Mobile App Security An introduction Marc Obrador Who am I? Marc - PowerPoint PPT Presentation

Mobile App Security An introduction Marc Obrador

Who am I? Marc Obrador Co-founder & Head of Product Architecture @ Build38 Barcelona marc@build38.com @marcobrador /in/marc-obrador Build38 | Intro to Mobile App Security February 2020 2

Agenda 1. Introduction 2. Some Common Threads 1. Man-In-The-Middle 2. App Tampering & Repackaging 3. Root / Jailbreak 3. Recap @marcobrador Build38 | Intro to Mobile App Security February 2020 3

Agenda 1. Introduction 2. Some Common Threads 1. Man-In-The-Middle 2. App Tampering & Repackaging 3. Root / Jailbreak 3. Recap @marcobrador Build38 | Intro to Mobile App Security February 2020 4

Why Mobile App Security? 2009 2015 2020 100 Desktop 80 60 40 20 Mobile 0 Source: www.gs.statcounter.com Smartphone = Regulation Mobile-first world (depending on market) untrusted device Build38 | Intro to Mobile App Security February 2020 5

Mobile AppSec vs “traditional” Cyber Securtity Build38 | Intro to Mobile App Security February 2020 6

Is there anything I can do? Let’s first switch our perspective Build38 | Intro to Mobile App Security February 2020 7

The hacker’s perspective 25 80 20 60 15 40 10 20 5 0 0 M1 M2 M3 M4 M5 M6 M7 M8 M9 M10 M11 M12 -20 -5 -10 -40 Investment Income Cumulated Profit Build38 | Intro to Mobile App Security February 2020 8

Is there anything I can do? Build38 | Intro to Mobile App Security February 2020 9

Is there anything I can do? Make it unattractive for the hacker Build38 | Intro to Mobile App Security February 2020 10

Is there anything I can do? 25 80 20 60 15 40 10 20 5 0 0 M1 M2 M3 M4 M5 M6 M7 M8 M9 M10 M11 M12 -20 -5 -10 -40 Investment Income Cumulated Profit Build38 | Intro to Mobile App Security February 2020 11

Is there anything I can do? 1. Increase required investment: Obfuscation + Anti-reversing 25 80 2. Reduce income: Diversification 20 60 3. Force periodic investment: Renewability 15 40 10 20 5 0 0 M1 M2 M3 M4 M5 M6 M7 M8 M9 M10 M11 M12 -20 -5 -10 -40 Investment Income Cumulated Profit Build38 | Intro to Mobile App Security February 2020 12

Things to protect User Data Business Data / IP DRM Build38 | Intro to Mobile App Security February 2020 13

Agenda 1. Introduction 2. Some Common Threads 1. Man-In-The-Middle 2. App Tampering & Repackaging 3. Root / Jailbreak 3. Recap @marcobrador Build38 | Intro to Mobile App Security February 2020 14

Agenda 1. Introduction 2. Some Common Threads 1. Man-In-The-Middle 2. App Tampering & Repackaging 3. Root / Jailbreak 3. Recap @marcobrador Build38 | Intro to Mobile App Security February 2020 15

MITM HTTPS is assumed! Build38 | Intro to Mobile App Security February 2020 16

MITM with HTTPS? No, if Certificate Pinning is used Android: depends on OEM iOS: requires social engineering Build38 | Intro to Mobile App Security February 2020 17

Agenda 1. Introduction 2. Some Common Threads 1. Man-In-The-Middle 2. App Tampering & Repackaging 3. Root / Jailbreak 3. Recap @marcobrador Build38 | Intro to Mobile App Security February 2020 18

What is it? 1. Download 2. Unpack 3. Modify 4. Repack 5. Distribute Build38 | Intro to Mobile App Security February 2020 19

But, why? Cheating on games Getting paid features for free Stealing user data Build38 | Intro to Mobile App Security February 2020 20

Android: apktool + smali code Build38 | Intro to Mobile App Security February 2020 21

iOS: dynamic library injection Build38 | Intro to Mobile App Security February 2020 22

Protecting against app repackaging Obfuscation Detect it Build38 | Intro to Mobile App Security February 2020 23

Agenda 1. Introduction 2. Some Common Threads 1. Man-In-The-Middle 2. App Tampering & Repackaging 3. Root / Jailbreak 3. Recap @marcobrador Build38 | Intro to Mobile App Security February 2020 24

The ”sandbox” model @marcobrador Build38 | Intro to Mobile App Security February 2020 25

Root / Jailbreak Detection /scottyab/rootbeer /KimChangYoun/rootbeerFresh /Stericson/RootTools /avltree9798/isJailbroken /thii/DTTJailbreakDetection @marcobrador Build38 | Intro to Mobile App Security February 2020 26

What to do if Root / Jailbreak is found? @marcobrador Build38 | Intro to Mobile App Security February 2020 27

What to do if Root is found? Sources: - https://techcrunch.com/2019/08/29/google-iphone-secretly-hacked/ - https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html @marcobrador Build38 | Intro to Mobile App Security February 2020 28

What to do if Root is found? Nothing Restrict some sensitive functionality Deny service Design your security model assuming that root can (and will) happen @marcobrador Build38 | Intro to Mobile App Security February 2020 29

Agenda 1. Introduction 2. Some Common Threads 1. Man-In-The-Middle 2. App Tampering & Repackaging 3. Root / Jailbreak 3. Recap @marcobrador Build38 | Intro to Mobile App Security February 2020 30

Recap - 100% protection does not exist – aim for “good enough” - Certificate Pinning is a good idea - Apps can be reverse engineered and repackaged § Move security-relevant logic to backend or write it in native C - Root can be really bad – come up with a plan Build38 | Intro to Mobile App Security February 2020 31

Thank you! Any questions?