Seguridad en Android

Seguridad en Android a nivel de aplicaciones y de dispostivos

Transcript

1. Seguridad
   en Android
   Diciembre 2014
   

   View Slide

2. https://speakerdeck.com/jmortega/
   @jmortegac
   

   View Slide

3. DALVIK / ART/ APK / PERMISOS
   MALWARE
   TOOLS
   SEGURIDAD EN COMPONENTES
   ANÁLISIS ESTÁTICO ECLIPSE /ANDROID STUDIO
   ENCRIPTACIÓN / OFUSCACIÓN
   INGENIERÍA INVERSA
   ANALIZADORES APK / FORENSICS
   

   View Slide

4. Dalvik vs ART(4.4)
   DALVIK ART
   Compilación
   Just-In-Time (JIT)
   Compilación
   Ahead-Of-Time (AOT)
   Cache se construye a
   medida que se ejecutan
   las aplicaciones
   Cache se construye al
   arrancar el dispositivo
   Apps se compilan cuando
   se ejecutan
   Almacena las aplicaciones
   compiladas
   Mayor consumo espacio
   interno
    Settings>Developer options>Select runtime
   

   View Slide

5. Generar APK
   ZIP + jarsigner+ zipalign
   

   View Slide

6. Obtener APK
    Google Play
    Markets alternativos (BlackMart, Fdroid, Aptoide)
    Apk extractor
    http://apps.evozi.com/apk-downloader
   

   View Slide

7. /data/data ROOT
   $ adb shell
   

   View Slide

8.  Detectar Root
   private boolean isDeviceRooted(){
   try{
   Runtime.getRuntime().exec("su");
   return true;
   }catch(IOExeception ex){
   return false;
   }
   }
   public static boolean() isDeviceRooted(){
   File f= new File("/system/sbin/su");
   return f.exits();
   }
   

   View Slide

9. View Slide

10. Permisos
     Instalar algún tipo de
    aplicación que compruebe los
    permisos.
     Deshabilitar actualizaciones
    automáticas.
    

    View Slide

11. Limitar permisos
    

    View Slide

12. Recomendaciones en permisos
     Minimizar el número de permisos que se piden
     33% aplicaciones piden más permisos de los
    necesarios
     ¿Es necesario android.permission.CAMERA?
    ContentValues contentValues = new ContentValues();
    contentValues.put(MediaStore.Images.Media.DESCRIPTION, "Image capture");
    contentValues.put(MediaStore.Images.Media.TITLE, "new image");
    Uri uri =
    getContentResolver().insert(MediaStore.Images.Media.EXTERNAL_CONTENT_URI,
    contentValues);
    Intent intent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE);
    intent.putExtra(MediaStore.EXTRA_OUTPUT, uri);
    intent.putExtra(MediaStore.EXTRA_VIDEO_QUALITY, 1);
    startActivityForResult(intent, 1);
    

    View Slide

13. Permissions in apps
    
     ¿Donde está el permiso?
     En la aplicación Google Camera
     GoogleCamera.apk
    

    View Slide

14. View Slide

15. Malware
    • Instalar de orígenes
    conocidos
    • Comprobar los permisos
    antes de instalar/actualizar
    • Revisar comentarios de los
    usuarios
    • Deshabilitar conexión
    automática a redes Wifi y
    evitar conectarnos a redes
    Free.
    Recomendaciones
    para evitar
    malware
    

    View Slide

16. Malware detection in Google play
    Bluebox
    Security
    Scanner
    SRT
    AppScanner
    Lookout
    Mobile
    Security
    Advanced
    Mobile Care
    Malwarebytes
    Anti-Malware
    CM Security
    

    View Slide

17. foresafe.com/scan
    mobilesandbox.org
    andrototal.org
    copperdroid
    

    View Slide

18. View Slide

19. Firmar aplicaciones
     Java keytool
    $ keytool -genkey -v -keystore
    -alias -keyalg RSA -keysize 2048
    -validity 10000
    

    View Slide

20. Android Studio
     Tool included in Android SDK for apk compress and optimizing
    $ zipalign -f 4 app-signed.apk final-app.apk
     Build > Generate Signed APK
    

    View Slide

21. View Slide

22. Shared preferences
     Fichero xml almacenado en
    /data/data/com.your.package/shared_prefs/preferences
    .xml
     No es recomendable almacenar información sensible
    relativa a nombres de usuario y contraseñas
     Librería para securizar este fichero
     https://github.com/scottyab/secure-preferences
    ROOT
    

    View Slide

23. Secure Shared preferences ROOT
    

    View Slide

24. Webview
    

    View Slide

25. Webview best practices
    Tener cuidado con librerías de terceros
    No guardar passwords
    No guardar datos de formularios
    Limpiar Caché
    webSettings.setSavePassword(false);
    webSettings.setSaveFormData(false);
    @Override public void onPageFinished(WebView view, String url) {
    super.onPageFinished(view, url);
    view.clearCache(true); //delete local files in the browser
    }
    

    View Slide

26. SQLite
    SQLiteDatabase db = dbHelper.getWriteableDatabase();
    String userQuery = "SELECT lastName FROM useraccounts WHERE
    userID = ?";
    SQLiteStatement prepStatement =db.compileStatement(userQuery);
    prepStatement.bindString(1, "userID");
    prepStatement.simpleQueryForString();
    Sentencias preparadas para evitar sql injection
    rawQuery
    compileStatement
    

