Android security (for developers) at jDays 2015

Slide 1

Slide 1 text

Android security FOR DEVELOPERS FILIP MAELBRANCKE

Slide 2

Slide 2 text

Your host Filip Maelbrancke Consultant @ AppFoundry ﬁlip.maelbrancke@appfoundry.be @fmaelbrancke

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

Slide 5

Slide 5 text

Security = managing risk ASSET VULNERABILITY THREAT

Slide 6

Slide 6 text

Security = managing risk ASSET VULNERABILITY THREAT

Slide 7

Slide 7 text

All in one device Increases threat proBability • GPS • Contacts • Camera • Email (work) • Wallet

Slide 8

Slide 8 text

Always out Vulnerability / Exploitability • Stolen • Forgotten • Lost

Slide 9

Slide 9 text

Everyone uses it Vulnerability / Exploitability • Weak pins • Use of open public WiFi

Slide 10

Slide 10 text

Android security MODEL Game X Game Y System Contacts Email Google Play Verify app signature App sandbox Permissions application isolation

Slide 11

Slide 11 text

typical mobile app MOBILE APPLICATION UI LOCAL STORAGE REMOTING LAYER REMOTE API COMMUNICATION CHANNEL

Slide 12

Slide 12 text

Security APP HARDENING DATA NETWORK SERVICES

Slide 13

Slide 13 text

No content

Slide 14

Slide 14 text

Securing the app JAVA CLASS DEX

Slide 15

Slide 15 text

reverse engineer

Slide 16

Slide 16 text

obtain apk adb backup -apk be.myapp ADB backup app Titanium, Astro, Helium, … adb shell pm list packages -f adb pull /data/app/be.myapp-1.apk

Slide 17

Slide 17 text

apk structure apk = zip APK AndroidManifest classes.dex Resources

Slide 18

Slide 18 text

reverse engineer TOOLS • Apktool • Dex2jar • JADX

Slide 19

Slide 19 text

Reverse engineer smali / baksmali apktool low level disassembled Dex bytecode code code can be modiﬁed recompile / resign

Slide 20

Slide 20 text

Reverse engineer apktool d myapp.apk

Slide 21

Slide 21 text

Reverse engineer

Slide 22

Slide 22 text

Reverse engineer

Slide 23

Slide 23 text

Reverse engineer convert .dex ﬁle to a .jar with java bytecode DEX2JAR dex -> java java decompiler code very readable

Slide 24

Slide 24 text

Reverse engineer

Slide 25

Slide 25 text

Reverse engineer command-line / GUI tools JADX

Slide 26

Slide 26 text

Reverse engineer Jeb Decompiler PAID dex -> java native dex decompiler

Slide 27

Slide 27 text

reverse engineer

Slide 28

Slide 28 text

Obfuscation

Slide 29

Slide 29 text

Proguard obfuscate optimize Shrink

Slide 30

Slide 30 text

proguard obfuscation

Slide 31

Slide 31 text

proguard

Slide 32

Slide 32 text

proguard configuration

Slide 33

Slide 33 text

other techniques If possible, run code at server! server String encryption Hide sensitive strings eg “Secure” Native code Java Native Interface reflection Proxy Introduces indirection Class encryption Use DexGuard

Slide 34

Slide 34 text

dexguard Same conﬁg proguard++ Commercial Good value for the money Tamper checks

Slide 35

Slide 35 text

dexguard

Slide 36

Slide 36 text

proguard tips Test! release build Mapping.txt Save! Crash? Supported on Crashlytics, Crittercism, ...

Slide 37

Slide 37 text

TAMPER DETECTION

Slide 38

Slide 38 text

Environment 1.installer 2.debugger / emulator 3.BINARY Validation Tamper detection / protection

Slide 39

Slide 39 text

INSTALLER PLAY STORE INSTALLER

Slide 40

Slide 40 text

debugger Debugger check

Slide 41

Slide 41 text

debugger Debugger check

Slide 42

Slide 42 text

emulator EMULATOR check

Slide 43

Slide 43 text

SIGNING KEY Valid signing key • SHA1 of signing cert • Embed • Check with runtime signature

Slide 44

Slide 44 text

SIGNING KEY Valid signing key

Slide 45

Slide 45 text

rooted device root detection • Check typical apps / ﬁles • Check keys • /system r/w

Slide 46

Slide 46 text

No content

Slide 47

Slide 47 text

Data protection laws that govern data protection Law obligation beyond legal obligations ➪ moral obligation

Slide 48

Slide 48 text

local Data protection Avoid it if you can Avoid External storage Avoid external storage for sensitive information For critical info set android:saveEnabled="false" Backup set android:allowBackup=false proper permissions MODE_PRIVATE with ﬁles

Slide 49

Slide 49 text

local Data protection getWindow().setFlags(LayoutParams.FLAG_SECURE, LayoutParams.FLAG_SECURE); avoid screen shots LOGOUT on inactivity if usability allows and clear the cached information

Slide 50

Slide 50 text

keylogger

Slide 51

Slide 51 text

Android not enough? rooted devices internal storage full disk crypto brute forcing

Slide 52

Slide 52 text

CRYPTO

Slide 53

Slide 53 text

crypto in Android = JCA APP JCA (Java Cryptography Architecture) Provider Provider Message Digest Key Generation Digital Signature ...

