Bypassing Mobile Protections

Slide 1

Slide 1 text

Comunidade de mulheres em Cybersecurity 1

Slide 2

Slide 2 text

Bypassing Mobile Protections DAIANE SANTOS

Slide 3

Slide 3 text

Disclaimer: The content presented here is my responsibility and has nothing to do with the opinions of my employer.

Slide 4

Slide 4 text

Disclaimer 2: The content presented here is only created for educational purposes.

Slide 5

Slide 5 text

02 01 whoami mobile timeline 03 owasp mobile top 10 04 protections 05 bypasses 06 contact what we have for today Agenda

Slide 6

Slide 6 text

Daiane Santos Mobile Security Engineer @ Nubank CTF Player and Captain @ RATF Autist AH/SD Enthusiast of Neuroscience I like chess whoami

Slide 7

Slide 7 text

1987 Calls Mobira Cityman 900 First GSM (2G) phone Calls SMS 1992 1996 Vibrate Mode GSM SMS Calls 2000 FM Radio Opera mini web browser Camera Voice Recorder Vibrate Mode GSM (3G) SMS Calls 2007 First iPhone Apps A lot of new features Timeline Nokia 2110 Motorola StarTAC Nokia 3310 iPhone 2G

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

Reverse Engineering

Slide 11

Slide 11 text

Change .apk for .zip And you're be able to see all the folders, AndroidManifest, etc. easy "hack"

Slide 12

Slide 12 text

API calls or endpoints understanding the way some security controls are implemented root detection -> SuperUser hardcoded sensitive information inside the code backdoor accounts, API keys and secrets, passwords... interesting strings points of encryption and obfuscation so we can decrypt and de-obfuscate What we are looking for?

Slide 13

Slide 13 text

Activities: Broadcast receivers: Services: Components that provide a screen with which users can interact. Components that receive and respond to broadcast messages from other apps or from the operating system. Components that perform operations in the background. What we are looking for?

Slide 14

Slide 14 text

AndroidManifest.xml

Slide 15

Slide 15 text

MobSF

Slide 16

Slide 16 text

Frida.re

Slide 17

Slide 17 text

What we can do?

Slide 18

Slide 18 text

Magisk

Slide 19

Slide 19 text

MagiskSU: Magisk Modules: MagiskBoot: Zygisk: Provide root access for applications Modify read-only partitions by installing modules The most complete tool for unpacking and repacking Android boot images Run code in every Android applications' processes What we can do?