[mDevCamp 2020] Reversing Android Apps

Transcript

1. 1.

   Reversing Android Apps

2. 2.

   Marc Obrador Lead Architect @ Build38 Barcelona marc@build38.com @marcobrador /in/marc-obrador

3. 3.

   None
4. 4.

   Source: https://en.wikipedia.org/wiki/Reverse_engineering It’s illegal (in the EU)!

5. 5.

   None
6. 6.

   Josep Bernad iOS Albert Sunyer UI

7. 7.

   Artà is in Mallorca ABF takes place (usually) in June

   COVID-19 pushed it to … ?
8. 8.

   None
9. 9.

   Get to know the app Step 0

10. 10.

    Get to know the app

11. 11.

    Get to know the app

12. 12.

    Get to know the app

13. 13.

    Get to know the app

14. 14.

    Static Analysis Step 1

15. 15.

    Static Analysis

16. 16.

    Getting the APK

17. 17.

    Decompiling the app https://ibotpeaches.github.io/Apktool/ $ brew install apktool

18. 18.

    Decompiling the app

19. 19.

    None
20. 20.

    None
21. 21.

    None
22. 22.

    None
23. 23.

    None
24. 24.

    Let’s keep looking around

25. 25.

    Wait… “discount codes”?

26. 26.

    App users get a discount for events

27. 27.

    None
28. 28.

    Let’s take a closer look…

29. 29.

    None
30. 30.

    HTTP Basic Authorisation = Base64(“username:password”)

31. 31.

    None
32. 32.

    HTTP Basic Authorisation = Base64(“username:password”) username = “string1” xor “string2”

    pasword = “string3” xor “string2”
33. 33.

    None
34. 34.

    Protecting against static analysis ProGuard is a good start… for

    regular apps • It’s just method renaming and code shrinking • Tools for reversing ProGuard exist: http://apk-deguard.com/ Other (paid) alternatives exist for obfuscation Writing sensitve code in native (NDK) is a good idea
35. 35.

    Dynamic Analysis Step 2

36. 36.

    Dynamic Analysis

37. 37.

    Dynamic Analysis

38. 38.

    Network Sniffing a.k.a MITM

39. 39.

    Network Sniffing https://www.charlesproxy.com/

40. 40.

    Setting Up Charles Proxy

41. 41.

    Setting Up Charles Proxy

42. 42.

    Setting Up Charles Proxy

43. 43.

    First attempt…

44. 44.

    First attempt…

45. 45.

    Setting Up Charles Proxy

46. 46.

    Setting Up Charles Proxy

47. 47.

    Let’s try again…

48. 48.

    None
49. 49.

    None
50. 50.

    None
51. 51.

    None
52. 52.

    None
53. 53.

    • Implement Root/Debugger/Emulator/Hooking Framework detection • Use certificate pinning •

    Try to detect app tampering Protecting against dynamic analysis
54. 54.

    Using Certificate Pinning Source: https://developer.android.com/training/articles/security-config

55. 55.

    Tampering with the App Step 3

56. 56.

    Assuming the app implemented Certificate Pinning…

57. 57.

    $ adb install “Downloads/Artà Beer Festival_v1.2.5_apkpure.com.apk” Performing Streamed Install Success

    $ adb shell am start com.marcobrador.android.artabeerfestival/.SplashActivity Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category .LAUNCHER] cmp=com.marcobrador.android.artabeerfestival/.SplashActivity }
58. 58.

    Let’s try to remove it

59. 59.

    None
60. 60.

    None
61. 61.

    None
62. 62.

    Time to give it a try!

63. 63.

    None
64. 64.

    None
65. 65.

    Preventing Repackaging

66. 66.

    Looks like we are done here Looks like we are

    done here
67. 67.

    This code can be removed, too!

68. 68.

    Closing Thoughts

69. 69.

    None
70. 70.

    None
71. 71.

    None
72. 72.

    Thank you!