code, • run a malicious DEX file without notification, • add a “guard code” to monitor its own processes, • rename .APK (Android application package) files used to install the malicious apps, • and launch the new activity as the payload.
attack vector, called Right_core, is a silent operation triggered by one of three common events on the device. • BOOT_COMPLETED – occurs after booting the device. • TIME_TICK – occurs every time a minute passes. • SCREEN_ON – occurs when the screen is turned on. The second attack vector, called qs, is initiated only if the first vector failed to gain root. This attack vector uses social engineering in order to achieve its purspose. The component “qs” is also XOR encrypted and needs to be decrypted by the parent malware. The malware’s authors Yingmob racked up around US $300,000 per month at its peak.
analysis • Anomaly detection • Rootkit detection • Software-based attestation: verify the memory contents of embedded devices and establish the absence of malicious changes to the memory contents.
has a copy of the device’s presumed memory, and sends a request to the embedded device. The device can prove its memory contents by returning the correct response.
Hardened kernel ➔ Stronger sandboxing and isolation for apps & services ➔ Backported security features and quicker patching ➔ Firewall & network hardening ➔ Open-source and free of proprietary services ➔ Security-centric user experience changes
permissions model ◦ Process isolation ◦ Extensible mechanism for secure IPC (Inter-Process Communication) ◦ The ability to remove unnecessary and potentially insecure parts of the kernel • Application sandbox: UID, separate process, native code
that tells the system what to do with all the top-level components • Activities: the code for a single, user-focused task • Services: a body of code that runs in the background, in its own process or in the context of another application. Bind to use • Broadcast Receiver: an object that is instantiated when an IPC mechanism known as an Intent is issued by the operating system or another application
Prior to Android 7.0: device manufacturers could modify the set of CAs shipped on their devices ◦ Android 7.0+: uniform set of system CAs, modification by device manufacturers is no longer permitted • Application Signing ◦ Shared UID feature: declare security permissions at the Signature protection level, restricting access only to applications signed with the same key
competing concerns: • Connectivity to as many hosts as possible. That includes advanced hosts that run the latest versions of boringssl and less out of date hosts running older versions of OpenSSL. • Security of the connection. This includes verification of the remote webserver with certificates and the privacy of data exchanged with strong ciphers.
with their expected X509 certificate or public key. • Which certificate to pin against in the chain? • Certificate or public key pinning? • Handling compromise: Fail hard or fail soft? • Where should we store the certificate/public key? ◦ Preloading ◦ Trust on first use ◦ Over the air
an assembler/disassembler for the dex format used by dalvik, Android's Java VM implementation: https://github.com/JesusFreke/smali • jd-gui: https://github.com/java-decompiler/jd-gui
to bytecode (.class files). Bytecode is more compact than Java source code, but it may still contain a lot of unused code, especially if it includes program libraries. Shrinking programs such as ProGuard can analyze bytecode and remove unused classes, fields, and methods. The program remains functionally equivalent, including the information given in exception stack traces.
information: source file names, line numbers, field names, method names, argument names, variable names, etc. This information makes it straightforward to decompile the bytecode and reverse-engineer entire programs. Sometimes, this is not desirable. Obfuscators such as ProGuard can remove the debugging information and replace all names by meaningless character sequences, making it much harder to reverse-engineer the code. It further compacts the code as a bonus.
some sophisticated verification of the byte code. This analysis makes sure the code can't accidentally or intentionally break out of the sandbox of the virtual machine.
specific proguard files proguardFile 'proguard-google-play-services.pro' proguardFile 'proguard-gson.pro' ... // Default proguard files & project app specific rules, proguardFile 'proguard-project-app.pro' proguardFile getDefaultProguardFile('proguard-android.txt') // As of Gradle Android plugin 1.1.0, the test APK has a separate config testProguardFile 'proguard-project-test.pro' } } }
the commercial sibling of ProGuard for Android. • ProGuard provides name obfuscation: it can replace the original names of classes, methods, and fields by short, meaningless names. DexGuard additionally provides string encryption and class encryption.
been modified in anyway or if the signature is changed • Verify the installer • It can be done with PackageManager • Multiple check point & use obfuscation in case it’s bypassed • Fail policy: what happens if modification is detected?
• Avoid storing your data in the shared storage • Encrypt your preferences / files => the private folder can be found on the device at path /data/data/yourpackage • Encrypt your SQLite database: https://github.com/sqlcipher/sqlcipher
jinqian
kazuhitotakahashi
kakehashi
tacck
blueb
ysknsid25
kaminashi
cmusudakeisuke
smt7174
sansantech
abemii
fumiyasac0921
isaoshimizu
bermonpainter
sachag
smashingmag
michaelherold
trallard
skipperchong
bluesmoon
eitanlees
pedronauck
lara
eileencodes
vanstee
