Android security (for developers) at jDays 2015

Android security (for developers) at jDays 2015

Slides from the 'Android Security For Developers' session at jDays 2015 in Göteborg, Sweden

103e1ebcacd620770cf32a36b9aba17e?s=128

AppFoundry

March 17, 2015
Tweet

Transcript

  1. Android security FOR DEVELOPERS FILIP MAELBRANCKE

  2. Your host Filip Maelbrancke Consultant @ AppFoundry filip.maelbrancke@appfoundry.be @fmaelbrancke

  3. None
  4. X

  5. Security = managing risk ASSET VULNERABILITY THREAT

  6. Security = managing risk ASSET VULNERABILITY THREAT

  7. All in one device Increases threat proBability • GPS •

    Contacts • Camera • Email (work) • Wallet
  8. Always out Vulnerability / Exploitability • Stolen • Forgotten •

    Lost
  9. Everyone uses it Vulnerability / Exploitability • Weak pins •

    Use of open public WiFi
  10. Android security MODEL Game X Game Y System Contacts Email

    Google Play Verify app signature App sandbox Permissions application isolation
  11. typical mobile app MOBILE APPLICATION UI LOCAL STORAGE REMOTING LAYER

    REMOTE API COMMUNICATION CHANNEL
  12. Security APP HARDENING DATA NETWORK SERVICES

  13. None
  14. Securing the app JAVA CLASS DEX

  15. reverse engineer

  16. obtain apk adb backup -apk be.myapp ADB backup app Titanium,

    Astro, Helium, … adb shell pm list packages -f adb pull /data/app/be.myapp-1.apk
  17. apk structure apk = zip APK AndroidManifest classes.dex Resources

  18. reverse engineer TOOLS • Apktool • Dex2jar • JADX

  19. Reverse engineer smali / baksmali apktool low level disassembled Dex

    bytecode code code can be modified recompile / resign
  20. Reverse engineer apktool d myapp.apk

  21. Reverse engineer

  22. Reverse engineer

  23. Reverse engineer convert .dex file to a .jar with java

    bytecode DEX2JAR dex -> java java decompiler code very readable
  24. Reverse engineer

  25. Reverse engineer command-line / GUI tools JADX

  26. Reverse engineer Jeb Decompiler PAID dex -> java native dex

    decompiler
  27. reverse engineer

  28. Obfuscation

  29. Proguard obfuscate optimize Shrink

  30. proguard obfuscation

  31. proguard

  32. proguard configuration

  33. other techniques If possible, run code at server! server String

    encryption Hide sensitive strings eg “Secure” Native code Java Native Interface reflection Proxy Introduces indirection Class encryption Use DexGuard
  34. dexguard Same config proguard++ Commercial Good value for the money

    Tamper checks
  35. dexguard

  36. proguard tips Test! release build Mapping.txt Save! Crash? Supported on

    Crashlytics, Crittercism, ...
  37. TAMPER DETECTION

  38. Environment 1.installer 2.debugger / emulator 3.BINARY Validation Tamper detection /

    protection
  39. INSTALLER PLAY STORE INSTALLER

  40. debugger Debugger check

  41. debugger Debugger check

  42. emulator EMULATOR check

  43. SIGNING KEY Valid signing key • SHA1 of signing cert

    • Embed • Check with runtime signature
  44. SIGNING KEY Valid signing key

  45. rooted device root detection • Check typical apps / files

    • Check keys • /system r/w
  46. None
  47. Data protection laws that govern data protection Law obligation beyond

    legal obligations ➪ moral obligation
  48. local Data protection Avoid it if you can Avoid External

    storage Avoid external storage for sensitive information For critical info set android:saveEnabled="false" Backup set android:allowBackup=false proper permissions MODE_PRIVATE with files
  49. local Data protection getWindow().setFlags(LayoutParams.FLAG_SECURE, LayoutParams.FLAG_SECURE); avoid screen shots LOGOUT on

    inactivity if usability allows and clear the cached information
  50. keylogger

  51. Android not enough? rooted devices internal storage full disk crypto

    brute forcing
  52. CRYPTO

  53. crypto in Android = JCA APP JCA (Java Cryptography Architecture)

    Provider Provider Message Digest Key Generation Digital Signature ...
  54. JCA Bouncy Castle Android OpenSSL APP JCA (Java Cryptography Architecture)

    Harmony
  55. bouncy castle Android = subset of upstream release cut-down CONSISTENT

