application. • ͦͷख๏Λར༻ͨ͠ΞϓϦղੳख๏ɺ߈ܸख๏ (Application poisoning)ͷհ • New analysis and attack technics using this technic.(Application poisoning) 4 Preinstalled Android Application Poisoning
many steps? -apkϑΝΠϧͷߏͪΐͬͱෳࡶ -apk file structure is a bit complicated ࣮ߦόΠφϦɻվ͟Μ͢ΔͨΊʹsmaliͰల։͕ඞཁ /binary, it needs to be extract by smali for manipulation ѹॖ͞Ε͍ͯΔ/compressed ॺ໊͞Ε͍ͯΔ/signed Τϯίʔυ͞Ε͍ͯΔ/encoded 8 Preinstalled Android Application Poisoning Prologue
Android programs are compiled into .dex (Dalvik Executable) files, which are in turn zipped into a single .apk file on the device. .dex files can be created by automatically translating compiled applications written in the Java programming language. http://developer.android.com/guide/appendix/glossary.html http://www.scriptol.com/programming/dalvik.php 9 Preinstalled Android Application Poisoning Prologue
• baksmali(smaliܗ͔ࣜΒdexϑΝΠϧͷม)͕Αࣦ͘ഊ͢Δ • baksmali(convert smali format to dex file) often fails. • ϓϦΠϯετʔϧΞϓϦΞϯΠϯετʔϧͰ͖ͳ͍ͷͰɺஔ͖͑Ͱ͖ͳ͍ • Pre-install applications can’t be replaced to manipulated apps because it’s not uninstallable. • ࠶ॺ໊ʹΑΓɺॺ໊͕มߋ͞Εͯ͠·͏ɻ • Original signature would be changed by re-sign. ݱঢ়ͷAndroidΞϓϦվ͟Μख๏ͷ՝ Problems for the present common manipulation technic 10 Preinstalled Android Application Poisoning Prologue
in AndroidManifest.xml • ॺ໊ʹΑΔηΩϡϦςΟϞσϧʹΑΓɺΞϓϦؒͷΞΫηεʢ࿈ܞʣ੍ݶΛߦ͏͜ͱ ͕Մೳɻ • This security model can restrict access(combination) between applications. • ॺ໊͕มߋ͞Εͯ͠·͏ͱΞϓϦؒͷΞΫηγϏϦςΟΛࣦ͍ɺͦͷػೳ͕ར༻Ͱ͖ ͳ͍έʔε͕͋Γ • If a signature would be changed, an application may lose accessibility to another application. ॺ໊ʹΑΔηΩϡϦςΟϞσϧ Security model by signature 11 Preinstalled Android Application Poisoning Prologue
• baksmali(smaliܗ͔ࣜΒdexϑΝΠϧͷม)͕Αࣦ͘ഊ͢Δ • baksmali(convert smali format to dex file) often fails. • ϓϦΠϯετʔϧΞϓϦΞϯΠϯετʔϧͰ͖ͳ͍ͷͰɺஔ͖͑Ͱ͖ͳ͍ • Pre-install applications can’t be replaced to manipulated apps because it’s not uninstallable. • ࠶ॺ໊ʹΑΓɺॺ໊͕มߋ͞Εͯ͠·͏ɻ • Original signature would be changed by re-sign. ݱঢ়ͷAndroidΞϓϦվ͟Μख๏ͷ՝ Problems for the present common manipulation technic 12 Preinstalled Android Application Poisoning Prologue
web at least. • rootԽඞਢʂʂͰϋοΧʔʹԿͷͳ͍ɺΑͶʁ • root must be needed!! But it doesn’t matter for hackers, don’t it? • Android্ͷ࣮ߦόΠφϦͷΩϟογϡʢ.odexʣΛվ͟Μ͢Δख๏ • The technic it to manipulate cached binary(.odex) on Android directly. 14 Preinstalled Android Application Poisoning Practice
of a classes.dex file that has optimizations that are device specific. http://code.google.com/p/smali/wiki/DeodexInstructions 15 Preinstalled Android Application Poisoning Practice dex install odex odex odex
system applications including preinstalled applications exist both, user application exit latter • ࠓճͷλʔήοτޙऀ / In this presentation, The target is latter place. 16 Preinstalled Android Application Poisoning Practice
format is a bit different to dex format, and It might be not documented. (Does anybody know it ?) 17 Preinstalled Android Application Poisoning Practice
- dexdump only. • dexdumpAndroid SDKʹؚ·ΕΔπʔϧ • dexdump is included in Android SDK. • objdumpΈ͍ͨͳπʔϧ • it’s like a objdump. 18 Practice Preinstalled Android Application Poisoning
