Upgrade to Pro — share decks privately, control downloads, hide ads and more …

The secret life of Android apps

Artur Hil
November 24, 2021

The secret life of Android apps

Artur Hil

November 24, 2021

More Decks by Artur Hil

Other Decks in Programming


  1. @s1LentHil Security Engineer CISSP, Breaking the apps to make them

    more secure, Security engineering and architecture We make software to get data security right
  2. What we will talk about • How to setup the

    testing environment • What tools do you need • How to tune those tools • Examples of proper security controls in apps @ s1LentHil
  3. We will not cover • How to root the Android

    Phone • How to bypass the Root detection • How to bypass the TLS pinning • How to reverse engineer the Android apps • How to make money on apps vulnerabilities • How to break the TikTok app to make you account popular @ s1LentHil
  4. You will need 1. macOS or Windows or Linux, but

    we will cover only macOS 2. Burp Suite community or Pro 3. Android studio or Real device, but we will cover only emulator 4. Some app you want to test @ s1LentHil
  5. Create the AVD with console avdmanager create avd -n Pixel_27

    -d 19 -k 'system-images;android-26;google_apis;x86_64' AVD name Device id (Pixel) Package path of the system image @ s1LentHil
  6. ROOT CA to AVD Easy way: Android < v 7.0

    https://portswigger.net/support/installing-burp-suites-ca-certificate-in-an-android-device cacert.der >> cacert.cer @ s1LentHil
  7. ROOT CA to AVD openssl x509 -inform DER -in cacert.der

    -out cacert.pem openssl x509 -inform PEM -subject_hash_old -in cacert.pem |head -1 9a5ba575 mv cacert.pem 9a5ba575.0 @ s1LentHil
  8. ROOT CA to AVD adb root restarting adbd as root

    adb remount remount succeeded adb push 9a5ba575.0 /sdcard/ 9a5ba575.0: 1 file pushed, 0 skipped. 1.4 MB/s (1326 bytes in 0.01s) @ s1LentHil
  9. ROOT CA to AVD adb shell generic_x86_64:/ # generic_x86_64:/ #

    mv /sdcard/9a5ba575.0 /system/etc/security/cacerts/ generic_x86_64:/ # chmod 644 /system/etc/security/cacerts/9a5ba575.0 generic_x86_64:/ # reboot @ s1LentHil
  10. @ s1LentHil adb shell pm list packages package:com.example.someapp adb shell

    pm path com.example.someapp package:/data/app/someapp/base.apk adb pull /data/app/someapp/base.apk path/to/desired/destination
  11. Comprehensive manual for mobile app security testing and reverse engineering

    for iOS and Android mobile security testers https://github.com/OWASP/owasp-mstg @ s1LentHil Mobile Security Testing Guide (MSTG)
  12. TLS pining @ s1LentHil MASVS 5.4 The app either uses

    its own certificate store, or pins the endpoint certificate or public key, and subsequently does not establish connections with endpoints that offer a different certificate or key, even if signed by a trusted CA.
  13. Root detection @ s1LentHil MASVS 8.1 The app detects, and

    responds to, the presence of a rooted or jailbroken device either by alerting the user or terminating the app.
  14. @ s1LentHil Developers are building great apps but often they

    don’t pay attention to security. Security people are breaking those apps but often they just break them. Security of the app is endless process.