Android Malware in Practice Part I Android Filesystem Layout [email protected] ~ $ adb shell mount rootfs / rootfs ro,relatime 0 0 tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0 devpts /dev/pts devpts rw,relatime,mode=600 0 0 proc /proc proc rw,relatime 0 0 sysfs /sys sysfs rw,relatime 0 0 none /acct cgroup rw,relatime,cpuacct 0 0 tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0 tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0 none /dev/cpuctl cgroup rw,relatime,cpu 0 0 /dev/block/mmcblk0p9 /system ext4 ro,noatime,barrier=1,data=ordered 0 0 /dev/block/mmcblk0p12 /data ext4 rw,nosuid,nodev,noatime,barrier=1,journal_async_commit, data=ordered,noauto_da_alloc,discard 0 0 /dev/block/mmcblk0p8 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,journal_async_commit, data=ordered 0 0 /dev/block/mmcblk0p3 /efs ext4 rw,nosuid,nodev,noatime,barrier=1,journal_async_commit, data=ordered 0 0 /sys/kernel/debug /sys/kernel/debug debugfs rw,relatime 0 0 /dev/fuse /mnt/sdcard fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,.... /dev/block/vold/179:17 /mnt/extSdCard vfat rw,dirsync,nosuid,nodev,noexec,noatime,nodiratime, uid=1000,gid=1023,... Android Filesystem Layout The mounts of interest / - root of the filesystem hierarchy /system - the ROM that holds all system binaries /data - RW location for user applications /cache - transient data space for user applications /efs - phone specific information like IMEI number /mnt/sdcard - fat32 filesystem with no inbuilt security Application locations • System applications • /system/app/<AppName>.apk • User applications • /data/app/<AppName>.apk (preloaded) • /data/app/<AppPkgName>-1.apk (downloaded) • /mnt/secure/asec/<AppPkgName>-1.apk (sdcard) App Signing • All apps are signed with a key to provide android with the ability to distinguish distributors of software • Possible to group applications in the same security context when two applications are signed with same key giving identical digital signature Android Debug Bridge • Android Debug Bridge allows the developer access to the Android device connected via usb or IP • Once connected to a device, ADB provides developers an interface to interact with a rich suite of tools to manage the device ADB Push / Pull • Using ADB we are able to transfer files from/to the device • Pull test.txt off the device and place in pwd • adb pull /mnt/sdcard/test.txt [local location] • Push local test.txt to sdcard on the device • adb push ./test.txt /mnt/sdcard Android Manual Install • Manually install application • adb push com.myapp.hello.apk /data/app/ • (Permissions need to be changed to 0644) • adb install com.myapp.hello.apk • Manually uninstall application • adb uninstall com.myapp.hello Package Manager • pm is a tool that is provided to manage and provide details about applications and permissions. • List all applications • pm list packages • Find location of an application • pm path com.myapp.helloworld • List available permissions • pm list permissions -f Activity Manager: Sending Intents • The activity manager provides the mechanism to start an instance of a graphic application • using adb we are able to start applications via • am start -a android.intent.action.CALL -d tel: 021021021 Service Manager • The service manager can also be invoked via command line to send messages • service call isms 5 s16 "+??????????" i32 0 i32 0 s16 "SMS TEXT HERE" Android Startup init (1) • Responsible for creating mounts and file permissions associated with mount • Reads initrc file which contains these directories, mounts and file permissions • Responsible for further starting other processes/daemons daemons (2) • Native linux daemons such as the following are started by init • • • • • • netd (manages network connections) vold (manages volumes such as sdcard) usbd (manages USB connections) debuggerd (debug processes - coredump) rild (manages communication with the radio) zygote zygote (3) • init launches zygote which loads classes and listen for requests to spawn new applications through an instance of a dalvik virtual machine • Utilises copy-on-write memory references when forking its process to reduce memory footprint Runtime/Service Manager (4a/b) • init starts android runtime process which initialises the Service Manager • Service Manager is the context manager for binder that is responsible for service registration and lookups • Android runtime then sends a start signal for zygote to create an instance of System Service (Android Services) dalvik (5) • Zygote has received a signal to instantiate a dalvik virtual machine instance for the Android System Server System Server (6) • Zygote forks itself with appropriate permissions and starts the System Server instance • Its role is to bootstrap all the android services required by the android framework which provide services to applications Native System Services (7) • Native System Services are services that integrate with the operating system to provide low latency and high availability services such as the audio and surface flinger • Audio Slinger provides audio management and multiplexing while Surface Flinger is the composition framework to display graphics Native System Services (7) continued • Native System Services register themselves with Service Manager allowing them to be available through IPC for other applications or processes Android System Services (8) • Android System Services provide high level framework services for applications • These services like Native System Services register themselves with Service Manager allowing for IPC communication from Android applications and other services Android Development • Android provides users familiar with Java an easy route to build mobile applications. Google provides a SDK and NDK which enable the developer to call upon rich libraries and tools. Software Development Kit (SDK) • The android Software development kit provides libraries and tools to develop standard java applications. Some of the tools allow for automatic installation of various android platforms and their associated libraries - eg. Ice Cream Sandwich. • Included in the ADT bundle is the SDK and an eclipse environment configured and setup for building/developing Android applications. Native Development Kit (NDK) • Android allows for native libraries to be used with the android environment. • These libraries are C/C++ based and give developers greater performance gains for intensive hardware operations. Repackaging howto: reverse engineering an application – open the apk archive to access smali$ apktool d com.hello out OR run dedexer (convert apk to jar archive) run a java decompiler or use jdgui http://java.decompiler.free.fr/?q=jdgui Insert the payload • Still have key signing issue • But users can be unaware of the dangers Reverse Engineering Links • http://a4apphack.com/security/sec-code/extract-androidapkfrom-market-and-decompile-it-to-java-source • http://marakana.com/s/post/1109/decompiling_an_android_ app • http://blog.apkudo.com/2012/10/16/reverseengineeringandroid-disassembling-hello-world/ Malicious App 1: SMS DEMO Malicious App 2: Photo/Sdcard DEMO Malicious App 3: Keyswift DEMO Reference: http://www.android-app-development.ie/blog/2013/03/06/insertingkeyloggercode-in-android-swiftkey-using-apktool/ Notes • These attacks were aimed at Samsung devices which have been known to implement their own sdk libraries for android. • These have not been tested as vigorously as would be liked and have been proven to provide further vulnerabilities. http://randomthoughts.greyhats.it/2013/03/owning-samsungphones-for-fun-but-with.html Permissions Concerns android.permission.SEND_SMS / RECEIVE_SMS android.permission.SYSTEM_ALERT_WINDOW android.permission.READ_CONTACTS / WRITE_CONTACTS android. permission.READ_CALENDAR / WRITE_CALENDAR android.permission.CALL_PHONE android.permission.READ_LOGS android.permission.ACCESS_FINE_LOCATION android.permission.GET_TASKS android.permission.RECEIVE_BOOT_COMPLETED android.permission.CHANGE_WIFI_STATE com.android.browser.permission.READ_HISTORY_BOOKMARKS / WRITE_HISTORY_BOOKMARKS Sourced from Google IO 2012 and marakana.com References • • • • Android: http://developer.android.com/index.html Google IO: https://sites.google.com/site/io/ Marakana: http://marakana.com/training/android/ Genome project http://www.malgenomeproject.org/ Questions?