hello all i would like to thank you for
joining our session on android
application hacking with damn vulnerable
bank
so this is how the ui of our vulnerable
bank case
with a huge number of android
applications and the frequency with
which we use them it is more important
than ever for us to understand the
security of android applications and
their pitfalls
we have many ways to learn and practice
android application security as of today
but most of the applications which you
have cover only the basic os top 10
vulnerabilities
which are common in 2010
none of them are updated to these
standards of the latest dates
so we would like to
cover this gap and take the learning
curve a notch higher with our dumb
vulnerable bank
this not only allows you to assess your
theoretical skills but it also goes
beyond regular os top 10 vulnerabilities
it expects you to know more about
android internals how the applications
are built
you have to do binary analysis and lot
more
we are sure it pushes your heart to the
next level whoever is getting started
with android application security
without further ado let's get started
so this is the outline of this talk an
introduction to our core team
why android
via android applications why did we
choose android application security
threat vectors for the android
applications introduction to our
application
hands-on session closing notes qa
so the core team
myself raven tamina
i'm currently a senior security
architect at emirates npd
speaker and trainer at hat defcon hack
in the box etc
i'm an active open source contributor
and i have added 17 000 plus lines of
code to and math
and the other
key member of our co-team is actions
jaiswal
security engineer at cred he's an active
ctf player he won several ctfs including
hacker one hacky holidays and so on
he is also a cynic red team member
last but not least we have this kakade
so he is a part of bandung specialized
in advanced security assessment
and he is an active synaptic member oscp
certified and also an open source
contributor
so why android why did we choose android
android is everywhere
across the globe you find it
so it is you can find android in
automobiles refrigerators mobiles gaming
consoles home automation via os
nintendos everywhere you'll find android
and if you see android has been growing
without leaps and bounds since its
inception it started out with cupcake
donut but it gained more traction once
it released jelly bean that's when these
smartphones got more cheaper and the
processing power of
the mobiles got increased so this jelly
bean kitkat lollipop marshmallow that's
when android gear more traction than
ever and
we got more developers building a lot of
applications
and the trend continues to go on and
android
devices and the applications keep on
increasing
so according to this stats counter from
july 2021
they say 72
of the devices across the globe are
running android
so this is one of the reason why we
picked android because it creates a huge
impact
and even the ios is also having a
significant contribution of 26 percent
and there are some other operating
systems which are
considerably
minimal so if you see the growth of
android in 2009 it started
but it was growing very slow
comparatively in the
2013-14 where we have the marshmallow
jelly bean
it started off with jelly bean until
marshmallow we had a huge surge
in the number of android applications
so
as you can see from the statistics of
data flare by 2023 there will be around
87 of the devices running android
standard is not just limited to mobile
the iot automobiles everywhere
and why did we choose the android
applications
as you can see in 2012 it started out
and when you compare the ios and android
there was not much
much difference it's just about a
0.1 million difference but when you see
about
2013-14 where we got the jelly bean
kitkat
and the other versions released sickness
slowly
we can see the number of
we can see the increase in the number of
applications
for android on google play if you see on
2017 we have around 1.6 million
apps on google play whereas in ios it's
just
0.75 million but as of 2021 there are
around 4 million apps on google
play
and yeah this is a statistics from build
fire which confirms these facts that i
validated there are around 4.2 million
applications as of 2020 and as of 2021
it's even more
and the games play a key role in android
applications
and the remaining regular applications
which we use on the daily basis for the
sportswear fintech
health tracking cooking entertainment
and the list goes on
so
just imagine 4.2 million applications
and
its security is more important than ever
so why android application security as
we have seen there are around 4 million
applications
and
people have been using that across the
globe
and an attack on such one of such
applications will create a huge impact
so the malware attacks and android
according to checkpoint as you can see
the
malware attacks are targeted mostly for
the financial leverage
around 29 of the attacks happen in the
financial industry or the fintech
applications that impacts the
that impacts a lot of things and
the government applications
manufacturing technology and so on
also you can see the
growth in
malware infection is significantly
higher when the android started it was
just 12 million
devices or applications that got
compromised and as of 2018 there are
