Risk Analysis of Android Based Appliance

Posted November 24th, 2011 by Pralhad Chaskar

Overview

I had to do the risk analysis of the Android 2.2 – Froyo based appliance and check for any security flaws exist in it before the XYZ Ltd. (just the example) company could launch that product in the market.

Background

How I get connected to appliance
At start of my task I first assign an IP address (here 192.168.1.88) to the appliance, and ensure I have necessary connectivity to the appliance. The next obvious task is to run a port scan. I use NMAP and to my dismay I find no open ports. I now enabled USB debugging in android appliance by browsing this path of appliance.

Settings > Applications > Development > USB Debugging

Again port scanning the device I found Port No. 5555 Open.

Then I figured out that by Enabling USB debugging opens Port no. 5555 by default. Odd-numbered range of ports from 5555 to 5585 are usually used by emulators/devices (let Nmap to find’s it out for you).

Intermediate between my machine and appliance: ADB

My next step was to place the bridge between my machine and appliance. Here Google helped me by providing us the Android Debug Bridge (ADB) which is freely available .

Android Debug Bridge (adb) is a versatile command line tool that lets you communicate with an emulator instance or connected Android-powered device. It is a client-server program that includes three components:
1] A client, which runs on your development machine. You can invoke a client from a shell by issuing an adb command.
2] A server, which runs as a background process on your development machine. The server manages communication between the client and the adb daemon running on an emulator or device.
3] A daemon, which runs as a background process on each emulator or device instance.

Following is the snippet of ADB.

Commands of my interest were as follows:-
1] adb connect device_ip:port_no – connects to attached device
2] adb devices – List all connected devices/emulator
3] adb push <local_path> <remote_path> – Copy file/dir to device/emulator
4] adb pull <remote_path> [<local_path>] – Copy file/dir from device/emulator
5] adb shell – Run remote shell interactively
6] adb logcat – View device log
7] adb install [-l] [-r] [-s] <file> – push this package file to the device
8] adb uninstall [-k] <package> – remove this app package from the device
9] adb help – Always helps to view all switches available

What do you mean rooting the android appliance?
Android is basically a reworked Linux. Rooting means getting super user privilege to android device. Rooting thus provide you with access to system files and the ability to change things that normally are marked read only. This allows you to change all kinds of things that normally you wouldn’t be able to, along with install custom versions of Android.

There are multiple applications available for rooting the android eg: z4root, EasyRoot, SuperOneClick and many more.

In my case z4root helped me to become root user, it allows for temporary / permanent root using Sebastian Krahmer’s RageAgainstTheCage method.

Tools help
Android Reversing Toolkit (ART) by Deurus which used to Compile, De-Compile, Re-compile the applications.

Manitree (by IntrepidusGroup) is a tool that will review an AndroidManifest.xml file, APK package, or an entire device (or devices) for insecure values in the AndroidManifest.xml file. This is not the exact way to analyze the APK’s but this tool will help you want to analyze 100′s of APK’s in short span of time and pluck out low hanging fruits.

dex2jar is a tool for converting Android’s .dex format to Java’s .class format which is readable by using Java Decompiler GUI utility.

Let’s Get Started
Here our appliance [Target] IP address was 192.168.1.88. Then I connected to the appliance using ADB.

Are we connected? Let’s verified the same

Uhhh….Finally our appliance is talking to us and we are also able to talk. By using the ADB we get the shell access of the appliance by using the command as follows.

Firstly I got the non-rooted (not able to browse all directories and files) appliance and want to pull out all the application (apk). Hence in order to get the path of each application’s installed, I need the packages.xml file. This file helped me to figure the exact path (codePath) of each apk located under /data/app directory (not available usually for non-rooted) of android. Following is the command for the same.

adb pull /data/system/packages.xml

In my case the desired application was in /data/app directory, so i was able to pull APK file from the appliance even if my appliance was non-rooted. But suppose your desired application is located in /data/app-private directory, and then you cannot pull out applications (apk) from non-rooted appliance.

Then i thought of rooting the appliance using the z4Root to get deeper insight of appliance and underlying OS.

And following are the directories and files we could find under root directory. Here our ADB daemon is only running with privilege of root by default.

Under the /system/app we could find all the applications installed in the appliance.

Then we can pull the respective *.apk file via ADB.

An .apk file extension denotes an Android Package (APK) file. This file format, a variant of the JAR format, is used for distributing and installing bundled components onto the Android operating system.

After pulling the desired apk, I used ART (one method to look into apk) to decompile the apk can be used to Compile, De-Compile & Re-Compile the applications. The steps involved in De-compilation are as follows:-

Now my concern was to dig in this APK file. So just rename the *.apk to *.zip (it is another way to look into apk). Unzip the respective file. Following are the contents of the same.