    View Slide

27. OWASP Mobile Top 10 Risks
    

    View Slide

28. View Slide

29. LINT ECLIPSE /ANDROID STUDIO
     Integrado en el the SDK
     Permite detectar errores comunes de programación
    

    View Slide

30. ANDROID STUDIO
    

    View Slide

31. SONARQuBE http://www.sonarqube.org/
    

    View Slide

32. View Slide

33. Encriptación en el teléfono
     Soportado desde Android 3.0
     Lleva 1h encriptar los datos
     Implica una reducción del rendimiento
    

    View Slide

34. View Slide

35. Ofuscación
     Renombra clases, campos y métodos con nombre
    cortos (a,b,c,..)
    

    View Slide

36. Ofuscación en proyectos android
    Proguard
    Integrado en el SDK
     http://developer.android.com/tools/help/proguard.html
    Habilitar Proguard en eclipse
    proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-
    project.txt
    

    View Slide

37. Ofuscación en proyectos android
    Habilitar Proguard en android STUDIO
    build.gradle
    android {
    buildTypes {
    release {
    runProguard true
    proguardFile getDefaultProguardFile('proguard-android.txt') ,
    'proguard-rules.pro'
    }
    }
    

    View Slide

38. Proguard.config
    -optimizationpasses 5
    -dontusemixedcaseclassnames
    -dontskipnonpubliclibraryclasses
    -dontpreverify
    -verbose
    -optimizations !code/simplification/arithmetic,!field/*,!class/merging/*
    -keep public class * extends android.app.Activity
    -keep public class * extends android.app.Application
    -keep public class * extends android.app.Service
    -keep public class * extends android.content.BroadcastReceiver
    -keep public class * extends android.content.ContentProvider
    -keep public class * extends android.app.backup.BackupAgentHelper
    -keep public class * extends android.preference.Preference
    -keep public class com.android.vending.licensing.ILicensingService
    -keepclasseswithmembernames class * {
    native ;
    }
    -keepclasseswithmembernames class * {
    public (android.content.Context, android.util.AttributeSet);
    }
    -keepclasseswithmembernames class * {
    public (android.content.Context, android.util.AttributeSet, int);
    }
    -keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf(java.lang.String);
    }
    -keep class * implements android.os.Parcelable {
    public static final android.os.Parcelable$Creator *;
    }
    

    View Slide

39. View Slide

40. Renombrar .apk to .zip
    Extraer zip que contiene el .dex
    Ejecutar dex2jar
    Abrir el .jar con java decompiler
    

    View Slide

41. Apk Tool
     Convierte un fichero .apk file a un projecto android
    $ apktool d target.apk output_directory
    

    View Slide

42. Dex2jar
     http://code.google.com/p/dex2jar
     Convierte ejecutable Dalvik en fichero jar.
    $ unzip target.apk
    $ d2jdex2jar.sh classes.dex -o target.jar
    

    View Slide

43. Java Decompiler
     http://java.decompiler.free.fr
    

    View Slide

44. APK to Java Decompiler
     https://github.com/skylot/jadx
    Decompilar directamente desde apk
    

    View Slide

45. Virtuous Ten Studio
    http://virtuous-ten-studio.com/
    Sólo para windows
    

    View Slide

46. Virtuous Ten Studio
    

    View Slide

47. Virtuous Ten Studio
    

    View Slide

48. Androwarn
    python androwarn.py -i my_apk.apk -r html -v 3
    https://github.com/maaaaz/androwarn
    Telephony identifiers exfiltration: IMEI, IMSI, MCC, MNC, LAC, CID, operator's name...
    Device settings exfiltration: software version, usage statistics, system settings, logs...
    Geolocation information leakage: GPS/WiFi geolocation...
    Connection interfaces information exfiltration: WiFi credentials, Bluetooth MAC adress...
    Telephony services abuse: premium SMS sending, phone call composition...
    Audio/video flow interception: call recording, video capture...
    Remote connection establishment: socket open call, Bluetooth pairing, APN settings
    edit...
    PIM data leakage: contacts, calendar, SMS, mails...
    External memory operations: file access on SD card...
    PIM data modification: add/delete contacts, calendar events...
    Arbitrary code execution: native code using JNI, UNIX command, privilege escalation...
    Denial of Service: event notification deactivation, file deletion, process killing, virtual
    keyboard disable, terminal shutdown/reboot...
    

    View Slide

49. View Slide

50. Dexter online
     https://dexter.bluebox.com
    

    View Slide

51. Dexter online
    

    View Slide

52.  https://github.com/viaforensics/android-forensics
    Forensics
    

    View Slide

53. Books
    

    View Slide

54. References
     http://code.google.com/p/dex2jar/
     https://code.google.com/p/android-apktool
     http://ashishb.net/security/android-security-related-tools
     http://androidcracking.blogspot.com.es
     http://developer.android.com/guide/topics/security/permissions.html
     http://source.android.com/devices/tech/security/#android-
    application-security
     http://siis.cse.psu.edu/android_sec_tutorial.html
    

    View Slide

55. View Slide