Mobile security chess board - attacks & defense
- 1. Mobile  Security  chess  board  -Ââ  A4acks  &  Defense Â
- 2. Who Am I? âąâŻ Hemil  Shah  â  hemil@blueinfy.net  âąâŻ Co-ÂâCEO  &  Director,  Blueinfy  Solu>ons  âąâŻ Past  experience   â⯠eSphere  Security,  HBO,  KPMG,  IL&FS,  Net  Square  âąâŻ Interest  â⯠ApplicaIon  security  research  âąâŻ Published  research  â⯠ArIcles  /  Papers  â  Packstroem,  etc.  â⯠Web  Tools  â  wsScanner,  scanweb2.0,  AppMap,  AppCodeScan,  AppPrint  etc.  â⯠Mobile  Tools  â  FSDroid,  iAppliScan,  DumpDroid  hemil@blueinfy.com  h4p://www.blueinfy.com  Blog  â  h4p://blog.blueinfy.com/ Â
- 3. About âąâŻGlobal  experience  worked  clients  based  in  USA,  UAE,  Europe  and  Asia-Ââpac.  âąâŻClients/Partners  include  Fortune  100  companies.  âąâŻDelivery  model  and  support  âąâŻBlackbox  and  Whitebox  â  Scanners  and  Code  Analyzers  âąâŻScanning  tools  and  technology  (15  years)  âąâŻStrong  and  tested  with  Fortune  clients  âąâŻIntegrated  in  SDLC  âąâŻHelp  client  in  miIgaIng  or  lowering  down  the  Risk  by  improving  process  âąâŻIn  house  R&D  team  for  last  7  years  âąâŻPapers  and  PresentaIons  at  conference  like  RSA,  Blackhat,  HITB,  OWASP  etc.  âąâŻBooks  wri4en  and  used  as  security  guides  Know-ÂâHow  Methods  &  Approach  Global  Delivery  &  Team  Technology  ĂïâŻBBC  ĂïâŻDark  Readings  ĂïâŻBank  Technology  ĂïâŻSecurityWeek  ĂïâŻMIT  Technology  Review  ApplicaIon  Security  Â
- 6. Mobile  Top  10  -Ââ  OWASP  âąâŻ Weak  Server  Side  Controls  âąâŻ Insecure  Data  Storage  âąâŻ InsuïŹcient  Transport  Layer  ProtecIon  âąâŻ Unintended  Data  Leakage  âąâŻ Poor  AuthorizaIon  and  AuthenIcaIon  âąâŻ Broken  Cryptography  âąâŻ Client  Side  InjecIon  âąâŻ Security  Decisions  Via  Untrusted  Inputs  âąâŻ Improper  Session  Handling  âąâŻ Lack  of  Binary  ProtecIons   Contributor : Nvisium Security, HP Fortify, Andreas Athanasoulias & Syntax IT, eSphere Security, Godfrey Nolan and RIIS (Research Into Internet Systems), Arxan Technologies Ref - https://www.owasp.org/index.php/Mobile_Top_Contributions
- 8. E-Ââcommerce  âąâŻ Typical  applicaIon  making  server  side  calls  âąâŻ Security  issues  and  hacks  â⯠Credit  card  and  Private  data  storage  with  poor  crypto  â⯠SQLite  hacks  â⯠SQL  injecIon  over  JSON  â⯠Ajax  driven  XSS  â⯠Several  XSS  with  Blog  component  â⯠Several  informaIon  leaks  through  JSON  fuzzing  âąâŻ Server  side  scan  with  tools/products  failed  Â
- 9. Banking  ApplicaIon  âąâŻ Scanning  applicaIon  for  vulnerabiliIes  âąâŻ Typical  banking  running  with  middleware   âąâŻ VulnerabiliIes  â  Mobile  interface  â⯠Poor  encoding  to  store  SSN  and  PII  informa>on  locally  â⯠Very  sensi>ve  transac>on  informa>on  stored  locally  â⯠Default  OS  Behavior  leaking  informa>on  â⯠CredenIals  submi4ed  in  GET  request  â⯠Keys/session  stored  in  keychain  ïŹle Â
