[mDevCamp 2020] Reversing Android Apps

[mDevCamp 2020] Reversing Android Apps

38b49a5fa7e0519f2919ac342a463980?s=128

Marc Obrador

June 11, 2020
Tweet

Transcript

  1. Reversing Android Apps

  2. Marc Obrador Lead Architect @ Build38 Barcelona marc@build38.com @marcobrador /in/marc-obrador

  3. None
  4. Source: https://en.wikipedia.org/wiki/Reverse_engineering It’s illegal (in the EU)!

  5. None
  6. Josep Bernad iOS Albert Sunyer UI

  7. Artà is in Mallorca ABF takes place (usually) in June

    COVID-19 pushed it to … ?
  8. None
  9. Get to know the app Step 0

  10. Get to know the app

  11. Get to know the app

  12. Get to know the app

  13. Get to know the app

  14. Static Analysis Step 1

  15. Static Analysis

  16. Getting the APK

  17. Decompiling the app https://ibotpeaches.github.io/Apktool/ $ brew install apktool

  18. Decompiling the app

  19. None
  20. None
  21. None
  22. None
  23. None
  24. Let’s keep looking around

  25. Wait… “discount codes”?

  26. App users get a discount for events

  27. None
  28. Let’s take a closer look…

  29. None
  30. HTTP Basic Authorisation = Base64(“username:password”)

  31. None
  32. HTTP Basic Authorisation = Base64(“username:password”) username = “string1” xor “string2”

    pasword = “string3” xor “string2”
  33. None
  34. Protecting against static analysis ProGuard is a good start… for

    regular apps • It’s just method renaming and code shrinking • Tools for reversing ProGuard exist: http://apk-deguard.com/ Other (paid) alternatives exist for obfuscation Writing sensitve code in native (NDK) is a good idea
  35. Dynamic Analysis Step 2

  36. Dynamic Analysis

  37. Dynamic Analysis

  38. Network Sniffing a.k.a MITM

  39. Network Sniffing https://www.charlesproxy.com/

  40. Setting Up Charles Proxy

  41. Setting Up Charles Proxy

  42. Setting Up Charles Proxy

  43. First attempt…

  44. First attempt…

  45. Setting Up Charles Proxy

  46. Setting Up Charles Proxy

  47. Let’s try again…

  48. None
  49. None
  50. None
  51. None
  52. None
  53. • Implement Root/Debugger/Emulator/Hooking Framework detection • Use certificate pinning •

    Try to detect app tampering Protecting against dynamic analysis
  54. Using Certificate Pinning Source: https://developer.android.com/training/articles/security-config

  55. Tampering with the App Step 3

  56. Assuming the app implemented Certificate Pinning…

  57. $ adb install “Downloads/Artà Beer Festival_v1.2.5_apkpure.com.apk” Performing Streamed Install Success

    $ adb shell am start com.marcobrador.android.artabeerfestival/.SplashActivity Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category .LAUNCHER] cmp=com.marcobrador.android.artabeerfestival/.SplashActivity }
  58. Let’s try to remove it

  59. None
  60. None
  61. None
  62. Time to give it a try!

  63. None
  64. None
  65. Preventing Repackaging

  66. Looks like we are done here Looks like we are

    done here
  67. This code can be removed, too!

  68. Closing Thoughts

  69. None
  70. None
  71. None
  72. Thank you!