Slide 54

Slide 54 text

JCA Bouncy Castle Android OpenSSL APP JCA (Java Cryptography Architecture) Harmony

Slide 55

Slide 55 text

bouncy castle Android = subset of upstream release cut-down CONSISTENT Consistent crypto across Android versions MINIMAL change github.com/rtyley/spongycastle Spongy castle Repackage of Bouncy Castle for Android

Slide 56

Slide 56 text

GPS dynamic Security provider Since Google Play Services 5 google play services replacement for the platform’s bundled provider security patches rapid delivery frequently updated by Google

Slide 57

Slide 57 text

dynamic security provider setup dependencies { compile 'com.google.android.gms:play-services:6.1.+' }

Slide 58

Slide 58 text

dynamic security provider setup

Slide 59

Slide 59 text

Android security providers

Slide 60

Slide 60 text

Conscrypt

Slide 61

Slide 61 text

encryption libs SQLCipher sqlcipher.net • Modiﬁed version of SQLite • AES-256 encryption • Drop-in replacement iocipher guardianproject.info/code/iocipher Virtual encrypted disk

Slide 62

Slide 62 text

key management Store along with the data (ﬁle private to the app) Store Embed Embed in source code (obfuscated ?) EASY TO EXTRACT

Slide 63

Slide 63 text

key management don’t store Don’t store the key on the device Have it entered each time necessary Store In systems service SOLUTIONS

Slide 64

Slide 64 text

key derivation Long random strings of bits encryption keys people vs keys Users are familiar with passwords Crypto algo PBKDF2WithHmacSHA1 password based encryption Generate strong crypto keys based on humanly-manageable passwords

Slide 65

Slide 65 text

proper key derivation Using a salt protects from table- assisted / pre-computed dictionary attacks SALT key stretching Repeat the key derivation operation multiple times to produce the ﬁnal key Slows down brute force attacks

Slide 66

Slide 66 text

key derivation https://github.com/nelenkov/android-pbe http://nelenkov.blogspot.jp/2012/04/using-password-based-encryption-on.html Nikolay Elenkov

Slide 67

Slide 67 text

KEYCHain? Keystore provider • Since Android 4.3 • Can be hardware-backed

Slide 68

Slide 68 text

Android keystore available from Android 4.3 java security provider APP can generate & save private keys keys private to each app

Slide 69

Slide 69 text

keystore

Slide 70

Slide 70 text

keystore

Slide 71

Slide 71 text

network

Slide 72

Slide 72 text

Secure communication channel use https Use SSL / TLS • Confidentiality • Authentication VALIDATION Hostname verification Certificate pinning http://android-ssl.org/

Slide 73

Slide 73 text

secure communication channel hostname verification

Slide 74

Slide 74 text

SSL certificates CA issued, Android recognized CA issued behaviour change custom TrustManager self-signed certificates

Slide 75

Slide 75 text

certificate authorities

Slide 76

Slide 76 text

certificate authorities https://bluebox.com/blog/technical/questioning-the-chain-of-trust-investigations-into- the-root-certiﬁcates-on-mobile-devices

Slide 77

Slide 77 text

Trustmanager StrongTrustManager • Validate whole certiﬁcate chain • Debian certiﬁcate store

Slide 78

Slide 78 text

self signed cert

Slide 79

Slide 79 text

anti-pattern don’t trust all!

Slide 80

Slide 80 text

Self-signed cert import in your app certificate custom trustmanager no man-in-the-middle attacks

Slide 81

Slide 81 text

certificate pinning with expected certiﬁcate / public key Associate host hashing anonymize certiﬁcate / public key

Slide 82

Slide 82 text

certificate pinning echo | openssl s_client -connect host:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > mycertiﬁcate.pem get certificate (openssl) embed in application /res/raw Custom trustmanager Based on keystore Load into keystore SSL context Init SSL context with TrustManager https://developer.android.com/training/articles/security-ssl.html

Slide 83

Slide 83 text

NOGOTOFAIL Test tool man in the middle server attempts to inject attacks into connections checks https://github.com/google/nogotofail

Slide 84

Slide 84 text

No content

Slide 85

Slide 85 text

Securing services Controls • Kill switch for speciﬁc functionality • Server downtime communication • Mandatory update mechanism

Slide 86

Slide 86 text

securing services Backend REST and APIs can have similar vulnerabilities to web applications mitigate follow OWASP top 10

Slide 87

Slide 87 text

No content

Slide 88

Slide 88 text

Effective security Using CryptoLint, we performed a study on cryptographic implementations in 11,748 Android applications. Overall we ﬁnd that 10,327 programs – 88% in total – use cryptography inappropriately. The raw scale of misuse indicates a widespread misunderstanding of how to properly use cryptography in Android development. “ ”

Slide 89

Slide 89 text

effective security hardcoded passphrases manually seeded SecureRandom insufﬁcient key generation iterations hardcoded salts non-random initialization vectors

Slide 90

Slide 90 text

security testing Static analysis Manual code review design review Analysis Static Dynamic Penetration testing

Slide 91

Slide 91 text

suggested reading Android Security Cookbook  Keith Makan / Scott Alexander-Bown (9781782167167) Android Security Internals   Nikolay Elenkov (9781593275815) Android Hacker’s Handbook  Joshua J. Drake et al. (9781118608647) Application Security for the Android platform  Jeff Six (9781449315078)  

Slide 92

Slide 92 text

suggested reading developer.android.com  https://developer.android.com/training/articles/security-tips.html   https://source.android.com/devices/tech/security/ OWASP  https://www.owasp.org/index.php/OWASP_Mobile_Security_Project Google+ community   Android security discussions Blogs  http://nelenkov.blogspot.com.tr/… 

Slide 93

Slide 93 text

Questions? Filip Maelbrancke Consultant @ AppFoundry ﬁlip.maelbrancke@appfoundry.be @fmaelbrancke