- 10. Social  ApplicaIon  âąâŻ Social  ApplicaIon  on  mulIple  plagorms  â⯠ApplicaIon  leverages  browser  component  as  part  of  the  mobile  â⯠Common  code  base  for  all  plagorms  â⯠Vulnerable   âąâŻBypass  ProïŹle  validaIon  (Logical)  and  unique  device  installaIon   âąâŻScreenshot  revealing  sensi>ve  informa>on   âąâŻDefault  OS  Behavior  leaking  informa>on  âąâŻPresentaIon  layer  (XSS  and  CSRF)  âąâŻUnencrypted  Communica>on  channel Â
- 11. Postmortem  âąâŻ One  pa4ern  in  all  the  reviews  -Ââ  SOME  INFORMATION  WAS  STORED  LOCALLY  âąâŻ More  than  99%  of  the  applicaIon  review  has  the  LOCAL  STORAGE  issue  as  we  saw  in  stats.  âąâŻ Server  side  and  logical  issues  are  sIll  hard  to  ïŹnd  but  have  biggest  impact.  Â
- 12. Mobile  Threats  and  Risk Â
- 13. A4acks  on  Mobile  âąâŻ No JailBreak Required âąâŻ Ease of attack - Airports/Public places
- 14. Why  should  I  worry?  âąâŻ We  have  MDM  in  place  âąâŻ We  do  not  allow  any  JailBreak  or  rooted  device  in  our  environment  with  MDM  âąâŻ We  have  strict  policy  enforced  and  all  our  devices  are  forced  to  have  password  lock  âąâŻ May  or  may  not  have  BYOD   âąâŻ OS  provides  encrypIon Â
- 15. Mobile  A4acks  âąâŻ So  What  a4acks  are  we  talking  about?   âąâŻ Privacy  becomes  important  along  with  the  Security  in  mobile  space  âąâŻ It  is  MOBILE  so  chances  of  loosing  device  or  someone  gemng  physical  access  to  it  is  MUCH  MUCH  higher  than  the  other  devices Â
- 16. ExploitaIon  âąâŻ Physical  Then  âąâŻ Temporary  physical  access  âąâŻ Malware  âąâŻ Malicious  ApplicaIons  âąâŻ Lack  of  standardize  security  review  process  âąâŻ JailBreak/Rooted  devices Â
- 17. What  can  be  done???  âąâŻ InformaIon  found  in  local  storage  with  default  OS  behavior  â   âąâŻ Changing  OS  behavior  -Ââ   âąâŻ Server  side  exploitaIon  â  âąâŻ XSS  in  Mobile  Hybrid  applicaIon  â  Â
- 18.     Technology  Trends Â
- 19. Mobile  Infrastructure  www mail intranet router DMZ Internet VPN Dial-up Other Office s Exchange firewall Database RAS
- 20. Mobile  App  Environment  Web Server Static pages only (HTML,HTM, etc.)Web Client Scripted Web Engine Dynamic pages (ASP,DHTML, PHP, CGI, etc.) ASP.NET on .Net Framework, J2EE App Server, Web Services, etc. Application Servers And Integrated Framework Internet DMZ Trusted W E B S E R V I C E S Mobile SOAP/JSON etc. DB X Internal/Corporate
- 21. Mobile  Architecture  Presentation Layer Business Layer Data Access Layer Authentication Communication etc. Runtime, Platform, Operating System Components Server side Components Client side Components (Browser) âąâŻHTML 5 âąâŻDOM âąâŻXHR âąâŻWebSocket âąâŻStorage âąâŻWebSQL âąâŻFlash âąâŻFlex âąâŻAMF âąâŻSilverlight âąâŻWCF âąâŻXAML âąâŻNET âąâŻStorage âąâŻJS âąâŻAndroid âąâŻiPhone/Pad âąâŻOther Mobile
- 22. Game  is  complex  â  Chess Â
- 23. Challenges Â
- 24. Challenges  âąâŻ DiïŹerent  code  base  âąâŻ Achieve  things  with  single  click  âąâŻ Vendor  review  process  -Ââ  Not  transparent  â  Can  we  rely  on  it???  âąâŻ Decrease  transacIon  Ime  âąâŻ CompeIIon   âąâŻ Rapid  business  requirement  results  in  high  frequency  of  updates Â
