Tweet
Tweet

Slide 1

Slide 1 text

Bypassing .APK Protections DAIANE SANTOS

Slide 2

Slide 2 text

Disclaimer: The content presented here is from my responsibility and has nothing to do with the opinions of my employer.

Slide 3

Slide 3 text

Disclaimer 2: The content presented here is only created for educational purposes.

Slide 4

Slide 4 text

It's okay not to know all the answers. It's better to admit our ignorance than to believe answers that might be wrong. Pretending to know everything, closes the door to finding out what's really there. Neil deGrasse Tyson

Slide 5

Slide 5 text

02 01 whoami mobile timeline 03 owasp mobile top 10 04 protections 05 bypasses 06 contact what we have for today Agenda

Slide 6

Slide 6 text

Daiane Santos Mobile Security Engineer @ Nubank CTF Player and Captain @ RATF Autist AH/SD Enthusiast of Neuroscience I like chess whoami

Slide 7

Slide 7 text

1987 Calls Mobira Cityman 900 First GSM (2G) phone Calls SMS 1992 1996 Vibrate Mode GSM SMS Calls 2000 FM Radio Opera mini web browser Camera Voice Recorder Vibrate Mode GSM (3G) SMS Calls 2007 First iPhone Apps A lot of new features Timeline Nokia 2110 Motorola StarTAC Nokia 3310 iPhone 2G

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

Reverse Engineering

Slide 11

Slide 11 text

Change .apk for .zip And you're be able to see all the folders, AndroidManifest, etc. easy "hack"

Slide 12

Slide 12 text

AndroidManifest.xml

Slide 13

Slide 13 text

API calls or endpoints understanding the way some security controls are implemented root detection -> SuperUser hardcoded sensitive information inside the code backdoor accounts, API keys and secrets, passwords... interesting strings points of encryption and obfuscation so we can decrypt and de-obfuscate What we are looking for?

Slide 14

Slide 14 text

shhgit Find secrets and sensitive files across GitHub (including Gists), GitLab and BitBucket.

Slide 15

Slide 15 text

Activities: Broadcast receivers: Services: Components that provide a screen with which users can interact. Components that receive and respond to broadcast messages from other apps or from the operating system. Components that perform operations in the background. What we are looking for?

Slide 16

Slide 16 text

attacks on activities If an application has an activity that is exported, other applications can also invoke it. This can be invoked by other malicious applications that are running on the device.

Slide 17

Slide 17 text

attacks on broadcast receivers That means any application will be able to send arbitrary, uncontrolled SMSs.

Slide 18

Slide 18 text

MobSF

Slide 19

Slide 19 text

Tempering Smali We can see there is a “if” condition is the decision maker element that decides whether the application is rooted or a Non-rooted device.

Slide 20

Slide 20 text

Tempering Smali

Slide 21

Slide 21 text

SSL Pinning and Proxy

Slide 22

Slide 22 text

Frida

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

$ frida --codeshare akabe1/frida-multiple-unpinning -f YOUR_BINARY frida-unpinning

Slide 25

Slide 25 text

anti-frida-bypass $ frida --codeshare enovella/anti-frida-bypass -f YOUR_BINARY

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

Root

Slide 28

Slide 28 text

Magisk

Slide 29

Slide 29 text

MagiskSU: Magisk Modules: MagiskBoot: Zygisk: Provide root access for applications Modify read-only partitions by installing modules The most complete tool for unpacking and repacking Android boot images Run code in every Android applications' processes What we can do?

Slide 30

Slide 30 text

What we can do?

Slide 31

Slide 31 text

Contact me: @Wh0isdxk Questions