"Hacking Android, a Hacker's narrative."

Those trendy, flashy and allusive Android devices in your pockets have allowed you to solve numerous problems but at the same time, introduced an indefinite amount of security related threats. Currently there is a large number of Android users who find themselves in an exciting yet hostile environment that without mobile devices, life would become tougher in many aspects.

This Android environment that you find yourself in is not new so why are you still worrying about mobile security? Hackers are constantly using multiple tools, techniques and targets to achieve their goals. Perhaps a hacker narrative describing how Android targets are exploited and defended may provide some insight into where you currently are, how you got here and where you are going so that you can worry less and Android more.

Transcript

1. HACKING ANDROID A Hacker's Narrative
2. WHOAMI @brompwnie chris@sensepost.com
3. PRESENT DAY “Worrying is like a rocking chair: it gives you something to do but never gets you anywhere” - Erma Bombeck
4. WHAT TODO?
5. OUTLINE What are the threats? Quick glance at Malware Recent Threats Traditional Problems Demo - Hack your Favorite Apps What can Dev's do?
6. THREAT LANDSCAPE
7. MALWARE Malicious apps make a *regular* appearance Data Acquisition Malicious activity Annoyance ¯\_(ツ)_/¯ Ransomware Person of interest
11. https://android-developers.googleblog.com/2017/04/an- investigation-of-chrysaor-malware-on.html
12. LOCAL ACCESS
13. REMOTE ACCESS
14. LINUX PWN
15. 802.11
16. CLOAK AND DAGGER
17. TRADITIONAL PROBLEMS
18. 2015-16 2017 https://developer.android.com/guide/topics/providers/content-provider-basics.html
19. THREAT LANDSCAPE
20. ANDROID VS APPLE
22. DEMO TODO Infect your Favorite Apps Have Phun
23. DO THE DEMO DUDE
24. WHAT CAN WE DO? Mobile ASVS Mobile Testing Guide Anti- Tampering/Debugging/Instrumentation SafetyNet Attestation API
25. CONCLUSION We are worrying because there are threats Security is very hard to get right Security is very easy to get wrong Go forth and Pwn
26. QUESTIONS? chris@sensepost.com @brompwnie https://github.com/sensepost/kwetza https://www.twitch.tv/brompwnie