- 25. Frequency  of  updates  âąâŻ Very  High  compare  to  Web  ApplicaIons  âąâŻ Usually,  4-Ââ5  updates  in  a  year  for  web  applicaIons  or  even  less  at  Imes  âąâŻ Usually,  10-Ââ12  updates  in  mobile  applicaIons  or  even  more  in  some  cases  âąâŻ We  all  have  accepted  that  applicaIon  needs  to  be  reviewed  before  going  to  producIon  â  DID  WE??? Â
- 26. Frequency  of  Updates  Application Name  Number of Releases in iOS  Number of Releases in Android  Facebook  19  34  Twitter  22  25  Chase Bank  9  2  eBay  9  4  Amazon  10  3  Temple Run 2  12  10  FB Messenger  12  10  Whatsapp  4  154  skype  8  6 Â
- 27. Mobile  A4acks  âąâŻ So  What  a4acks  are  we  talking  about?   âąâŻ Privacy  becomes  important  along  with  the  Security  in  mobile  space  âąâŻ It  is  MOBILE  so  chances  of  loosing  device  or  someone  gemng  physical  access  to  it  is  MUCH  MUCH  higher  than  the  other  devices Â
- 28. Mobile  Top  10  -Ââ  OWASP  âąâŻ Weak  Server  Side  Controls  âąâŻ Insecure  Data  Storage  âąâŻ InsuïŹcient  Transport  Layer  ProtecIon  âąâŻ Unintended  Data  Leakage  âąâŻ Poor  AuthorizaIon  and  AuthenIcaIon  âąâŻ Broken  Cryptography  âąâŻ Client  Side  InjecIon  âąâŻ Security  Decisions  Via  Untrusted  Inputs  âąâŻ Improper  Session  Handling  âąâŻ Lack  of  Binary  ProtecIons   Contributor : Nvisium Security, HP Fortify, Andreas Athanasoulias & Syntax IT, eSphere Security, Godfrey Nolan and RIIS (Research Into Internet Systems), Arxan Technologies Ref - https://www.owasp.org/index.php/Mobile_Top_Contributions
- 29. Top  5  vulnerability  âąâŻ From  the  stats  of  eSphere  data  -Ââ   0 10 20 30 40 50 60 70 80 90 100 Local Storage Sensitive Information stored in Logs/ Default OS Behaviour Copy/Paste enabled in sensitive fields - Privacy issue Cross Site Scripting SQL Injection over JSON or other streams
- 31. Weak  Server  Side  Controls Â
- 32. Server  Side  Issues  âąâŻ Most  ApplicaIon  makes  server  side  calls  to  either  web  services  or  some  other  component.  Security  of  server  side  component  is  equally  important  as  client  side  âąâŻ Controls  to  be  tested  on  the  server  side  â  Security  Control  Categories  for  Server  Side  ApplicaIonâ  AuthenIcaIon,  Access  Controls/ AuthorizaIon,  API  misuse,  Path  traversal,  SensiIve  informaIon  leakage, Â
- 33. Server  Side  Issues  âąâŻ Error  handling,  Session  management,  Protocol  abuse,  Input  validaIons,  XSS,  CSRF,  Logic  bypass,  Insecure  crypto,  DoS,  Malicious  Code  InjecIon,  SQL  injecIon,  XPATH  and  LDAP  injecIons,  OS  command  injecIon,  Parameter  manipulaIons,  BruteForce,  BuïŹer  OverïŹow,  HTTP  response  splimng,  HTTP  replay,  XML  injecIon,  CanonicalizaIon,  Logging  and  audiIng.  Â