around 800
million
and more
infected applications
so if you consider about 2021 it will be
even more higher
so it's very important for us to
understand the core concepts of the
android application security or how we
can protect them
from a security point of view
and
yeah as you can see in 20 2006 when it
everything got started
all the attacks were non-profit
motivated they were just uh
leveraging the vulnerabilities so for
fun
but as we got
later into the other era we got
introduction to the
bitcoins cryptocurrencies non-traceable
transactions and so on so that's when
things changed when the fintech
application started getting installed on
our mobiles where we can make
transactions in just one click
that's when the attackers move from
non-profit to profit motivated attacks
where they do spear phishing attacks or
they target particular individuals or a
particular application
to
[Music]
exploit for money and as you can see in
2012 there are around
173
attacks that happened for the profit
motivated and that's a significant race
so uh we are sure if by 2021 as of now
it's even more
as you can see highest vulnerabilities
found in
one third of the android applications
are nearly equivalent to half of the or
50 of the android applications
and according to the helpnet security
60 of the vulnerabilities in android
applications are on client side itself
and that should be something
very scary
about and 89 of the vulnerabilities can
be exploited without any physical access
so just your android application and an
internet access
it's enough to
create a huge loss
and also 56 percent of the
vulnerabilities can be exploited without
even administrative rights
so even if some attacker gets hands on
your mobile he doesn't need to jailbreak
or do something just with the default
privileges 56 of the attacks happen
so
this is where we believe
uh considering these huge significant
numbers
android applications should be protected
and
threat vectors for the android
applications as we have discussed the
malware data exfiltration data tampering
data loss
multiple
threat vectors depending on the kind of
applications we are seeing and
considering the huge number of 4 million
plus applications which we have
they have different features and we'll
get to have different threat vectors but
the most common ones are
these
listed here
and what are the consequences of this
threat vectors they can lead to using of
your data bad use of your mobile
resources may be a crypto miner running
on your mobile
and reputational laws
identity theft they can use your mobile
to perform some ddos attacks they can
use your
mobile for multiple other purposes and
which can create a huge impact
for you on the professional and personal
level
so this is what we strive to do with our
damn vulnerable bank
with these
significant numbers and the increasing
rate of the android applications
and
the
lot of new developers to the android
we want to provide a platform where the
people who want to get started with the
android application security or the
android developers have an interface to
learn android application security at
a deeper level
all the applications which we have today
they just cover the os top 10
vulnerabilities but we want to take it
much higher and focus on the recent
vulnerabilities which we see
and we want to make it
realistic as possible
and that's where this
damn vulnerable bank comes into play as
you can see we have the complete banking
interface the sign up login similar to
the real world applications
and for making a transfer adding the bin
feature and stuff so i won't take much
of your time will get immediately
started with the demo and my colleague
frishkesh will
take you further on this
thank you everyone for a quick
introduction let's start with installing
the application
using the adb command so adb install dvb
dot apk
okay looks like we have installed the
application successfully
let's go ahead and open the application
looks like the application is crashing
we need to find a way why the
application is crashing in order to do
that what we can do
is we will decompile the application
using the apk tool and check the android
manifest file
so let's go ahead
we'll use the apk tool d
to decompile
and we'll check take the apk file
let's decompile the application
next we will go to the section
where the android manifest is
open that are manifest file
and we need to check the section called
as hardware accelerated
so why we are looking at this is because
we are running the application right now
in an emulator and the emulator does not
need a gpu
and since this is set to true it means
that the application will be using gpu
which is basically crashing the
application so what we can do is we'll
go ahead and set this value to false
now before closing this android manifest
what we could do is just copy the name
of the package which will require it for
the later use
all right i think we are done over here
with the android manifest we will close
it
go back
and
compile the application again using the
apk2
which is apktool build
that is b
and then again the name of the folder
followed by a new application name
let's wait for a few seconds so that it
builds the application
and the application is built
now what we will do is we will go ahead
and uninstall the previous application
so that we can install this new
application we'll use adb uninstall
