Little Brother is watching - we know all your secrets! Siegfried Rasthofer | Fraunhofer SIT, Germany Steven Arzt | Fraunhofer SIT, Germany Stephan Huber | Fraunhofer SIT, Germany With the help of: Alexander Traud, Benedikt Hiemenz, Daniel Hitzel, Julien Hachenberger, Julius Näumann, Kevin Steinbach, Michael Tröger, Philipp Roskosch, Sebald Ziegler VB 2018, October 4 th 2018
Who are we? Steven Siegfried § Deputy head of Secure Software § Head of department Secure Software Engineering Engineering § PhD, M.Sc., M.Sc., B.Sc. in CS & IT Sec. § PhD, M.Sc., B.Sc. in computer science § Code and data flow analysis § Static and dynamic code analysis § Ethical hacker § Founder of @TeamSIK and @CodeInspect 2
Agenda § Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Sideloading-Malware § Responsible Disclosure Process § Summary 3
Agenda § Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Sideloading-Malware § Responsible Disclosure Process § Summary 4
Surveillance - Now Benign Reasons? Spyware/RAT 5
Surveillance - Now Family Couple Benign Reasons? Friends 6
Good vs. Bad Family Couple Spyware/RAT Friends 7
Surveillance - Apps Google Play Store *Android Security Report 2017 8
How well is the collected data protected? 9
App Name Google Play Store Installations Couple Tracker App 5-10 m My Family GPS Tracker KidControll GPS Tracker Rastrear Celular Por el Numero 1-5m Phone Tracker By Number Couple Vow Real Time GPS Tracker Ilocatemobile Family Locator (GPS) Free Cell Tracker Rastreador de Novia 100-500k Phone Tracker Free Phone Tracker Pro Rastreador de Celular Avanzado Rastreador de Novia 50-100k Localiser un Portable avec son Numero Handy Orten per Handynr 10-50k Track My Family 1k 10
Agenda § Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Sideloading-Malware § Responsible Disclosure Process § Summary 11
How does it work? – Very simple TEXT pull push Tracking Provider Observer Monitored Person (back-end/cloud) 12
Agenda § Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Sideloading-Malware § Responsible Disclosure Process § Summary 13
Enable Premium Features 14
Enable Premium Features boolean removeAd = SharedPref.getBoolean("l_ads", false) if(removeAd) { this.setVisibility(View.GONE); } else { ... } 15
Enable Premium Features boolean removeAd = SharedPref.getBoolean("l_ads", false) if(removeAd) { this.setVisibility(View.GONE); } else { ... } /data/data/com.bettertomorrowapps.spyyourlovefree/ shared_prefs/loveMonitoring.xml <boolean name="l_location_full" value="false" /> <boolean name="l_fb_full" value=" false " /> <boolean name="l_loc" value=" false " /> <boolean name="l_sms" value=" false " /> <boolean name="l_ads" value=" false " /> <boolean name="l_sms_full" value=" false " /> <boolean name="l_call" value=" false " /> <boolean name="l_fb" value=" false " /> 16
SharedPreferences Backup/Restore § Rooted device: § copy loveMonitoring.xml from app folder to pc § modify file, set false to true § copy back and overwrite orig. file with modified file § Unrooted device: convert * adb backup adb tool modify file adb restore *https://github.com/nelenkov/android-backup-extractor 17
Enable Premium Features /data/data/com.bettertomorrowapps.spyyourlovefree/ shared_prefs/loveMonitoring.xml <boolean name="l_location_full" value="false" /> <boolean name="l_fb_full" value=" false " /> <boolean name="l_loc" value=" false " /> <boolean name="l_sms" value=" false " /> <boolean name="l_ads" value=" false " /> <boolean name="l_sms_full" value=" false " /> <boolean name="l_call" value=" false " /> <boolean name="l_fb" value=" false " /> 18
Enable Premium Features /data/data/com.bettertomorrowapps.spyyourlovefree/ shared_prefs/loveMonitoring.xml <boolean name="l_location_full" value="false" /> <boolean name="l_fb_full" value=" false " /> <boolean name="l_loc" value=" false " /> <boolean name="l_sms" value=" false " /> <boolean name="l_ads" value=" false " /> <boolean name="l_sms_full" value=" false " /> <boolean name="l_call" value=" false " /> <boolean name="l_fb" value=" false " /> 19
Enable Premium Features 1. Give me all text messages Observer 20
Enable Premium Features 1. Give me all text messages 2. Ok: msg1, msg2, msg3, … Observer 21
Enable Premium Features 3. Client “Authorization” Check if(getBoolean(“l_sms_full”) == false) { String[] msgs = getAllMsgs(); … singleMsg = msgs[i]. substring(0, 50); } else { //return complete text messages } 1. Give me all text messages 2. Ok: msg1, msg2, msg3, … Observer 22
Enable Premium Features 3. Client “Authorization” Check if(getBoolean(“l_sms_full”) == false) { String[] msgs = getAllMsgs(); … singleMsg = msgs[i]. substring(0, 50); } else { //return complete text messages } 1. Give me all text messages 2. Ok: msg1, msg2, msg3, … Observer 23
Do not use SharedPreferences for payment or license checks!! 24
Agenda § Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Sideloading-Malware § Responsible Disclosure Process § Summary 25
Mitm + Bad Crypto + Obfuscation ?? 26
Mitm + Bad Crypto + Obfuscation ?? user@example.com secure123 27
Mitm + Bad Crypto + Obfuscation http ://s9.***********.com/login/?aaa... GET /login/?aaa=Bi9srqo&nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 28
Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 user@example.com secure123 29
Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com secure123 30
Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com GET /login/? secure123 psw=-ZI-WQe& 3. amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 31
Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com GET /login/? secure123 psw=-ZI-WQe& 3. amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& 4. mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1 32
Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com GET /login/? secure123 psw=-ZI-WQe& 3. amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& 4. mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1 33
Mitm + Bad Crypto + Obfuscation GET /login/? aaa=Bi9srqo& 1. nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& 2. eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 user@example.com GET /login/? secure123 psw=-ZI-WQe& 3. amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& 4. mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1 34
Recommend
More recommend