- 35. Insecure  Storage  âąâŻ How  a4acker  can  gain  access  âąâŻ WiïŹ Â Â âąâŻ Default  password  aner  jail  breaking  (alpine)  âąâŻ Adb  over  wiïŹ Â âąâŻ Physical  Then  âąâŻ Temporary  access  to  device  Â
- 36. What  âąâŻ What  informaIon  â⯠AuthenIcaIon  CredenIals  â⯠AuthorizaIon  tokens  â⯠Financial  Statements  â⯠Credit  card  numbers  â⯠Ownerâs  InformaIon  â  Physical  Address,  Name,  Phone  number  â⯠Social  Engineering  Sites  proïŹle/habbits  â⯠SQL  Queries Â
- 37. InsuïŹcient  Transport  Layer  ProtecIon Â
- 38. Insecure  Network  Channel  âąâŻ Easy  to  perform  MiM  a4acks  as  Mobile  devices  uses  untrusted  network  i.e  open/ Public  WiFi,  HotSpot,  Carrierâs  Network  âąâŻ ApplicaIon  deals  with  sensiIve  data  i.e.   âąâŻ AuthenIcaIon  credenIals  âąâŻ AuthorizaIon  token  âąâŻ PII  InformaIon  (Privacy  ViolaIon)  (Owner  Name,  Phone  number,  UDID) Â
- 39. Insecure  Network  Channel  âąâŻ Can  sniïŹ Â the  traïŹc  to  get  an  access  to  sensiIve  data  âąâŻ SSL  is  the  best  way  to  secure  communicaIon  channel  âąâŻ Common  Issues  âąâŻ Does  not  deprecate  HTTP  requests  âąâŻ Allowing  invalid  cerIïŹcates  âąâŻ SensiIve  informaIon  in  GET  requests Â
- 42. Unintended  Data  Leakage   âąâŻ Plagorm  issues  â  sandboxing  or  disable  controls  âąâŻ Cache  âąâŻ Logs,  Keystrokes,  screenshots  etc.  âąâŻ Temp  ïŹles  âąâŻ 3rd  Party  libs  (AD  networks  and  analyIcs)  Â
- 43. Data  Leakage  âąâŻ Default  OS  behavior  aner  iOS  4.0  to  cache  all  the  URLS  (Request/Response)  in  the  local  storage  in  ïŹle  named  cache.db  ïŹle  âąâŻ Cache.db  ïŹle  is  not  encrypted  âąâŻ By  default,  applicaIon  takes  last  screenshot  and  saves  it  in  to  ïŹle  system  when  user  presses  home  bu4on Â
- 44. Poor  AuthorizaIon  and  AuthenIcaIon Â
- 45. AuthorizaIon  &  AuthenIcaIon  âąâŻ No  password  complexity  specially  on  mobile   âąâŻ Hidden/No  Logout  bu4on  âąâŻ Long  session  Ime  out  âąâŻ No  account  lock  out  âąâŻ AuthorizaIon  ïŹags  or  based  on  the  local  storage Â
- 47. Cryptography  âąâŻ Broken  implementaIon  âąâŻ Hash/Encoding  used  in  place  of  encrypIon  âąâŻ Client  side  script  in  place  of  SSL Â
- 48. Client  Side  InjecIon Â
- 49. SQL  InjecIon  in  Local  database  âąâŻ Most  Mobile  plagorms  uses  SQLite  as  database  to  store  informaIon  on  the  device  âąâŻ Using  any  SQLite  Database  Browser,  it  is  possible  to  access  database  logs  which  has  queries  and  other  sensiIve  database  informaIon  âąâŻ In  case  applicaIon  is  not  ïŹltering  input,  SQL  InjecIon  on  local  database  is  possible Â
- 50. Security  Decisions  Via  Untrusted  Inputs Â
- 51. Untrusted  Source  âąâŻ Any  input  from  client  side  which  can  be  modiïŹed   âąâŻ Mainly  authenIcaIon  and  authorizaIon  decisions  based  on  the  untrusted  input  âąâŻ Easiest  way  for  developer  to  solve  complex  issues/funcIonality   âąâŻ A4acker  can  get  this  informaIon  by  either  reverse  engineering  applicaIon  or  by  checking  local  storage Â
