Andr - - PowerPoint PPT Presentation

▶
unde understandi nding o ng ope pen p n ports i in a n
SMART_READER_LITE
LIVE PREVIEW

Unde Understandi nding+O ng+Ope pen+P n+Ports+i +in+A n+Andr - - PowerPoint PPT Presentation

Oct 07, 2023 39 likes •255 views

Unde Understandi nding+O ng+Ope pen+P n+Ports+i +in+A n+Andr ndroid+ d+ Ap Applications:+Discover ery,+Diagnosis,+and+ Se Secur curity+A y+Assessme ment Daoyuan Wu 1 ,*Debin Gao 1 ,*Rocky*K.*C.*Chang 2 ,* En He 3 ,*Eric*K.*T.*Cheng

slide-1
SLIDE 1

Unde Understandi nding+O ng+Ope pen+P n+Ports+i +in+A n+Andr ndroid+ d+ Ap Applications:+Discover ery,+Diagnosis,+and+ Se Secur curity+A y+Assessme ment

Daoyuan Wu1,*Debin Gao1,*Rocky*K.*C.*Chang2,* En He3,*Eric*K.*T.*Cheng2,*and*Robert*H.*Deng1

1 2

China Electronic Technology Cyber Security Co., Ltd.

3

slide-2
SLIDE 2

2

Open&port

http://127.0.0.1:1234 //filename Inject&dangerous& commands

slide-3
SLIDE 3

Th The$First$Step:$Discovering$Open$Ports$in$Apps

3

Static'Analysis

Issues:& dynamic'code'loading,' complex'implicit'flows,' and'code'obfuscation.

In;lab'Dynamic' Analysis

Cannot'mimic'real'user' inputs'to'driven'apps

Crowdsourcing Discovery

OPAnalyzer [EuroS&P’17]' Difficult'to'recognize random'port'numbers

Leverage'users’'interaction' with'their'smartphones'to' monitor'open'ports

slide-4
SLIDE 4

Ne NetMo Mon:(O :(On*de devi vice Op Open(Port(Monitoring

Available(on(Google(Play(since(October(2016

https://play.google.com/store/apps/details?id=com.netmon

4

slide-5
SLIDE 5

Po Port%Monitoring%Mechanism

5

p

/proc/net/tcp |tcp6|udp|udp6

$"cat"/proc/net/tcp6"""""""""(accessible"also"on"the"latest"Android"8"and"9) sl local_address remote_address st tx_queue rx_queue tr5tm6>when5retrnsmt uid 0:"0000000000000000FFFF00000100007F:9AE0 00000000000000000000000000000000:000050A 00000000:000000005 00:00000000500000000510156 1:"0000000000000000FFFF00000100007F:EC225 00000000000000000000000000000000:000050A500000000:000000005 00:00000000500000000510272 2:"0000000000000000FFFF00002600040A:E8EA5 0000000000000000FFFF00006B72662F:01BB506500000000:000000005 03:00001279500000000555550 3:"0000000000000000FFFF00002600040A:84B05 0000000000000000FFFF00005FC2D9AC:01BB508500000000:000000015 00:00000000500000000510015

Periodically analyze5proc5with5minimal5overhead

!

p

slide-6
SLIDE 6

Se Server%si side)Op Open%Po Port)Analytic)Engine

6

UID App Type IP Port Time U1 Netflix UDP4 0.0.0.0 1900 T1 U1 Netflix UDP4 0.0.0.0 39798 T1 U2 Netflix UDP4 0.0.0.0 1900 T2 U2 Netflix UDP4 0.0.0.0 32799 T2 …… Ux Netflix TCP4 0.0.0.0 9080 Tx Uy Netflix TCP4 0.0.0.0 9080 Ty App Type IP Port Netflix UDP4 0.0.0.0 Random App Type IP Port Netflix TCP4 0.0.0.0 9080 Netflix UDP4 0.0.0.0 1900

Raw port monitoring records Per-app

  • pen ports

“Intelligent” engine

slide-7
SLIDE 7

Se Server%si side)Op Open%Po Port)Analytic)Engine

7

slide-8
SLIDE 8

Se Server%si side)Op Open%Po Port)Analytic)Engine

8

slide-9
SLIDE 9

Se Server%si side)Op Open%Po Port)Analytic)Engine

9

slide-10
SLIDE 10

Cr Crowdsou

  • urced*Open*Port
  • rt*Results
  • The$ten'month$data:
  • 3,293$user$phones$from$

136$different$countries

  • 26%$are$from$US,$while$

diverse$for$others

  • 40M$port$monitoring$

records:

  • 2,778$open'port$apps
  • And$their$4,954$open$

ports

10

  • The$effectiveness:
  • Discovered$2,284$apps$

with$TCP$open$ports,$ vs.$1,632$apps$detected$ in$state'of'the'art$ research$[EuroS&P’17].

