Mobile Browser Content Handling
0 likes1,079 views
The document discusses the handling of content by mobile browsers and the associated security risks, focusing on URL schemes for iOS and Android applications. It highlights the importance of validating inputs and preventing malicious interactions through these content handlers. Security testers and developers are urged to recognize and mitigate these vulnerabilities to protect user data and device functionality.
![iOS URL Handlers
• XPath: Look for:
/plist/dict/array/dict[key='CFBundleURLSchemes']/array/string
• Now you know the URL Schemes the app handles
• SANS blog post on this issue in iOS:
– http://software-security.sans.org/blog/2010/11/08/insecure-handling-url-schemes-
apples-
ios/?utm_source%253Drss%2526utm_medium%253Drss%2526utm_campaign%2
53Dinsecure-handling-url-schemes-apples-ios
– Too long to type? http://bit.ly/ezqdK9
© Copyright 2011 Denim Group - All Rights Reserved 5](https://image.slidesharecdn.com/mobilebrowsercontenthandlingowaspnova20110303-110308142029-phpapp02/85/Mobile-Browser-Content-Handling-6-320.jpg)
Mobile Browser Content Handling
- 1. Mobile Browser Content Handling Potential Risks and Mitigations Dan Cornell © Copyright 2011 Denim Group - All Rights Reserved
- 2. My Background • Dan Cornell, Founder and CTO of Denim Group • Software developer by background (Java, .NET, etc) • OWASP San Antonio, Global Membership Committee • Denim Group – Build software with special security, performance, reliability requirements – Help organizations deal with the risk associated with their software • Code reviews and application assessments • SDLC consulting • Secure development training © Copyright 2011 Denim Group - All Rights Reserved 1
- 3. Mobile Browser Content Handling • Many mobile platforms allow you to designate applications to handle content found in web pages – By URI protocol – By content type • Provide a “premium” experience for users who have the target app installed • Examples: – tel:// URLs initiating phone calls – maps:// URLs to display maps © Copyright 2011 Denim Group - All Rights Reserved 2
- 4. iPhone/iPad URL Schemes • iOS applications can be set up to “handle” certain URL schemes • Defined in the application’s Info.plist • Binary format: annoying © Copyright 2011 Denim Group - All Rights Reserved 3
- 5. Decoding plist Files • plutil -convert xml1 Info.plist • Much nicer © Copyright 2011 Denim Group - All Rights Reserved 4
- 6. iOS URL Handlers • XPath: Look for: /plist/dict/array/dict[key='CFBundleURLSchemes']/array/string • Now you know the URL Schemes the app handles • SANS blog post on this issue in iOS: – http://software-security.sans.org/blog/2010/11/08/insecure-handling-url-schemes- apples- ios/?utm_source%253Drss%2526utm_medium%253Drss%2526utm_campaign%2 53Dinsecure-handling-url-schemes-apples-ios – Too long to type? http://bit.ly/ezqdK9 © Copyright 2011 Denim Group - All Rights Reserved 5
- 7. Android Intents • Intents are facilities for late-binding messaging between applications – http://developer.android.com/guide/topics/intents/intents-filters.html • One use is to allow applications to register to receive messages from the Browser when certain types of content are received – Like iOS URL Schemes but an even more comprehensive IPC mechanism © Copyright 2011 Denim Group - All Rights Reserved 6
- 8. What’s Up With My Android XML Files? • Binary encoding • Use axml2xml.pl to convert them to text http://code.google.com/p/android-random/downloads/detail?name=axml2xml.pl © Copyright 2011 Denim Group - All Rights Reserved 7
- 9. Much Better • Now we can see <intent-filter> tags © Copyright 2011 Denim Group - All Rights Reserved 8
- 10. Intent Filter Example <intent-filter> <action android:name="android.intent.action.VIEW" /> <category android:name="android.intent.category.DEFAULT" /> <category android:name="android.intent.category.BROWSABLE" /> <data android:scheme="danco" /> </intent-filter> • Action: What to do? • Data: Scheme is URI “protocol” to handle • Category BROWSABLE: Allow this Action to be initiated by the browser © Copyright 2011 Denim Group - All Rights Reserved 9
- 11. Intent Filter Demo – Manual Launch, HTML Page © Copyright 2011 Denim Group - All Rights Reserved 10
- 12. Intent Filter Demo – Anchor Launch, IFrame Launch © Copyright 2011 Denim Group - All Rights Reserved 11
- 13. I’m a Security Tester. Why Do I Care? • URL handlers are remotely-accessible attack surface • This is a way for you to “reach out and touch” applications installed on a device if you can get a user to navigate to a malicious page • Send in arbitrary URLs via links or (easier) embedded IFRAMEs • Example: iOS Skype application used to automatically launch the Skype application and initiate a call when it encountered a skype:// URL – Apple’s native Phone handle for tel:// URLs would confirm before a call was made © Copyright 2011 Denim Group - All Rights Reserved 12
- 14. I’m a Developer. Why Do I Care? • See the previous slide. Bad guys care. So should you. Please. • Content passed in via these handlers must be treated as untrusted – Positively validate – Enforce proper logic restrictions • All: – Should a malicious web page be able to cause this behavior? • Make phone call, transmit location, take photo, start audio recording, etc • iOS: – Validate inputs to handleOpenURL: message • Android: – Validate data brought in from Action.getIntent() method © Copyright 2011 Denim Group - All Rights Reserved 13
- 15. Online • Code, slides and videos online: www.smartphonesdumbapps.com © Copyright 2011 Denim Group - All Rights Reserved 14
- 16. Questions? Dan Cornell dan@denimgroup.com Twitter: @danielcornell www.denimgroup.com (210) 572-4400 © Copyright 2011 Denim Group - All Rights Reserved 15