and remember we had copied the package
name we'll quickly paste it over here
apparently copied the other command so
i'll have to just
quickly go to this section
copy the name of the package
and then edit adb uninstall
the name of the package now we have
uninstalled the application
we will go ahead and install the
application that we just now
built
which is dvba hyphen no gpu
so adb
install
name of the package
it's trying to install the package
but looks like there is some error it
says that failed to collect certificates
now we are getting this error because we
have yet not signed our application
so let's go ahead and sign the
application using the key tool
tool
so key tool
will create a key first with the type
key store
and
let's set up a password for the key tool
we can keep it blank
click on yes
we have created a key now we'll use this
key to sign our app application using
the jar signer
let's go ahead and sign our application
let's use the previously set password
for the key
and we have signed the application
now what we'll go is we'll go ahead and
install the application
using the adb install
hyphen gpu
and it says success great let's go ahead
open the application and see if it's
opening
we are now able to open the application
but wait we are now getting some other
errors it says that 4 is rooted and the
emulator is detected
what we can do now
let's reverse engineer the application
using a tool called apkx
so
let's go ahead type in apkx the name of
the apk that we are using right now
which is no hyphen gpu
what it will do is it will decompile the
application
and then using this what we are going to
do is we are going we are going to look
at the source code
and then from that we are going to find
out what exactly is
making the application close
and
exactly what code block
is
giving us those
toasts which is the emulator detected
and the root is detected let's wait for
this tool to complete
all right we can see that the
decompiling is done
let's go ahead
and check the folder dvb iphone no gpu
we'll go ahead and open this in one of
our favorite code editors here i will
use the vs code
but wait searching from here is a
tedious task what we could do instead is
let's use a command line tool called
grub
and look for the
word which said emulator detected i'll
just quickly show the application again
and we'll check the toast what message
does it give
it is emulator detected let's go with
that
so
i'm using a minus i flag for case
insensitive and r for recursive
and let's check for the message saying
emulator detected great we have found
the name of the file which is in src com
app
a damn vulnerable bank holder as well
let's go ahead
and open that
said src
com app damn vulnerable
main activity dot java
now what we could do from here
is let's search for the keyword
emulator
and there it is
we have found the code block
that is actually giving us the toast
but this code block does not
seem to actually close the application
it is just sending a toast
now let's check for the other message
that was phone is rooted
here it is
so basically we are looking at this code
block
now what exactly is happening if the a
dot r returns true
the application will send a toast with
the message phone is rooted and then it
will
call the function which is this dot
finish which will basically close the
application
now now in order to bypass this checks
what we have to do is
we have to flip the
written value of this method
now there are two ways to do that
uh one is to patch the application using
smiley code and then rebuild
and then reinstall the other way is to
dynamically
hook into this function
at the runtime and change the behavior
of this method and send the value as
false instead of true
or we could just flip the value of a dot
r
so we don't even have to see how the a
dot r is implemented
now in order to do that let's go ahead
and
let's use frida
to dynamically hook on to this method
so i'll close this file which we won't
need right now
okay
now what i'm going to do is we already
have a script ready for freedom
i will just quickly show you the script
that is
we that we are going to use
let me just get back
here it is
so what we are going to do right now is
java dot use is going to use this
package called a dot a dot a dot a where
the a dot r is actually defined
now we are going to implement the method
r which we saw previously which where in
a dot r was being used
what we are going to do is we will be
going to call the method as is without
modifying we will get the return value
of this method
and then what we are going to do is we
are going to return
the exact opposite value of the return
value before that will print the value
now
this is a javascript code
which we'll be using
so how do we use this
basically we'll be using freeda to
execute this and this will also open the
application
all right then let's go ahead and run
frida
to start this what i'm going to do is
i'll be calling a frida command
with a minus f
uh which will open the package and the l
will pass the file name which we just
saw
okay
let's see how it goes
clicking on insert
all right looks like i have not started
my fada server let me just go ahead
and
let me just start the fluida server
this might have gotten stuck let's open
a new terminal
and let's try the same frida script
command
okay it says syntax error let's check
what the error is on the line 10.
