2. Android Application Security
Artem Chaykin
Lead Specialist, Web Application Security Team
Positive Technologies
Positive Hack Days 2013

3. What am I?
― As previous slide said, ptsecurity guy
― Mostly web and mobile applications security assessment
― SCADAStrangelove Team

4. Intro

5. Intro

6. Application
Resources Manifest
Intents
Activity Service Broadcast
Permissions
Content
providers
Native libs Classes

7. Application
Resources Manifest
Intents
Activity Service Broadcast
Permissions
Content
providers
Native libs Classes

8. Application
Resources Manifest
Intents
Activity Service Broadcast
Permissions
Content
providers
Native libs Classes

9. Application
Resources Manifest
Intents
Activity Service Broadcast
Permissions
Content
providers
Native libs Classes

10. Application
Resources Manifest
Intents
Activity Service Broadcast
Permissions
Content
providers
Native libs Classes

11. Application
Resources Manifest
Intents
Activity Service Broadcast
Permissions
Content
providers
Native libs Classes

12. Application
Resources Manifest
Intents
Activity Service Broadcast
Permissions
Content
providers
Native libs Classes

13. Application
Resources Manifest
Intents
Activity Service Broadcast
Permissions
Content
providers
Native libs Classes

14. Hardcoded and forgotten

15. Hardcoded and forgotten
― Default/test credentials
― Test servers/ locals IPs
― Some cool info

16. File system

17. File system
― One app – One UID
― 0600 mask for new files
― 0666 mask for new files (touch, echo, etc)

18. File system
― World readable files
― Even world writable..
― SD storage

19. Ok, it could be worse..

20. File system
How to secure:
― Use MODE_PRIVATE for files
― Do not use system tools
― Do not save sensitive data on SD storage

22. logcat
// Delete before production release
Log.d(“Bank”,login+”::”+password);
^^aye, of course

23. logcat
android.permission.READ_LOGS
E/HttpUtil( 9509): >>Response: <?xml version='1.0'
encoding='UTF-8'?><result resultCode="200001033"
desc="[OSE(551)]http
error:http://10.10.10.10:7711/GET_BALANCE?LOGIN=833477&
amp;PASSWORD=222222" /><<

24. logcat
How to secure:
Do not use at all

25. SQLite & content
providers

26. SQLite & content providers
SQLite3
/data/data/app.name/databases/
load_extension() disabled :(
SQLinj… will talk later
Private database

27. SQLite & content providers
Content provider:
API to public/semi-public your database
Exported and public by default
File access API
Examples:
content://sms

28. SQLite & content providers
How to secure:
android:exported=“false”
android:protectionLevel=“signature”
android:grantUriPermission=“true”

29. Intents

30. Intents
Intent
Activity Service Broadcast

31. Activity
This is a Facebook activity->
This is what you can interact with

32. Service
This is a Facebook service ->

33. Service
This is a Facebook service ->
Really, here it is.

34. Service
This is a Facebook service ->
Really, here it is.
Background work : sync, upload, download, etc

35. Broadcast
Battery low
System send broadcast:
ACTION_BATTERY_LOW
Application1:
Alerts “Battery low”
Application2:
Stop sync

36. Manifest
Look for android:debuggable=true
Intents “exported” = (true|false)
Intents with <intent-filter> - exported by default

37. Intents
Exported intents can be called from third-party apps
Activity
startActivity()
startActivityForResult()
Service
startService()
Broadcast
sendBroadcast()

38. Intents
Third-party apps can send “extra”“data://” to intents
extra
string integer long float boolean uri
component
name
data
wrapper://host/path?query

39. Intents
Set “exported” to false for all intents
Set permissions for broadcast receiving/delivering
Validate extra data sent to intents

40. Client-server, SSL, MiTM,
intercepting, sniffing,
spoofing, cats, and more
client vulns.

41. Client-server
JSON;
XML (SOAP);
Simpe POST;
Even query string;

42. Client-server

43. Конец рассказа
Спасибо за внимание
Artem Chaykin
achaykin@ptsecurity.com
@a_chaykin