1 / 34

Android Malware in Practice

Android Malware in Practice. Part I. Android Filesystem Layout. visitor@UOA283090 ~ $ adb shell mount rootfs / rootfs ro,relatime 0 0 tmpfs / dev tmpfs rw,nosuid,relatime,mode =755 0 0 devpts / dev / pts devpts rw,relatime,mode =600 0 0 proc / proc proc rw,relatime 0 0

tuwa
Download Presentation

Android Malware in Practice

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Android Malwarein Practice Part I

  2. Android Filesystem Layout visitor@UOA283090 ~ $ adb shell mount rootfs / rootfsro,relatime 0 0 tmpfs /devtmpfsrw,nosuid,relatime,mode=755 0 0 devpts /dev/ptsdevptsrw,relatime,mode=600 0 0 proc /procprocrw,relatime 0 0 sysfs /sys sysfsrw,relatime 0 0 none /acct cgrouprw,relatime,cpuacct 0 0 tmpfs /mnt/asectmpfsrw,relatime,mode=755,gid=1000 0 0 tmpfs /mnt/obbtmpfsrw,relatime,mode=755,gid=1000 0 0 none /dev/cpuctlcgrouprw,relatime,cpu 0 0 /dev/block/mmcblk0p9 /system ext4 ro,noatime,barrier=1,data=ordered 0 0 /dev/block/mmcblk0p12 /data ext4 rw,nosuid,nodev,noatime,barrier=1,journal_async_commit, data=ordered,noauto_da_alloc,discard 0 0 /dev/block/mmcblk0p8 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,journal_async_commit, data=ordered 0 0 /dev/block/mmcblk0p3 /efsext4 rw,nosuid,nodev,noatime,barrier=1,journal_async_commit, data=ordered 0 0 /sys/kernel/debug /sys/kernel/debug debugfsrw,relatime 0 0 /dev/fuse /mnt/sdcardfuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,.... /dev/block/vold/179:17 /mnt/extSdCardvfatrw,dirsync,nosuid,nodev,noexec,noatime,nodiratime, uid=1000,gid=1023,...

  3. Android Filesystem Layout The mounts of interest / - root of the filesystemhierarchy /system - the ROM that holds all system binaries /data - RW location for user applications /cache - transient data space for user applications /efs - phone specific information like IMEI number /mnt/sdcard - fat32 filesystem with no inbuilt security

  4. Application locations • System applications • /system/app/<AppName>.apk • User applications • /data/app/<AppName>.apk (preloaded) • /data/app/<AppPkgName>-1.apk (downloaded) • /mnt/secure/asec/<AppPkgName>-1.apk (sdcard)

  5. App Signing • All apps are signed with a key to provide android with the ability to distinguish distributors of software • Possible to group applications in the same security context when two applications are signed with same key giving identical digital signature

  6. Android Debug Bridge • Android Debug Bridge allows the developer access to the Android device connected via usb or IP • Once connected to a device, ADB provides developers an interface to interact with a rich suite of tools to manage the device

  7. ADB Push / Pull • Using ADB we are able to transfer files from/to the device • Pull test.txt off the device and place in pwd • adbpull /mnt/sdcard/test.txt [local location] • Push local test.txt to sdcard on the device • adbpush ./test.txt /mnt/sdcard

  8. Android Manual Install • Manually install application • adbpush com.myapp.hello.apk /data/app/ • (Permissions need to be changed to 0644) • adbinstall com.myapp.hello.apk • Manually uninstall application • adbuninstall com.myapp.hello

  9. Package Manager • pm is a tool that is provided to manage and provide details about applications and permissions. • List all applications • pm list packages • Find location of an application • pm path com.myapp.helloworld • List available permissions • pm list permissions -f

  10. Activity Manager:Sending Intents • The activity manager provides the mechanism to start an instance of a graphic application • using adb we are able to start applications via • am start -a android.intent.action.CALL -d tel: 021021021

  11. Service Manager • The service manager can also be invoked via command line to send messages • service call isms 5 s16 "+??????????" i32 0 i32 0 s16 "SMS TEXT HERE"

  12. Android Startup

  13. init (1) • Responsible for creating mounts and file permissions associated with mount • Reads initrc file which contains these directories, mounts and file permissions • Responsible for further starting other processes/daemons