let's try and change it to where
let's execute it again
so let's run the freda script
and see if we can bypass
the root detection and the emulator
detection using this
says use
resume we let them benefit running
okay
now what we are seeing over here is we
can ignore the emulator it is detected
but we are seeing that the feeder is
running this is what we are seeing now
and that is what is crashing the
application
let's go ahead
and see exactly what that is
let's check the code again
all right now we have bypass this
phone root is detect4 is rooted now what
we have to do is we have to bypass
the frida is running error
which is basically causing the
application to stop
now how do we do that
we need to first figure out
how
exactly what this field check is
now how do we find that the code is
already obfuscated we cannot just go in
into the code and keep on looking that
will take a lot of time
what we can do again is use grip
ir
and let's grab for freedom
now we have got many matches over here
what we can check for hints is
frida check jni
we could check
load system dot load library for free
check
you also find over here frida check jni
which is basically
and also over here something like lift
reader check
dot so
which is basically giving us some idea
that
there is a chance
that we are
looking at a native library
which is a dot so file now how do we
find
how this frida check is implemented
in order to do that we are going to use
a tool called
to reverse engineer this library and see
what exactly it is doing
so
let's open github
and
let me just transfer the file
into the github
now we know that what we have to do
right now is since we are using an
emulator we have to find a file of x86
since the emulator runs on an x86
architecture so this is the path of the
file that we need to get
so what i have done right now is i have
drag and drop
this file in ghidra i just click on ok
it will load
and
so basically it will give you give us a
file browser sorry my bad code browser
now what we can do is we can go ahead
and click on functions
and check all the methods
the method that we are interested in is
this
this is java
underscore com underscore app damnable
now binary analysis is out of the scope
over here so we won't be focusing a lot
but if you look at the code on the right
side it is basically a
reverse engineered code for a socket
connection
so what is happening over here is the
socket is being created
and this local 28 is being passed for
connection
now as we can see that local 28 is
actually
a constant over here
now
what do we understand from this
so in most cases what happens is the
binaries content code in the big indian
format
so we
basically need to convert this value
which is a269 double zero double zero to
the triple zero two
to an actual value which is having eight
bits
now
basically we have to split this into
halves which is
zero x
a two six nine and
a triple zero two
now in order to convert them from big
ending to a decimal value we have to
swap the first two and the last two bits
so basically a zero x a two six nine
will become six nine a two
and
uh which is equivalent
to 274
basically it is equivalent to 27042
so if i could just see if i can
convert this value directly
to decimal
if i can show you right over here
yes
so what's happening right now over here
is
that we need to swap the digits which is
why we are not able to get the exact
value which we wanted to
which is
27042
now if i click on convert again
so this is the problem
but
i hope you got it
basically what we are saying is that
since we have to convert it from big
endian we have to split the first four
bits and the last four bits
so we have just let's focus on the first
four bits which is zero x a two six nine
which will be changing as
two a and nine six so it will be 0x 2a
96
which after converting to decimal
would be 27042
and now if you google the frida's the
default port since friday the server
client architecture frida server is
running on the emulator now if we google
the default port of the
frida we'll find that it is 27042
which is the exact port that we have
formed so what do we understand from
this code it's basically that the
application is trying to connect to the
default port
and if the port responds back with a
tcp handshake packet
basically it will find that the port is
open and the application stops working
so how do we bypass this
well it's pretty easy all we have to do
is just change the port of the firena
server that's it now how do we do that
let's see
let me just close the gyra
all right
now let's go ahead
and
get into adb shell
cd data local time this is where i have
stored my frida server
this is my friday server what i'm going
to do is i will kill the previous
the current process
let me find what the process is
which is 4706
let's skim that first
now let's start the frida server again
now what we are going to do is we are
going to run the frida server on port
1337
let's see
how it goes
all right now that we have started the
feeder server on 1337 port
uh let me just change the
terminal over here and let's try and
connect
to this
frida server
now how do we execute the command now
well it's pretty easy we just have to
add the minus h flag so how do we do
that
first
get
the ip address of the
emulator
which is
in my case it's 192.168.57.107.
