The Phantom Menace - How can one mobile App rot everything?

Alexey Troshichev
@hackappcom

Transcript

1. The Phantom Menace How can one mobile App rot everything?
2. Who am I? - Work hard on defense - Have fun in offense - Break things 1 Alexey Troshichev @hackappcom
3. What may be wrong with an App? - Insecure transfer - Injections - Insecure storage - Architecture flaws 2 OWASP mobile for details
4. Common Attacks 3
5. App is dangerous for users. What’s about vendors? Why should we waste time attacking one user, when we can just break into backend to get them all? 4
6. What can an App tell us? - Environment disclosure - Common authentication data - Built-in accounts - Anything you can’t even imagine =) 5
7. Why it’s interesting? - Static analysis - We are just searching strings…and it could be automated =) 6
8. AWK, STRINGS, GREP? - Not suitable for binary containers - Too much garbage 7
9. App in our dreams 8
10. App in the real world 9
11. Steps - Containers recursive traversal - Unusual files search - Selective GREP - Structure validation (sqlite, binXML,plist, etc..) 10
12. Let’s take 21268 top apps from Google Play… …and scan it ! 11
13. Shared cloud storage credentials 12
14. Environment disclosure 13
15. Backend sources 8( 14
16. Free Scanner 15 https://hackapp.com/scanner
17. Questions Alexey Troshichev @hackappcom 16