Presented at NULL Hyderabad

1. Hacking and Securing Apps
srini0x00

2. SRINIVAS
Application Security Engineer
Tata Consultancy Services
I run www.androidpentesting.com
Hello!

3. Agenda…
 Android Basics
 Android Security Model
 Hello World in Android
 Reverse Engineering
 Setting up Burp Proxy
 Traffic Analysis with tcpdump & Wireshark
 Insecure Data Storage
Attacking Authentication
 Exploiting Application Components
 Side Channel Data Leakage
 Client Side Injection
 Directory Traversal Attacks
 Infecting Legitimate Apps
 Securing Android Apps

4. Disclaimer!
> This doesn’t show any automated tools to find and exploit vulnerabilities in Android
Applications.
Example: Appscan for web apps
> But we take help from some semi automated tools.
Example: Burp suite for web apps.
> We can have another Humla with automated tools. 

5. Lets Begin…

6. What is
Android

7. Android is an operating system based on the Linux kernel, and
designed primarily for touch screen mobile devices such as
smart phones and tablet computers.

8. Android Basics

9. Lets dig in..

10. Android Architecture

11. Android Security Model
> Security at the OS level through the Linux kernel
> Application sand boxing.
> Secure inter-process communication.
> Application signing.
> Application-defined and user-granted permissions
> Google Bouncer

12. Lets See..

13. Android App Components
Activity
Service
Intents
Broadcast Receivers
Content Providers

14. Let’s say “Hello World”
Building your First App

15. Reverse Engineering
java
Byte code
Dalvik Code
Dalvik
VM
.java
.class
.dex
javac
dx
Engineering

16. Reverse Engineering
Reverse
Engineering
java
Dalvik Code
.java
.dex

17. Reverse Engineering
APKTOOL DEX2JAR
JD-GUI
.smali .java

18. Lets do it..

19. Pentesting Android Apps
Profiling Your Application
Finding out a vulnerability
Exploiting
Securing
Methodology
We Follow
it in this
workshop

20. MITM Using Burp suite
1. Run Burp Suite on the machine
2. Set the system’s IP in your device as proxy
3. Start tampering the requests
Mobile based Web Apps

21. MITM Using Burp suite
Almost similar to regular web application pentesting.
So lets get into native applications.

22. Native Application Traffic Analysis
1. Get Cross Compiled tcpdump dump binary for your Android Device
2. Push it on to the device
3. Change it’s permissions to 777
4. Start tcpdump and save the packets in a .pcap file
5. Analyze the packets using Wireshark

23. Demo..

24. Insecure Data Storage
1. Shared Preferences
2. SQLite Databases
3. Internal Storage
4. External Storage

25. Demo.. 1

26. Demo.. 2

27. Attacking Application Components
1. Activities
2. Services
3. Content Providers
4. Broadcast Receivers
5. Intents

28. Demo.. 1

29. Demo.. 2

30. Demo.. 3

31. Awww! SQL Injection in Android
Demo..

32. Unintended Data Leakage
> Formerly known as Side Channel Data Leakage
> Occurs when Information processed by the code places
sensitive information some where on the device which can
be accessible to other apps.

33. Unintended Data Leakage
Leaking Content Providers
Copy/Paste Buffer
Information Disclosure in Logs
URL Caching
and many more….

34. Content Provider Leakage
DEMO 1

35. Copy/Paste Buffer
DEMO 2

36. Information Disclosure in Logs
DEMO 3

37. Lets look at a Real App
DEMO

38. Challenge
It’s Ur Turn
1 Problem
2 Solutions
Ur time starts now

39. Did I Miss
Anything

40. Infecting Legitimate Apps
That’s your challenge solution 2

41. Contact Me
https://www.facebook.com/androidpentesting
@srini0x00
srini0x00@gmail.com

42. Thanks!