AndroidManifest.xml is a required file for any application. It describes the name, version, access rights, referenced library files, and other information of the application. The AndroidManifest.xml contained in the .apk file has been compressed.
META-INF Directory, where signature data is stored, is used to ensure the integrality of the .apk package and system security.
Classes.dex is a java byte code file generated after the compilation using java source codes.
Res directory is used to store resource files.
resources.arsc is a binary resource file after compilation.

By just supplying the AndroidManifest.xml file to Manitree, it will generate the report mentioning the improper permissions granted to application with severity. Following is the usage for the same.

So let’s check in the code of AndroidManifest.xml which is pointed out by the Manitree.

In above image <grant-uri-permission android:pathPrefix=”/” /> means that anything that is located in a path that starts with “/” is able to access the content-provider of any other application. For better understanding ContentProvider are used to provide data from an application to another (eg: – Social networking app which could access the photos from Gallery, so here Social Networking app & Gallery are sharing the common resource). ContentProvider do not store the data but provide the interface for other applications to access the data. Hence in our case instead of <grant-uri-permission android:pathPrefix=”/” /> it should be <grant-uri-permission android:pathPrefix=”/<specific_application_directory>” />

Now let’s concentrate on Classes.dex file. This file can be decompressed using the tool dex2jar.

Now open generated classes.dex.dex2jar.jar file using Java Decompiler GUI [jd-gui].

Expanding each tab we could actually read the code.

Going through the non-obfuscated code we can understand the flow of code and working of Application. In order to prevent this we can use “ProGuard” tool which shrinks, optimizes and obfuscates your code and renaming classes, fields, and methods with semantically obscure names. The result is a smaller sized .apk file that is more difficult to reverse engineer. After usage of Proguard code looks as follows.

Next step was is there any database in backend for application to store the data. This I could figure out in /data/data/<package_name>/databases/ folder. Then by using the ADB we can pull the desired database file on our machine.

Android as whole uses SQLite database to store the data for each application. We can view the contents of extracted database file of desired “package_name” using the addon in Mozilla Firefox named SQLite Manager 0.7.4 or tool named SQLite Maestro.

Now I can read the un-encrypted database entries and also execute the SQL queries to refine your result.

While this entire activity is running always keep “logcat” open in one of the terminal/command-prompt. Logcat has mechanism for collecting and viewing system debug output. Logs from various applications and portions of the system are collected in a series of circular buffers, which then can be viewed and filtered by the logcat command. Following is the command for the same.

adb logcat [<option>] … [<filter-spec>] …

Exercise ended with following Risks
1] Root-level Access to system
2] Installation of 3rd-Party APKs
3] No authentication to access to system
4] Remote Connection/Management of Device
5] Vulnerability in the underlying OS
6] Insecure Coding Practices
7] Unrestricted Browsing permissions
8] Manual Vendor Updates
9] Loss of the Device
10] Database entries are not encrypted

Best Coding Practices for building secure Android application (Source: Google)
1] Maintain a privacy policy
2] Minimize permissions
3] Give your users a choice regarding data collection
4] Don’t collect unnecessary information
5] Don’t send data off the device
6] Use encryption and data minimization
7] Don’t use code you don’t understand
8] Don’t log device or user specific information
9] Use Proguard- Code obfuscation mechanism
10] Performing Input Validation

Dump password of application pool user from IIS >= 6.0

Posted November 19th, 2010 by Dhiraj Ranka

IIS Application pools are used to separate sets of IIS worker processes that share the same configuration and application boundaries. Application pools used to isolate our web application for better security, reliability, and availability and performance and keep running with out impacting each other . The worker process serves as the process boundary that separates each application pool so that when one worker process or application is having an issue or recycles, other applications or worker processes are not affected.
One Application Pool can have multiple worker process. (Ref:http://technet.microsoft.com/en-us/library/cc735247%28WS.10%29.aspx)

Main Point to Remember:
1. Isolation of Different Web Application
2. Individual worker process for different web application
3. More reliably web application
4. Better Performance

It may happen that while managing or testing multiple web applications we create many application pool(s) in the IIS. Thus, there is always the possibility that we may forget the password of an account that we have used for the some application pool. In order to retrieve the credentials we can use the utility called APPCMD.

Read the rest of this entry »

Info-Letter vol.2

Posted November 19th, 2010 by Wasim Halani

Hi all,

This month’s reading list. Make sure to check out the tools sections.