  14. daemons (2) • Native linux daemons such as the following are started by init • netd(manages network connections) • vold(manages volumes such as sdcard) • usbd(manages USB connections) • debuggerd(debug processes - coredump) • rild(manages communication with the radio) • zygote

  15. zygote (3) • init launches zygote which loads classes and listen for requests to spawn new applications through an instance of a dalvik virtual machine • Utilises copy-on-write memory references when forking its process to reduce memory footprint

  16. Runtime/Service Manager (4a/b) • init starts android runtime process which initialisesthe Service Manager • Service Manager is the context manager for binder that is responsible for service registration and lookups • Android runtime then sends a start signal for zygote to create an instance of System Service (Android Services)

  17. dalvik (5) • Zygote has received a signal to instantiate a dalvikvirtual machine instance for the Android System Server

  18. System Server (6) • Zygote forks itself with appropriate permissions and starts the System Server instance • Its role is to bootstrap all the android services required by the android framework which provide services to applications

  19. Native System Services (7) • Native System Services are services that integrate with the operating system to provide low latency and high availability services such as the audio and surface flinger • Audio Slinger provides audio management and multiplexing while Surface Flinger is the composition framework to display graphics

  20. Native System Services (7) continued • Native System Services register themselves with Service Manager allowing them to be available through IPC for other applications or processes

  21. Android System Services (8) • Android System Services provide high level framework services for applications • These services like Native System Services register themselves with Service Manager allowing for IPC communication from Android applications and other services

  22. Android Development • Android provides users familiar with Java an easy route to build mobile applications. Google provides a SDK and NDK which enable the developer to call upon rich libraries and tools.

  23. Software Development Kit (SDK) • The android Software development kit provides libraries and tools to develop standard java applications. Some of the tools allow for automatic installation of various android platforms and their associated libraries - eg. Ice Cream Sandwich. • Included in the ADT bundle is the SDK and an eclipse environment configured and setup for building/developing Android applications.

  24. Native Development Kit (NDK) • Android allows for native libraries to be used with the android environment. • These libraries are C/C++ based and give developers greater performance gains for intensive hardware operations.

  25. Repackaging howto: reverse engineering an application – open the apk archive to access smali- $ apktool d com.helloout OR run dedexer (convert apk to jar archive) run a java decompiler or use jdgui http://java.decompiler.free.fr/?q=jdgui

  26. Insert the payload • Still have key signing issue • But users can be unaware of the dangers

  27. Reverse Engineering Links • http://a4apphack.com/security/sec-code/extract-androidapk-from-market-and-decompile-it-to-java-source • http://marakana.com/s/post/1109/decompiling_an_android_app • http://blog.apkudo.com/2012/10/16/reverse-engineeringandroid-disassembling-hello-world/

  28. Malicious App 1: SMS DEMO

  29. Malicious App 2: Photo/Sdcard DEMO

  30. Malicious App 3: Keyswift DEMO Reference: http://www.android-app-development.ie/blog/2013/03/06/inserting-keyloggercode-in-android-swiftkey-using-apktool/

  31. Notes • These attacks were aimed at Samsung devices which have been known to implement their own sdklibraries for android. • These have not been tested as vigorously as would be liked and have been proven to provide further vulnerabilities. http://randomthoughts.greyhats.it/2013/03/owning-samsung-phones-for-fun-but-with.html

  32. Permissions Concerns android.permission.SEND_SMS / RECEIVE_SMS android.permission.SYSTEM_ALERT_WINDOW android.permission.READ_CONTACTS / WRITE_CONTACTS android. permission.READ_CALENDAR / WRITE_CALENDAR android.permission.CALL_PHONE android.permission.READ_LOGS android.permission.ACCESS_FINE_LOCATION android.permission.GET_TASKS android.permission.RECEIVE_BOOT_COMPLETED android.permission.CHANGE_WIFI_STATE com.android.browser.permission.READ_HISTORY_BOOKMARKS / WRITE_HISTORY_BOOKMARKS Sourced from Google IO 2012 and marakana.com

  33. References • Android: http://developer.android.com/index.html • Google IO: https://sites.google.com/site/io/ • Marakana: http://marakana.com/training/android/ • Genome project http://www.malgenomeproject.org/

  34. Questions?

More Related