Man in the Binder
- 1. MAN IN THE BINDER: HE WHO CONTROLS IPC, CONTROLS THE DROID Nitay Artenstein - nitaya@checkpoint.com Idan Revivo - idanr@checkpoint.com
- 2. Who Are We? Nitay Artenstein Idan Revivo • Researcher at Check Point • Used to do pentesting in Africa (with a machete) • Now does more risky stuff, such as kernel exploits • Researcher at Check Point • When he’s not breaking Android,he breaks his trainees at the gym • Contributorto Cuckoo Project
- 3. Overview
- 4. ev·o·lu·tion n. A gradual process in which something changes into a different and usually more complex or better form
- 7. Why the Big Difference? • The sandbox • Android is a complicatedenvironment • Do we work in Java? JNI? C? Native ARM?
- 8. How to Write Malware in this Mess?
- 10. • Android Malware Today • Developer Point-of-View • What is Binder? • Man In The Binder Attacks • Possible Solutions Agenda
- 12. What Do Mobile Malware Authors Want? • Sending SMS to premium numbers • Location tracking • Secondary APK installation • Link clicking • Bank fraud • Stealing personal information • Etc..
- 13. Android Malware Evolution Android Was Born •9/2008 Fake Player •8/2010 •First SMS Trojan •Just asks for SEND_SMS permission DroidDream •3/2011 •Uses root exploits •Installs secondary APK •50 variants in app store Spitmo– Zeus goesmobile •3/2011 •Banking malware Obad – The most sophisticated Android trojan •6/2013 •3 exploits •1 backdoor •SMS Trojan Dendroid – Android RAT •5/2014
- 14. Keylogging – Swapping the Keyboard
- 15. Intercepting SMS – Just Ask Politely
- 16. Location Tracking – Again Just Ask Politely
- 18. • Android is built on top of the Linux kernel • An application doesn’t talk to hardware • Talking to the system – only via IPC Android Architecture Basics
- 19. • Each app runs with its own uid • Privileges are given upon app installation • Each privilege translates into a gid The Sandbox
- 21. What is Binder?
- 22. Return of the Microkernel • Minimalist kernel, less attack surface • Monolithic kernels won the war • How to get the benefits of a microkernel anyway? Andrew S. Tanenbaum Dianne Hackborn Darth Vader
- 23. IPC is the Key • Isolate the kernel from user apps • Implement system servers in userland • Control all communication via Binder
- 26. Why Target Binder? • Stealthy, difficult to detect • Portable data interception • Integration with the system architecture
- 27. Ready for Some Fun?
- 29. Keyloggers, the Binder Way • A thread in an app sets up a listener • It is contacted by the InputContext interface when the user hits a key • All communicationis done via Binder
- 31. Keylogging Demo
- 32. Second Attack: Data Grabbing
- 33. The Secret About Activities • Most secure applicationsprotect their data • However, developers don’t bother to encrypt data moving between in-app Activities • Surprise: This data goes through Binder
- 34. Yes, in-app data goes through Binder
- 35. …and we got the hex dump to prove it
- 37. Third Attack: Intercepting SMS
- 38. What Happens When You Get An SMS? • The Telephony Manager notifies the SMS app • The app queries the TM’s database • The response is sent back as a Cursor object • …but that’s just a file descriptor!
- 39. Let’s Grab It!
- 41. • Do as much as you can in-app • Audit your app to see what goes to IPC • If it goes through Binder, encrypt it How Do I Protect Myself?
- 42. Questions?