Traditional Pen-testing is Dead: A frank look at the state of affairs of our daily job
http://www.secmaniac.com/october-2010/traditional-penetration-testing-is-dead-bsides-atlanta/

Read the rest of this entry »

Info-Letter vol. 1

Posted October 18th, 2010 by Wasim Halani

Hi all,

We are starting with a monthly reading-list for people who are unable to keep up with the latest in the field of IT Security.
A few articles (like the ones below) may be informational to the non-technical readers as well to improve their tech know-how and security posture

Read the rest of this entry »

Social Engineering & “Influence”, by Dr. Cialdini

Posted June 3rd, 2010 by K K Mookhey

Over the past few years, we have completed a number of social engineering tests as part of advanced penetration testing at various organizations. Coincidentally, I recently read an excellent book called “Influence – the Psychology of Persuasion” by Dr. Robert Cialdini.and realized that it has some excellent lessons for anyone wanting to guard themselves from social engineering attacks.

Dr. Cialdini’s book is an excellent coverage of what he calls “compliance professionals” – people engaged in hard-core door-to-door selling such as second-hand car salesman, multi-level marketing (read Amway) professionals, etc. He talks about the following 6 techniques adopted by these professionals to convince people to buy things they were never going to buy in the first place. The same techniques can also afford the social engineer easy access to information, and it is worthwhile for information security professionals to examine what the other breed of “compliance professionals” is up to!

Read the rest of this entry »

Format Preserving Encryption – In the guise yet retrievable as it is

Posted February 9th, 2010 by Khushbu Jithra

A recent dive into challenges faced from privacy compliance requirements unearthed an interesting patent. The unearthing of this new patent on the block came from the need of anonymizing data for several reasons including compliance (PCI DSS, German Data Privacy Law [BDSG], UK Data Privacy Act). Read the rest of this entry »

GeoEdge – IP Address Locator

Posted January 6th, 2010 by Nikhil Wagholikar

Introduction

Log analysis, is one of the very basic but crucial exercise of any Forensics Analyst. It includes many aspects for analysis; some of the important ones being:

• Determine actions/requests performed by User/Host/IP Address
• The application’s or Server’s reactions towards user’s requests
• Finding more information about a particular User/Host/IP Address who may be performing some extra-ordinary transactions with the application/server
• Application/Server performance
• Application/Server traffic monitoring to calculate business growth etc

However from forensics point of view, investigating “which user did what on the application/server that lead to its compromise” is of the most importance. Similar scenario applies to Email investigation. It’s quite simple now to find out the IP Address of the person who is sending out fishy or threatening emails to the victim(s).

Here we are discussing a post investigation aspect of above and similar scenarios i.e. what after once the source IP Address (of the attacker) is identified? In this article we are going to discuss about a simple tool/script, which helps forensic analyst to get the exact location of the source IP Address on this very beautiful earth.
Read the rest of this entry »

Hacking Microsoft Windows 2003 Server with Microsoft SQL Server 2005

Posted December 8th, 2009 by TAS

This post is a complete switch over from my previous post on phishing modus operandi. A little background on the hack. I was doing an assessment of a financial application; the objective was to evaluate the security of the complete infrastructure on which the application will be hosted once it goes live. As oppose to the routine list of findings this particular hack took the limelight. It was system compromise with Administrator access to the system. Yeah!

Read the rest of this entry »

A Phishy Story

Posted November 5th, 2009 by TAS

Phishing sounds similar to fishing. Fishes are to the volume of internet users today much like fishermen are to phishers. Zillions of fishes falling prey the nets is nothing less compared to internet users being phished through their own in boxes and messengers. Phishers tend to have some personal favorites – personal information, credit cards numbers, debit cards numbers with ATM pins, etc. Though phishing has been around for a long time, it became more prominent back in 2003. You can read more here on the big scams here.

How does it all work?

Read the rest of this entry »

Deobfuscating Javascript Malware

Posted October 1st, 2009 by Wasim Halani

Some days back I was greeted by a Google Safe browsing warning when I tried visiting a ‘known’ site. As I was sure it was supposed to be clean and harmless site, I thought it would be good to dig further into this problem. The trail led to interesting amounts of codes, concepts and techniques.

Malware writers are very smart nowadays (haven’t they always been ?). They know that once their code is understood it most likely to be detected by anti-malware applications. To delay detection by such applications, they resort to a wide range of techniques. In this blog post I’ll be discussing the most potent and easily created malware.

Javascript has become the boon and bane of the Internet. It provides greater interactivity with the user but can also be used by malware writers to infect innocent users. Javascript is a client-side scripting technology which means the processing of the script is handled by the user’s browser.

Obfuscation is the concealment of intended meaning in communication, making communication confusing, intentionally ambiguous, and more difficult to interpret.

Read the rest of this entry »