- 52. KeyChain  Dumper  âąâŻ Easy  as  running  a  command  âąâŻ Upload  on  to  server  in  /var  directory  âąâŻ Give  execute  permission  âąâŻ Chmod  +x  /var/keychain_dumper  âąâŻ Get  all  the  keys  âąâŻ ./keychain_dumper Â
- 54. Improper  Session  âąâŻ Session  is  key  for  any  applicaIon  for  authorizaIon    âąâŻ Session  is  stored  in  binary  format  but  can  be  easily  reversible  âąâŻ ApplicaIon  is  sending  sensiIve  informaIon  in  GET  request  (Be  it  on  HTTP  or  HTTPS) Â
- 55. Lack  of  Binary  protecIon Â
- 56. Lack  of  Binary  ProtecIon  âąâŻ Apple  signs  and  encrypts  all  the  binaries   âąâŻ SIll  strings  can  be  retrieved  from  the  binary   âąâŻ Storing  EncrypIon  and  DecrypIon  keys  in  the  client  side  is  sIll  a  problem   Â
- 57. AutomaIon  in  ApplicaIon  Reviews Â
- 58. Manual  Review   âąâŻ Looking  for  informaIon  in  local  storage  manually  is  really  â   â⯠Time  Consuming  â⯠Tedious  â⯠Prone  to  be  false  negaIves  (how  accurately  you  can  check  ïŹles  more  than  once  in  an  hour  and  ïŹle  formats  are  diïŹerent)  Â
- 59. Manual  Review  -Ââ  iOS Â
- 60. What  do  we  need  âąâŻ AutomaIon!!!  âąâŻ AutomaIon!!!  âąâŻ AutomaIon!!!  âąâŻ AutomaIon!!!  âąâŻ AutomaIon!!!  âąâŻ Unfortunately  no  complete  automaIon  is  available  today  BUT  some  of  the  tools  which  can  be  handy  are  -Ââ   Â
- 61. Snoop-Ââit  âąâŻ The  only  tool  today  to  automate  iOS  applicaIon  reviews  âąâŻ Very  handy  and  gives  perfect  pointer  where  to  look  for  âąâŻ A  long  way  to  go  for  automaIon  like  web  Â
- 62. Snoop-Ââit  (ContâŠ)  âąâŻ Snoop-Ââit  helps  you  monitor  â   â⯠File  system  access  â⯠Keychain  access  â⯠HTTP(S)  connecIons   â⯠Access  to  sensiIve  API  â⯠Debug  outputs  â⯠Tracing  App  internals Â
- 63. Snoop-Ââit  (ContâŠ)  âąâŻ Along  with  Monitoring,  snoop-Ââit  allows  to  -Ââ   â⯠Fake  hardware  idenIïŹer  â⯠Fake  locaIon/GPS  data  â⯠Explore  and  force  display  of  available  ViewController  â⯠List  custom  URL  schemes  â⯠List  available  ObjecIve-ÂâC  classes,  objects  and  methods  â⯠Bypass  basic  jailbreak  detecIon  mechanisms Â
- 64. Snoop-Ââit Â
- 65. iAppliScan  âąâŻ iAppliScan  allows  you  to  automate  iOS  applicaIon  review.   âąâŻ InteresIng  features  â   â⯠ Look  for  sensiIve  informaIon  in  ïŹles/directories  â⯠Find  whether  parIcular  ïŹle  exist  or  not  â⯠Download  ïŹle  for  further  analysis  â⯠Run  external  command  Â
- 66. iAppliScan Â
- 68. Reviewing  without  jailbreaking  âąâŻ Is  it  really  possible  to  review  applicaIon  with  out  jailbreaking  ?  âąâŻ âYESâ  âąâŻ âYESâ  âąâŻ âYESâ  âąâŻ âYESâ Â
- 69. Reviewing  without  jailbreaking  âąâŻ Plenty  of  tools  available  (Specially  for  Forensic)  to  brows  the  applicaIon  directory  without  jailbreaking.   âąâŻ iFunBox  allows  to  view  ïŹles  on  the  device  without  jailbreak  âąâŻ Displays  applicaIonâs  permissions  âąâŻ Browse  the  installed  applicaIon  directory  Â