header.(usage unknown, Adler-32) ! ! ! ! • dexdump͕νΣοΫαϜΛ࠶ܭࢉͯ͘͠ΕΔͷͰɺͦͷΛ্ॻ͖͢ΕOK • dexdump can calculate checksum after manipulation, it should be OK to overwrite it. 22 Preinstalled Android Application Poisoning Practice
dialog and exit immediately. • վ͟Μͯ͠ɺϙοϓΞοϓ͕දࣔ͞Εͳ͍(ऴྃ͠ͳ͍)Α͏ʹ͢Δɻ • Avoid popup and exit by manipulation. 23 Preinstalled Android Application Poisoning Practice
is not changed. • dalvik-cache্ͷodexϑΝΠϧΛআ͢Δ͜ͱͰɺ؆ ୯ʹݩͷঢ়ଶʹͤΔɻʢodex͕࠶ੜ͞ΕΔʣ • Easily rollback by deleting odex file on dalvik- cache.(odex would be re-generate) 25 Preinstalled Android Application Poisoning Practice
a dynamic analysis of application, Log output would be effective. • ΞϓϦέʔγϣϯʹσόοά༻ͷϩάΫϥε͕͍ͬͯΔ͜ͱ͕ଟ͍ɻ • Logging functionality would be exist in a lot of released application. • ͦΕΛѱ༻͢Δɻ • Then, abuse it. 28 Preinstalled Android Application Poisoning Use case
• exception۟ͷதͷLogؔΛͬͯɺσʔλʢ͜ͷ߹ɺύεϫʔυͱIDʣΛϩ άग़ྗͰ͖ͳ͍ͩΖ͏͔ʁ • Can we output datas(in this case, ID and Password) using Log function in exception? - exception࣌ͷॲཧΛਖ਼ৗܥͰͤͯ͞ - The process for exception would be done in normal case, - LogؔͷҾʹσʔλΛͯ͠Ε - Then, Give datas to arguments for Log function, ! • Ͱ͖Δ͔ʁɹCan we do this?
applications have URL strings which would be used for Web API. • URLͷจࣈྻΛվ͟Μ͠ɺຊདྷͱҟͳΔαʔόʹଓͤ͞Δ͜ͱͰ MITM(Man In The Middle)߈ܸΛཱͤ͞Δɻ • MITM(Man In The Middle) attack would be executed by be connected manipulated URL. 45 Preinstalled Android Application Poisoning Use case for attack Pre-installed application poisoning concept
in dex/odex, Then if sort would be corrupted, It would be error. ! ! • ͞ΒʹؔͰจࣈྻΛ༻͢Δࡍɺྻ൪߸Λࢦఆ͍ͯ͠ΔͨΊɺॻ͖͑ޙ࠶ ιʔτͯ͠͠·͏ͱશମͷมߋ͕ඞཁͱͳΔɻ • And also, A string is specified by sort number when function use it, so Re- sort after manipulation would not be a realistic approach 47 Preinstalled Android Application Poisoning Use case for attack Notice: Strings manipulation
“Strings poisoner”. • վ͟Μʹύιίϯ͕ඞཁͳ͍ɻ • No need pc poisoning. • ΠϧεΞϓϦͷಈ͖Λఆ͍ͯ͠·͢ɻ • Assuming Virus attraction. 48 Use case for attack Preinstalled Android Application Poisoning Demonstration
be uninstalled. • unrootͯ͠ଓ͘ • still under attack if Android devices would be unrooted • ϓϦΠϯετʔϧΞϓϦम෮Ͱ͖ͳ͍ɻग़ՙ࣌ʹ͞ͳ͍ͱɻ • Pre-install application can not be fixed because it’s not uninstallable. 50 Preinstalled Android Application Poisoning Use case for attack Pre-installed application poisoning point
– ͍ํʹΑͬͯղੳ߈ܸʹ͑ΔϋοΧʔͷख๏ /Hacker’s technic for analysis(white hacker) or attack(black hacker). ๏cons – େ͖ͳվ͟Μ͔ͳ͍ / not suitable for big manipulation. – odexσόΠε͝ͱʹҟͳΔͷͰɺվ͟ΜՕॴํ๏͕ҟͳΔɻ/ odex is device specific file. manipulation target and method would be changed each odex file. 52 Preinstalled Android Application Poisoning Conclusion
owaspjapan
427marketing
codingconduct
cromwellryan
techseoconnect
palkan
addyosmani
orderedlist
inesmontani
gurzu
chriscoyier
michielstock
![Thank you!! Question? [email protected] [email protected] 53 Preinstalled Android Application Poisoning](https://files.speakerdeck.com/presentations/3a8d5180921d01313ec11a12803d7217/slide_52.jpg){kind=link}