[Music]
let's go ahead
and run friday this time with the host
and the port number that we have given
and the rest of the flags
remain the same
let's see how it goes
[Music]
the application is opening
and finally the emulator detected
and the friday is not running
that's great
now we are able to run the application
now let's try and understand and explore
the application
now that we are able to run the
application let's go ahead and try and
explore the application in order to do
that what we have to do first is start
the backend server
and
then get the ip address where the
backend server is running and enter the
ip address in the api input field
i went ahead and checked the ip address
where my back-end server is running
and i'm going to
put that
over here which is 192.168.57.1
and 3000 so 3000 port is where the api
is running let's click on health check
and see if the api is up
great the api is up
i'm going to go ahead and use the login
feature
to log in using one of the default
credentials
which is user1
and the corresponding password of user
would
all right then looks like we have logged
in finally we will have to keep this
free
running
because
without that
the bypasses won't work which means the
application will crash
now the next step if you need to
understand and see
how the request and response is being
handled
so for that what we are going to do is
we are going to use bird to intercept
the prox to intercept the requests
and then see the traffic how is it
flowing
now how to set up burp and proxy is not
in the scope so i am going to just go
ahead and show the response and the
request from the board
all right then let's go ahead and just
let's click on view beneficiary
we can see that there is a request and
response that we are getting by clicking
the v button officially
in the request we are not getting any
much of a body
uh it's just a post request
to view the beneficiary the
authentication or the authorization is
implemented
using the jwd token
now even jw token is out of scope right
now since we are focusing more on the
application
let's check the response
okay
it looks like the response has the
keyword so the first thing is that the
response is in json format second is the
key is enc underscore data
and the value is not in plain text
it looks like a base64 so let's just go
ahead select this value
we can check in the decoder
decode as base64 but hey this everything
is garbage
it looks like it's probably encrypted
now what we can do
is
since we are checking at the beneficiary
view
we can just go ahead and check the
source code of it
and we will find what exactly is the
application doing
so to do that let's open
the
application that was previously
decompiled using the apx tool so we will
open it using the vs code editor
so let's say we are checking the view
beneficiary
let's see where view beneficiary is okay
this looks like a function which is
using view beneficiary
let me just
minimize
my work
all right
great
i hope this is visible now
oh
so now let's check view beneficiary
let us again check what exactly did we
find in the board
the keyword
it was enc underscore data
so let's go ahead
and check for the keyword enc underscore
data
we are not finding anything under enc
underscore data
nowadays we can go ahead and check view
balance
and hey i think there is one finding
where the enc underscore data is being
used
so what does this line say
it says that
it is getting a json object
from the enc underscore data it is
taking the body of the value of enc
underscore data and it is passing to a
function called e dot a
now we need to find out what does e dot
a does
it looks like that e dot a is decrypting
the value that is being sent
by the enc underscore data
now how do we find that
so the package that is being imported is
c dot b dot a dot e what we could do is
just get into c dot b
dot a
dot e
so this is the package that you are
looking at
and then the function
with the method name a
again then there is another function
that has been called let's not get into
the rabbit hole what we could do it just
use frida magic again and just hook on
to the method which we saw previously
in let's say view balance
which was
e dot a
so this is the script that will be using
to get the decrypted value
so what we are doing here
we are using the package which is
c dot b dot a dot e which we saw
previously
we are implementing the function which
is a which means that whenever this
function a is called from the package c
dot b dot a dot e
this is the method that will get
executed and what are we doing here we
are just getting the data that is being
sent to this method
we will actually call this original
method
get the written value
which hopefully should be the decrypted
value
will log it and then we'll just return
the same value so that we do not crash
the application
all right then let's save this
let us go ahead
and
let us go ahead and reload the script
all right then looks like we are getting
the decrypted value as well
that is great
but now we also need to see the value
that is being sent
to the server
so basically we need the value that is
being sent to the server so that we can
tamper with the request and then go
ahead with our other pen testing
methodologies or strategies
but first let's see how we can tamper
the request for that first we'll have to
decode or decrypt the requests
so in order to find how the request can
be tampered we need to find an api that
actually has got the requests
so let's just click on few of the apis
over here and see if we can find any api
that actually has got the request
well this does not have one
my balance does not have
one transactions
now
we get one form
so let's go ahead and transfer some
money see if that works
