[mDevCamp 2020] Reversing Android Apps

1. Reversing Android Apps
2. Marc Obrador Lead Architect @ Build38 Barcelona marc@build38.com @marcobrador /in/marc-obrador
4. Source: https://en.wikipedia.org/wiki/Reverse_engineering It’s illegal (in the EU)!
6. Josep Bernad iOS Albert Sunyer UI
7. Artà is in Mallorca ABF takes place (usually) in June COVID-19 pushed it to … ?
9. Get to know the app Step 0
10. Get to know the app
11. Get to know the app
12. Get to know the app
13. Get to know the app
14. Static Analysis Step 1
15. Static Analysis
16. Getting the APK
17. Decompiling the app https://ibotpeaches.github.io/Apktool/ $ brew install apktool
18. Decompiling the app
24. Let’s keep looking around
25. Wait… “discount codes”?
26. App users get a discount for events
28. Let’s take a closer look…
30. HTTP Basic Authorisation = Base64(“username:password”)
32. HTTP Basic Authorisation = Base64(“username:password”) username = “string1” xor “string2” pasword = “string3” xor “string2”
34. Protecting against static analysis ProGuard is a good start… for regular apps • It’s just method renaming and code shrinking • Tools for reversing ProGuard exist: http://apk-deguard.com/ Other (paid) alternatives exist for obfuscation Writing sensitve code in native (NDK) is a good idea
35. Dynamic Analysis Step 2
36. Dynamic Analysis
37. Dynamic Analysis
38. Network Sniffing a.k.a MITM
39. Network Sniffing https://www.charlesproxy.com/
40. Setting Up Charles Proxy
41. Setting Up Charles Proxy
42. Setting Up Charles Proxy
43. First attempt…
44. First attempt…
45. Setting Up Charles Proxy
46. Setting Up Charles Proxy
47. Let’s try again…
53. • Implement Root/Debugger/Emulator/Hooking Framework detection • Use certificate pinning • Try to detect app tampering Protecting against dynamic analysis
54. Using Certificate Pinning Source: https://developer.android.com/training/articles/security-config
55. Tampering with the App Step 3
56. Assuming the app implemented Certificate Pinning…
57. $ adb install “Downloads/Artà Beer Festival_v1.2.5_apkpure.com.apk” Performing Streamed Install Success $ adb shell am start com.marcobrador.android.artabeerfestival/.SplashActivity Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category .LAUNCHER] cmp=com.marcobrador.android.artabeerfestival/.SplashActivity }
58. Let’s try to remove it
62. Time to give it a try!
65. Preventing Repackaging
66. Looks like we are done here Looks like we are done here
67. This code can be removed, too!
68. Closing Thoughts
72. Thank you!