- 70. Reviewing  without  jailbreaking  âąâŻ Copy   the  enIre  applicaIon  directory  mulIple  Imes  âąâŻ Look  for  sensiIve  informaIon  in  the  ïŹles  âąâŻ Use  Proxy  on  non-Ââjailbreak  device  to  check  all  server  side  a4acks. Â
- 72. AutomaIon  in  Android Â
- 73. Manual  Review  -Ââ  Android Â
- 74. FSDroid  âąâŻ Leverages  SDK  Class  â  No  hacks  in  here!!!  âąâŻ FSDroid  can  â  â⯠Monitor  ïŹle  system   â⯠Can  write  ïŹlter  to  monitor  parIcular  directory  â⯠Can  save  last  5  reports  for  future  use  â⯠Does  not  need  mobile  device  â  can  run  on  Emulator  smoothly  â⯠Easy  to  run  (As  easy  as  giving  directory  name  and  pressing  start  bu4on)  Â
- 75. File  System  Monitoring  Demo Â
- 76. Looking  in  to  Code Â
- 77. Static Code Analysis âąâŻ Introduce in Mac OS X v10.6, XCode 3.2, Clang analyzer merged into XCode. âąâŻ Memory leakage warning âąâŻ Run from Build->Analyze âąâŻ Innovative shows you complete flow of object start to end âąâŻ Configure as a automatic analysis during build process
- 78. StaIc  Code  Analysis   PotenIal  Memory  Leak Â
- 79. StaIc  Code  Analysis   Dead  store  â  variable  never  used Â
- 80. Code  Analysis  with  AppCodeScan  âąâŻ Semi  automated  tool  âąâŻ Ability  to  expand  with  custom  rules  âąâŻ Simple  tracing  uIlity  to  verify  and  track  vulnerabiliIes  âąâŻ Simple  HTML  reporIng  which  can  be  converted  to  PDF  Â
- 81. AppCodeScan  âąâŻ SophisIcated  tool  consist  of  two  components   âąâŻ Code  Scanning  âąâŻ Code  Tracer  âąâŻ Allows  you  to  trace  back  the  variable  âąâŻ AppCodeScan  is  not  complete  automated  staIc  code  analyzer.  âąâŻ It  only  relies  on  regex  and  lets  you  ïŹnd  SOURCE  of  the  SINK Â
- 82. Rules  in  AppCodeScan  âąâŻ WriIng  rules  is  very  straight  forward  âąâŻ In  an  XML  ïŹle  which  is  loaded  at  run  Ime  âąâŻ This  release  has  rules  for  iOS  and  Android  for  -Ââ  Local  Storage,  Unsafe  APIs,  SQL  InjecIon,  Network  ConnecIon,  SSL  CerIïŹcate  Handling,  Client  Side  ExploitaIon,  URL  Handlers,  Logging,  CredenIal  Management  and  Accessing  PII.   Â
- 83. Sample  Rules  -Ââ  Android  Â
- 84. Android  DEMO Â
- 85. Sample  Rules  -Ââ  iOS  Â
- 86. iOS Â DEMO Â
- 87. Debuggable  ïŹag  in  Android  âąâŻ One  of  the  key  a4ribute  in  android  manifest  ïŹle  âąâŻ Under  âapplicaIonâ  secIon  âąâŻ Describes  debugging  in  enabled  âąâŻ If  âDebuggableâa4ribute  is  set  o  true,  the  applicaIon  will  try  to  connect  to  a  local  unix  socket  â@jdwp-Ââcontrolâ  âąâŻ Using  JDWP,  It  is  possible  to  gain  full  access  to  the  Java  process  and  execute  arbitrary  code  in  the  context  of  the  debugable  applicaIon Â
- 88. CheckDebuggable  Script  âąâŻ Checks  in  APK  whether  debuggable  is  enabled  âąâŻ Script  can  be  found  at  â  h4p:// www.espheresecurity.com/ resourcestools.html  âąâŻ Paper  can  be  found  at  -Ââ  h4p:// www.espheresecurity.com/ CheckDebuggable.pdf  Â
- 89. Conclusion Â