    Consistent crypto across Android versions MINIMAL change github.com/rtyley/spongycastle Spongy castle Repackage of Bouncy Castle for Android
  56. GPS dynamic Security provider Since Google Play Services 5 google

    play services replacement for the platform’s bundled provider security patches rapid delivery frequently updated by Google
  57. dynamic security provider setup dependencies { compile 'com.google.android.gms:play-services:6.1.+' }

  58. dynamic security provider setup

  59. Android security providers

  60. Conscrypt

  61. encryption libs SQLCipher sqlcipher.net • Modified version of SQLite •

    AES-256 encryption • Drop-in replacement iocipher guardianproject.info/code/iocipher Virtual encrypted disk
  62. key management Store along with the data (file private to

    the app) Store Embed Embed in source code (obfuscated ?) EASY TO EXTRACT
  63. key management don’t store Don’t store the key on the

    device Have it entered each time necessary Store In systems service SOLUTIONS
  64. key derivation Long random strings of bits encryption keys people

    vs keys Users are familiar with passwords Crypto algo PBKDF2WithHmacSHA1 password based encryption Generate strong crypto keys based on humanly-manageable passwords
  65. proper key derivation Using a salt protects from table- assisted

    / pre-computed dictionary attacks SALT key stretching Repeat the key derivation operation multiple times to produce the final key Slows down brute force attacks
  66. key derivation https://github.com/nelenkov/android-pbe http://nelenkov.blogspot.jp/2012/04/using-password-based-encryption-on.html Nikolay Elenkov

  67. KEYCHain? Keystore provider • Since Android 4.3 • Can be

    hardware-backed
  68. Android keystore available from Android 4.3 java security provider APP

    can generate & save private keys keys private to each app
  69. keystore

  70. keystore

  71. network

  72. Secure communication channel use https Use SSL / TLS •

    Confidentiality • Authentication VALIDATION Hostname verification Certificate pinning http://android-ssl.org/
  73. secure communication channel hostname verification

  74. SSL certificates CA issued, Android recognized CA issued behaviour change

    custom TrustManager self-signed certificates
  75. certificate authorities

  76. certificate authorities https://bluebox.com/blog/technical/questioning-the-chain-of-trust-investigations-into- the-root-certificates-on-mobile-devices

  77. Trustmanager StrongTrustManager • Validate whole certificate chain • Debian certificate

    store
  78. self signed cert

  79. anti-pattern don’t trust all!

  80. Self-signed cert import in your app certificate custom trustmanager no

    man-in-the-middle attacks
  81. certificate pinning with expected certificate / public key Associate host

    hashing anonymize certificate / public key
  82. certificate pinning echo | openssl s_client -connect host:443 2>&1 |

    sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > mycertificate.pem get certificate (openssl) embed in application /res/raw Custom trustmanager Based on keystore Load into keystore SSL context Init SSL context with TrustManager https://developer.android.com/training/articles/security-ssl.html
  83. NOGOTOFAIL Test tool man in the middle server attempts to

    inject attacks into connections checks https://github.com/google/nogotofail
  84. None
  85. Securing services Controls • Kill switch for specific functionality •

    Server downtime communication • Mandatory update mechanism
  86. securing services Backend REST and APIs can have similar vulnerabilities

    to web applications mitigate follow OWASP top 10
  87. None
  88. Effective security Using CryptoLint, we performed a study on cryptographic

    implementations in 11,748 Android applications. Overall we find that 10,327 programs – 88% in total – use cryptography inappropriately. The raw scale of misuse indicates a widespread misunderstanding of how to properly use cryptography in Android development. “ ”
  89. effective security hardcoded passphrases manually seeded SecureRandom insufficient key generation

    iterations hardcoded salts non-random initialization vectors
  90. security testing Static analysis Manual code review design review Analysis

    Static Dynamic Penetration testing
  91. suggested reading Android Security Cookbook
 Keith Makan / Scott Alexander-Bown

    (9781782167167) Android Security Internals 
 Nikolay Elenkov (9781593275815) Android Hacker’s Handbook
 Joshua J. Drake et al. (9781118608647) Application Security for the Android platform
 Jeff Six (9781449315078) 

  92. suggested reading developer.android.com
 https://developer.android.com/training/articles/security-tips.html 
 https://source.android.com/devices/tech/security/ OWASP
 https://www.owasp.org/index.php/OWASP_Mobile_Security_Project Google+ community

    
 Android security discussions Blogs
 http://nelenkov.blogspot.com.tr/…

  93. Questions? Filip Maelbrancke Consultant @ AppFoundry filip.maelbrancke@appfoundry.be @fmaelbrancke