enter the account number again which is
three times to
three times two
into the amount let's just send one
it has not
found any fingerprint sensor i hope it
goes ahead
and it won't
this is because we have not implemented
a pin if we had implemented a security
pin this would have gone ahead alright
then looks like we are not finding any
method from here let's just go into the
source code and see if we can find any
method
let's check bank login
all right then looks like this is
something that is interesting
it is taking user name and password okay
wait this is something
we had found in the burp as well
if you check login
the request is actually sending some
data
which is encrypted
let's try and leverage this
so here the username password is being
sent and it's being put in enc
underscore data
as a key
and e dot b
method is being called
before sending this json object this is
the json object that was created
now this e dot b could be the function
that is used to encrypt the data so how
do we do this again we already know
where the method is being which is in
so e dot b
is a part of c dot b dot a dot e now we
we won't go into the rabbit hole again
we will just write as frida script
to decrypt this value
as you can see here this is the method
that we are using
to decrypt the encrypted value
so we are again using the same package
which is c dot b dot a dot e
this time we are implementing the method
b
last time we had implemented the method
a which was the decryption method
this method is used for encryption
and now what we are going to do over
here is we will get the data
the
original data before encryption
then will be encrypting the data and
then we'll be logging it again and then
we will return the data as is so that
the application does not crash
so let's just save this file
let's close it
or we could keep it running
let's come here
just a few enter so that we do not mess
up
let's reload
and now what we could do
is we could log out
and login
user1
and password1
there we go we are able to get the
decrypted data
now let's understand how the encryption
and decryption is working
because we cannot keep on doing this if
we have to tamper the value while
sending the encrypted data we need a
code on our local site that will easily
encrypt and decrypt for us but in order
to write a local code we'll have to
understand how the encryption decryption
is working in the application
now we know that the method e dot b is
being called
which is the package c dot b dot a dot e
is being used for both encryption and
decryption so let's go ahead and check
that package
so what i'm going to do is i'm going to
visit c dot b
dot a
dot e
wherein i can see that the method a was
used for decryption the method b was
used for encryption
and what is common in this the common is
method e dot c
which is e dot c which is being used as
you can see in the decryption what it is
doing is it is passing the
the
base 64 decoded value to e dot e.c
while
in
method b as you can see over here
it is first encoding
it is first passing the value directly
which means that it is a plain text
value and then base 64 encoding
so let's see what this exactly is
now
the logic that is being used for
encryption and decryption is not a part
of this and could be done as a homework
what we are going to do is we will
basically understand what exactly it is
how exactly can we implement this
now we can see that there is a hard
coded key
that we can use
which is being used as well
and then there are a few operations
that are being implemented
now what we are going to do is we are
not going to go into the depth of the
encryption
but
let's say we have written
the encrypted and the decryption code
on the local side once we understand how
this encryption and decryption is
working on the application
so how easy would it be
just to decrypt this application
or decrypt the entire traffic
let me just spin up burp again
so here we can see
that let's say we take this encrypted
data and we try to decrypt it all we
have to do now is just copy this data
and
we just have to paste it in we just have
to call the decrypt method that we have
written
after understanding or after reversing
the decryption and encryption method
from the application
and we just copied over here
we save this
and then we call
the script which is using node so we
have written the code in the javascript
so let's create uh
try and execute this and there you go we
are getting the decrypted value
let's try another one
let us take a response this time
we copy the encrypted data
we open the j crypto js
change this value
save the file
and execute it again
and there you go
we have our decrypted data
this is how easy
this has been once you understand how
the application is reversed
but it's not going to be that easy in
the real world example
now to take you ahead
i invite akshans
and i hand over it to him thank you
so in exploit section we are going to
talk about real world attack scenarios
and vulnerabilities in dbpa
so let's begin with irrelevant attack
scenarios
so first we are going to discuss about
sensitive information disclosure so in
this
we are going to talk about a researcher
report
that was
being disclosed on hacker one
and the application was coinbase
so in coinbase application
there was a bug where
logging was enabled and which would
result in
the highest impact for access token
leakage so basically when a user would
login into facebook
uh
the response the oauth response code
would be sent back to the application
but in this case what was also happening
is that
the application was receiving it but
also the logging was enabled so
via log cat anyone could also see that
responsible so researcher further
escalated and was able to obtain the
access token for an account by also
