$30 off During Our Annual Pro Sale. View Details »

The secret life of Android apps

Artur Hil
November 24, 2021

The secret life of Android apps

Artur Hil

November 24, 2021
Tweet

More Decks by Artur Hil

Other Decks in Programming

Transcript

  1. The secret life of Android
    apps
    Artur Hil

    View Slide

  2. @s1LentHil
    Security Engineer
    CISSP,
    Breaking the apps to make them more secure,
    Security engineering and architecture
    We make software
    to get data security right

    View Slide

  3. @
    s1LentHil

    View Slide

  4. What we will talk about
    ● How to setup the testing environment
    ● What tools do you need
    ● How to tune those tools
    ● Examples of proper security controls in apps
    @
    s1LentHil

    View Slide

  5. We will not cover
    ● How to root the Android Phone
    ● How to bypass the Root detection
    ● How to bypass the TLS pinning
    ● How to reverse engineer the Android apps
    ● How to make money on apps vulnerabilities
    ● How to break the TikTok app to make you account popular
    @
    s1LentHil

    View Slide

  6. You will need
    1. macOS or Windows or Linux, but we will cover only macOS
    2. Burp Suite community or Pro
    3. Android studio or Real device, but we will cover only emulator
    4. Some app you want to test
    @
    s1LentHil

    View Slide

  7. Environment variables
    nano ~/.zshrc
    @
    s1LentHil

    View Slide

  8. Create the AVD with AVD manager
    Android Studio > Tools > AVD manager
    @
    s1LentHil

    View Slide

  9. Create the AVD with AVD manager
    @
    s1LentHil

    View Slide

  10. It is your choice to trust
    @
    s1LentHil

    View Slide

  11. Create the AVD with AVD manager
    @
    s1LentHil

    View Slide

  12. Create the AVD with AVD manager
    @
    s1LentHil

    View Slide

  13. Create the AVD with AVD manager
    @
    s1LentHil

    View Slide

  14. Create the AVD with console
    sdkmanager --install "system-images;android-26;google_apis;x86_64"
    sdkmanager --list
    @
    s1LentHil

    View Slide

  15. Create the AVD with console
    avdmanager create avd -n Pixel_27 -d 19 -k 'system-images;android-26;google_apis;x86_64'
    AVD name Device id (Pixel) Package path of the system image
    @
    s1LentHil

    View Slide

  16. @
    s1LentHil

    View Slide

  17. Running through the Burp Suite
    @
    s1LentHil

    View Slide

  18. Running through the Burp Suite
    @
    s1LentHil

    View Slide

  19. GET the ROOT CA
    @
    s1LentHil

    View Slide

  20. ROOT CA to AVD
    Easy way:
    Android < v 7.0
    https://portswigger.net/support/installing-burp-suites-ca-certificate-in-an-android-device
    cacert.der >> cacert.cer
    @
    s1LentHil

    View Slide

  21. ROOT CA to AVD
    emulator -list-avds
    Pixel_27
    emulator @Pixel_27 -writable-system
    @
    s1LentHil

    View Slide

  22. ROOT CA to AVD
    openssl x509 -inform DER -in cacert.der -out cacert.pem
    openssl x509 -inform PEM -subject_hash_old -in cacert.pem |head -1
    9a5ba575
    mv cacert.pem 9a5ba575.0
    @
    s1LentHil

    View Slide

  23. ROOT CA to AVD
    adb root
    restarting adbd as root
    adb remount
    remount succeeded
    adb push 9a5ba575.0 /sdcard/
    9a5ba575.0: 1 file pushed, 0 skipped. 1.4 MB/s (1326 bytes in 0.01s)
    @
    s1LentHil

    View Slide

  24. ROOT CA to AVD
    adb shell
    generic_x86_64:/ #
    generic_x86_64:/ # mv /sdcard/9a5ba575.0 /system/etc/security/cacerts/
    generic_x86_64:/ # chmod 644 /system/etc/security/cacerts/9a5ba575.0
    generic_x86_64:/ # reboot
    @
    s1LentHil

    View Slide

  25. @
    s1LentHil

    View Slide

  26. @
    s1LentHil

    View Slide

  27. @
    s1LentHil
    adb shell pm list packages
    package:com.example.someapp
    adb shell pm path com.example.someapp
    package:/data/app/someapp/base.apk
    adb pull /data/app/someapp/base.apk path/to/desired/destination

    View Slide

  28. @
    s1LentHil
    adb install base.apk
    Performing Streamed Install
    Success

    View Slide

  29. Establishes baseline security requirements for mobile apps
    https://github.com/OWASP/owasp-masvs
    @
    s1LentHil
    Mobile Application Security Verification
    Standard (MASVS)

    View Slide

  30. Comprehensive manual for mobile app security testing and reverse
    engineering for iOS and Android mobile security testers
    https://github.com/OWASP/owasp-mstg
    @
    s1LentHil
    Mobile Security Testing Guide (MSTG)

    View Slide

  31. https://owasp.org/www-project-mobile-top-10/
    @
    s1LentHil

    View Slide

  32. TLS pining
    @
    s1LentHil
    MASVS 5.4
    The app either uses its own certificate store, or pins the endpoint
    certificate or public key, and subsequently does not establish
    connections with endpoints that offer a different certificate or key, even
    if signed by a trusted CA.

    View Slide

  33. Root detection
    @
    s1LentHil
    MASVS 8.1
    The app detects, and responds to, the presence of a
    rooted or jailbroken device either by alerting the user or
    terminating the app.

    View Slide

  34. @
    s1LentHil
    Developers are building great apps but often they don’t pay attention to security.
    Security people are breaking those apps but often they just break them.
    Security of the app is endless process.

    View Slide

  35. @
    s1LentHil
    https://book.hacktricks.xyz/mobile-apps-pentesting/android-app-pentesting
    https://gist.github.com/mrk-han/66ac1a724456cadf1c93f4218c6060ae
    https://speakerdeck.com/julep/common-ios-vulnerabilities-and-how-to-fix-them
    https://www.cossacklabs.com/blog/react-native-app-security/
    Read more about mobile app security

    View Slide

  36. @s1LentHil
    https://speakerdeck.com/
    s1lenthil
    We help companies to
    protect their sensitive
    and valuable data.

    View Slide