  • In$a$controlled$set$of$

apps$with$TCP$open$ ports,$25.1%$of$them$use$ dynamic$or$obfuscated$ codes$for$open$ports.

  • The$pervasiveness:
  • Correlated$with$

top$3,216$apps from$Google$Play,$ 492$of$them$are$ with$open$ports.

  • Pervasiveness:

15.3%.

slide-11
SLIDE 11

Op Open%Ports% s%in%925%Popular%Apps

11

slide-12
SLIDE 12

Op Open%Ports% s%in%755%Built1in in%Apps

12

More'than'half'of'these'built2in' apps'contain UDP'open'port'68. One'quarter'(175'apps,'23.2%)' have'TCP/UDP'port'5060'open. 41'Samsung'and'16'LG'models' modify'some'Android'AOSP'apps' to'introduce'port'5060.

  • TCP'port'6000'in'Xiaomi Browser
  • UDP'port'19529'in'LG’s'18'apps
slide-13
SLIDE 13

Wh While&crowdsourcing&is&effecti tive&in& disc discover ering ing&o &open&po pen&ports, s, it it&do &does es&no &not&r &reveal&t eal&the&c he&code de6le level&in el&informa matio ion& n& fo for&more&in6dep depth&under h&understanding anding&o &or& diag diagno nosis sis.

slide-14
SLIDE 14

Op Open%Port%Diagn gnosi sis% s%via%Static%Analysi sis

14

SDK?

1 2

Insecure parameters?

slide-15
SLIDE 15

Diagno gnosis(I: I:(Open pen.Po Port(SDKs

  • Out$of$the$1,520$open0port$apps:
  • 61.8%$are$solely$due$to$SDKs;

Facebook$SDK$is$the$major$contributor.

  • 13$open0port$SDKs$detected:

15

slide-16
SLIDE 16

Diagno gnosis(II: II:(Ins Insec ecur ure( e(API( PI(Us Usages es

16

581%apps%whose%

  • pen%ports%are%

not%introduced% by%SDKs 611%open%ports% from%390%apps% (67.1%)%adopted% “convenient”% API%usages 164%ports%from% 120%apps% (20.7%) set%their% port%number% param random 20.7%&(120/581)&open1port&apps&adopt&convenient&but&insecure API& usages.

Did%not%set%the%IP%addr param%or%set%it%“null”.

slide-17
SLIDE 17

In#t In#the#las he#last#phase#o #phase#of#o f#our ur#pipeline, #pipeline,# we we#perform#three#novel# securit ity#as assessments#of#

  • f#op
  • pen#por
  • rts.
slide-18
SLIDE 18

Vul ulner nerabi bility,Patter erns ns,Iden Identified, ed,in, n,Open, pen,Ports

18

Terminate+on-going+ sessions+by+sending+ two+UDP+packets Crash+Instagram+by+ sending+just+a+HTTP+ request Send+a+HTTP+URL+request+pointing+to+a+large+file,+ to+maliciously+inflate(victim(apps’(cellular(data( usage in+the+background. Some+open+ports+are+used+as+ an(analytics(interface(for+their+ companion+websites.

slide-19
SLIDE 19

Deni enial'of

  • f'Se

Service ce.A .Attack ck.E .Evaluation

  • n.

19

slide-20
SLIDE 20

In Inter er&de devi vice+ e+Connec nnectivi vity+Mea easur urem emen ent

20

224$cellular$ networks$ 2,181$WiFi networks

6,391$network$scan$traces

111$(49.6%) 1,823$(83.6%) Allow$intra?network connectivity$(in$the$same$network) 23$cellular 10$WiFi Allow$inter?network connectivity$due$to$using$public$IP Remote$open?port$attacks$require$the$victim$ device$to$be$connected$(intra? or$inter?network).$

slide-21
SLIDE 21

Con Conclusion

  • n)&)Takeaway
  • We#proposed#the#first#open.port#analysis#pipeline.
  • We#found#open#ports#in#many#popular#and#built.in#apps,#and#also#in#SDKs.
  • We#performed#comprehensive#security#assessments:
  • Vulnerabilities#in#popular#apps,#DoS#experiments,#real#connectivity#measurement.

21

Contact:#Daoyuan Wu# dywu.2015@smu.edu.sg