using client secret
coming to second vulnerability there was
user input leakage so this happened in
grammarly keyboard application
so in grammarly keyboard application
before 4.1 there was leakage in user
input text field
but
currently uh grammarly keyboard is not
supported less than version 5.0 so the
vulnerability is itself prevented
third we are coming to access in web
view so this was reported by pachi pro
and
in grab application
so in this the issues were related with
deep link and webview
so
what basically the issue was that deep
link was accepting
page url parameter and this parameter
was able to open
was able to load url
in the application
so
once it was loaded in the application
user can send a deep link url and it
would be loaded inside the application
sandbox
so backy pro further escalated it and
then he was also able to get
grab user information
so for a particular user who was able to
get information of them
so how this was exactly triggered let's
see so as you can see like
the page parameter was vulnerable which
was able to open any url
now
once this could open any url the the
first major attacks can be the user can
do and open redirect and can send him to
a malicious webpage or they can show in
pop-up or alert kind of thing but
in this case what was happening is
basically
the webview had an interesting setting
that would support zendex activity web
interface and basically this what
allowed is to get grab information user
within that webpage so basically for the
poc if someone had loaded windowed or
under
get grab user and loaded this exact page
what would happen basically is they
could get grab user information
so this was a sensitive one which was
happening by accesses
and also the deep link was involved so
this was a chain of multiple issues
so now let's look at vulnerabilities
that we have laid out in dbp so we are
going to see demo for two of the
vulnerabilities that is for sensory
information and disclosure and accesses
in webview deep link
so
let's start with this
so first we are going to see
the
sensory information disclosure
that is we are going to see how we can
get an access token
from
the application
so here let's first look at the activity
so in bank login activity which is the
login page for our
application
here once a user login basically
the application also login for access
token so basically
one can read the access token by adp
logs so let's see the demo for same
so we have our application here
and
let's
do login
admin
user account
and let's grip
for the access token and let's login
so as you can see
we got the admin
user access token where the adb logs
so this was an issue
where the application is logging which
it should not and because of that we
were able to get the access token
and
see the admin account so by using this
basically you can also log in as admin
now second we will see an access issue
that exists due to chaining of
web view and deep link
now let's look
at
android studio again and let's look at
the code for android manifest
so in manifest if we see we have
currency rates activity which basically
accepts a deep link so the steep link is
a url basically
where
the scheme is http and the host is
xe.com so basically then the application
expects that
a deep link within protocol http
and a host xp.com can be accepted by
this application now let's see how this
vlink will be consumed by the
application
so if we open currency rates activity we
see that the d-ping has two ways to
being accepted the first being if the
deep link is null it would directly open
xe.com
but if there is a url parameter attached
to it then it would load that url
basically
uh
after the url uh parameter the value of
that so
just giving you an example here
if we have http
as
http
www.xe.com
comma url
equal to http
google.com
so if we see here
google.com will be open
if we send this url
to the default
now
let's see what the potential impact can
be of this
now we have seen that we can send a
arbitrary url from our side which we can
send it to the deep link now using this
we can get an open redirect but let's
see an xss example
so what we can do is basically load a
page a web page
we can open it in chrome or in
wi-fi also
so under this what we'll do is basically
first add xc.com that is the protocol
and the host then add the url parameter
which will
help us to pass the
other half that is other url for that
and then we can execute the javascript
as well
so let's see the demo for same
so as you can see we have loaded this
page
and
if we click on lucky draw let's see what
happens
so we get the prompt
and we'll click just one
as you see we get
the javascript being executed and we get
the prompt
for enter password
now this was
the demo for the two vulnerabilities
that we have covered
thank you akshaya and srishkish for the
wonderful session
i hope
you have
got some idea on what we are trying to
achieve and the kind of vulnerabilities
which we have indicated with
the vulnerable application
so just a closing note
so with this all said we developed this
application the damn vulnerable bank
with the willingness to share learn and
teach android application security
we want to give the community what we
didn't have when we got started
just knowing the os top 10
vulnerabilities will not help us in the
long run or when we try to pen test
applications
at large scale
so we want to provide an interface that
will help you while doing the real world
pen tests as well so we are constantly
striving
to keep this application updated with
the latest vulnerabilities and make it
as harder as possible to level up the
skills of the beginners starting with
android application security so that
they will have access and knowledge to
different techniques
other than os top 10.
and as you can see we have the github
link and
over there and
we have a complete guide on how you can
solve all these challenges with a
complete walkthrough
as the below link
and
yeah we are open for the q and d and you
can contact us on twitter on this below
links
thank you for staying with us so far
i would like to hear more on your
feedback okay guys
thank you for the great talk
we are now ready for the q a session
do you have any questions from the
audience
on youtube in zoom
anywhere else
okay guys
thank you
okay
i'm checking my notes and i don't see
any questions is that correct or should
we
let the audience rest
if anyone on zoom wants to ask the
questions live please raise your hand
and i will give you the microphone
okay that's surprising
okay i will ask the question then guys
uh
do you plan to extend this work
somewhere else to some other platforms
to iot or to
[Music]
ios
i don't know it looks like something
that could scale
sure so
what we have plan right now
in our minds is to actually add some
more
findings that are more realistic
than the ctf ones so that
ones that who are learning right now
about the android android security atlas
specifically
they'll get more exposure to how and
what are the threats that need to be
checked and they could again uh come up
with let's say threat modeling of some
applications
that would be uh
that is to be integrated as well
and yeah
we invite all of you uh whoever wants to
contribute to the application feel free
to send us a pull request uh we'll work
on it and we can make this an app for
everyone in the future
awesome
okay so my strategy of taking fire on
myself and letting the audience rest
seems to work out we have the first
question
does the damn vulnerable bank contain
all the real world
challenges
it's a tricky one
how can you contain all the real world
challenges in one product but please
advice
sure so uh the challenges that we are
adding are the real world challenges
that's one thing that we can tell uh
there are no ctf like uh
challenges or we are not luring the
attackers in some rabbit holes so yeah
and uh we are going to keep on adding
some of the challenges as well as we
will be adding some of the mitigations
that people are using right now like
using some native libraries and even how
to bypass these mitigations as well so
we are trying to keep it as real as
possible
[Music]
i'm glad you're on mute if you're
speaking
yeah sorry i'm giving the microphone to
bogdan who has a question and wants to
ask it live please go on
yeah hey guys thanks a lot for your talk
um let me introduce myself uh i'm back
done i was brutal chapter leader and i
have a question for you uh would it be
easier to use real device with uh magisk
for example two bypass root detection
and some slk switch to decrypt the
traffic
hey
thank you for your question so um yeah i
mean majority of the applications can be
bypassed using uh matches to bypass
protection and even kill switches work
but in real life or in real world we've
seen applications on which these general
tools don't work so just for that what
we have done is we have been
implemented or used freeda so that
the people who are just entering into
android security would also get a test
of it so that they can use their own
creativity uh
in order to write some uh code to hook
into the methods uh dynamically and
perform some more stuff
okay got it thank you thanks for an
answer yes
okay next
question as far as i understand
this app doesn't use armed trust zone
what can you do in such case
i'm sorry um i i'm not able to see the
question can you please repeat it again
uh as far as i understand this app
doesn't use armed trust zone what can
you do in such cases
i think well uh i think it means that uh
what you can do when the case in the
case is when uh the application does use
arm trouser
um
i'm not sure exactly what the question i
mean what exactly are they expecting it
from the question and if you're not
implementing i will ask i will ask
alexander to clarify their question if
they can or maybe ask it live because
this is the question from zoom
yes alexander you can now talk please
and mute and go on
hello everyone uh let me clarify my
question
uh so arm frozen is a standard um
mechanism for security
uh extensions and uh it should
enhance security for device uh for using
uh
secure storage uh cryptography
from drazon and
other mechanisms
could you bypass such mechanism with
your techniques
got it got it uh thank you for excuse me
just from my understanding it's like uh
it's like
security enclave in ios right
right
uh-huh so tpm basically yeah thank you
for the question really interesting
right so uh if you're speaking about
some of the security measures that are
being actually implemented on the
hardware level
uh they won't be uh bypassed using the
techniques since uh like even to give an
example of android key store so correct
me if i'm wrong so even key store cannot
be bypassed even on the rooted devices
because
uh unless and until we get the
uid or the
id of the application we won't be able
to access the key store that is being
actually mapped for the application
so
these are the shortcomings of
actually hacking the applications even
if you are doing it on the rooted device
or even if the application is running on
a rooted device
thank you us
yes thank you
okay do we have any more questions we
have a lot of
feedback positive cheering on youtube
thank you for the great talk nice one
keep it going
yeah
i would just i'll just repeat that if
anyone in the audience wants to
contribute to the project
get back to our speakers after
the talk or after the conference and
would i post the link in the chat
and go ahead and do that
yeah you can easily find them vulnerable
bank on github so your prs are
warmly
welcome
okay any more questions we have some
delay with youtube
let's wait for about
20 seconds and then wrap it up
and the link goes to youtube channel as
well
okay gentlemen i think
uh that was that was a pause long enough
for us to
to be sure that all the questions were
answered thank you very much for the
great talk and uh we will get back to
you
regarding the logistics later on okay
thank you thank you blair thank you for
having me thank you thank you very much
for your contribution
and the great project that you are
maintaining and i again
uh
welcome everyone to contribute and join
this uh great opportunity to advance the
security knowledge around android
platform