Inspection of Windows Phone applications

3,379 views
3,063 views

Published on

Published in: Technology
0 Comments
3 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
3,379
On SlideShare
0
From Embeds
0
Number of Embeds
5
Actions
Shares
0
Downloads
78
Comments
0
Likes
3
Embeds 0
No embeds

No notes for slide

Inspection of Windows Phone applications

  1. 1. Inspection of Windows Phone applicationsDmitriy EvdokimovAndrey Chasovskikh
  2. 2. About usDmitriy ‘D1g1’ Evdokimov - Security researcher at ERPScan - Editor of Russian hacking magazine - DEFCON Russia (DCG #7812) organizerAndrey Chasovskikh - Software developer - Windows Phone addict 2
  3. 3. Agenda- Windows Phone intro- Security model- All about applications- Not all applications are secure- Tools overview- Deep dive: finding vulnerabilities- Conclusion 3
  4. 4. WINDOWS PHONE INTRO
  5. 5. History of Windows Phone - The successor to the Windows Mobile OS - 15 Mar 2010 – Windows Phone 7 series announced - 21 Oct 2010 – Windows Phone 7 released - 29 Oct 2012 – Windows Phone 8 released WP7 WP7.5 Mango WP8 WP7 NoDo WP7.5 Tango version time21 Oct 2011 27 Sep 2011 29 Oct 2012 5
  6. 6. Market share Source: Gartner, November 2012 6
  7. 7. Windows Phone Store- 125 000+ applications- Casual apps, social networks, mobile banking, enterprise applications etc. 7
  8. 8. SECURITY MODEL
  9. 9. Chamber concept, WP7- Trusted Computing Base (TCB) Kernel, kernel-mode drivers- Elevated Rights Chamber (ERC) Services, user-mode drivers- Standard Rights Chamber (SRC) Pre-installed applications- Least Privileged Chamber (LPC) Applications from WP store 9
  10. 10. Chamber concept, WP8- Trusted Computing Base (TCB) Kernel, kernel-mode drivers- Least Privileged Chamber (LPC) All other software: services, pre-installed apps, application from WP store 10
  11. 11. Capabilities WMAppManifest.xml Windows Phone 7 Windows Phone 8 Undocumented- Camera - All WP7 capabilities - Native code- Contacts - NFC - SMS API- Location services - SD card access - Access to user- Owner/phone identity - Wallet properties- Network services - Speech recognition - SIM APIEtc. - Front camera Etc. Etc. 11
  12. 12. Sandboxing concept- No app communication in WP7- Limited app-to-app in WP8- File system structure is Isolated chamber Isolated chamberhidden App1 App2- Isolated storages Isolated storage Isolated storage for App1 for App2 12
  13. 13. App-to-App, WP8- File associations - LaunchFileAsync() - Reserved: xap, msi, bat, cmd, py, jar etc- URI associations - LaunchUriAsync() - Reserved: http, tel, wallet, LDAP, rlogin, telnet etc - Proximity communication using NFC 13
  14. 14. Isolated Storage Physical File Storage Isolated Storage Isolated Settings Storage Isolated File Storage Files Directory Database 14
  15. 15. Signing- Store applications are signed in WP7- All binaries get signed since WP8- Application file get signed - Kind of checksum file is put into applications- Applications XAP files have undocumented format (since Aug 2012) 15
  16. 16. ALL ABOUT APPLICATIONS
  17. 17. .NET and CLR, WP7 Applications Developer Platform (XAML, XNA, Device services).NET Compact Framework (BCL + Silverlight flavor) WP7 OS, WinCE based 17
  18. 18. Framework??? 18
  19. 19. .NET and CLR, WP8 ApplicationsDeveloper Platform (XAML, XNA, Device services) .NET Framework (CoreCLR) WP8 OS, Win8 based 19
  20. 20. Framework 20
  21. 21. Application file structure- Application assemblies- Resources- AppManifest.xaml- WMAppManifest.xml- WMInteropManifest.xml** — optional for WP7, absent in WP8 21
  22. 22. Submission and certification .xap XAP FileApp Creation App Submission Validation Source code Adding Metadata Publication in Certification Signing Marketplace Testing 22
  23. 23. Applications on a deviceWP7:Applications Install<ProductID>Install - Content from XAP - WMAppPRHeader.xml (package signature) Data<ProductID>DataIsolatedStorageSame idea in WP8, i.e. install path:C:DataPrograms<ProductID>Install 23
  24. 24. NOT ALL APPLICATIONS ARE SECURE
  25. 25. Security assessmentApp Server Data channelApp Device/Emulator 25
  26. 26. Mobile applications security assessmentPrepare environment - Get app (unpack/decrypt) - Configuration device/emulatorStatic analysis - Properties of program compilation - Metadata analysis - Code analysisDynamic analysis - How application works with file system/network - Runtime code analysis 26
  27. 27. OWASP Top 10 Mobile Risks1. Insecure Data Storage2. Weak Server Side Controls3. Insufficient Transport Layer Protection4. Client Side Injection5. Poor Authorization and Authentication6. Improper Session Handling7. Security Decisions Via Untrusted Inputs8. Side Channel Data Leakage9. Broken Cryptography10. Sensitive Information Disclosure 27
  28. 28. WP vs. Android vs. iOS vulnerabilities WP7 (C#/VB) iOS WP8 (C#/VB/C/C++) (Objective-C) Platform independent vulnerabilities Platform specific vulnerabilities Android (Java)Note: Main programming languages in brackets 28
  29. 29. TOOLS OVERVIEW
  30. 30. Arsenal- Device - Full unlock- Emulator- Windows Phone Device Manager- Network proxy: Burp Suite, Charles etc.- .NET tools: .Net Reflector, ILSpy etc.- IDA Pro- RAIN, Boyan Balkanski- Windows Phone App Analyzer, David Rook- XAPSpy, Behrang Fouladi - XapSpyAnalysis, David Rook 30
  31. 31. Main issueStatic analysis is insufficient.Lack of dynamic analysis tools: • IDE allows debugging with source code only • No programmable debugging interface • Managed code Solution: static byte code instrumentation. 31
  32. 32. Tangerine 32
  33. 33. Automates routine with XAP files- Unpacking- Removing application signature- Resigning assemblies- Packing- Deploying 33
  34. 34. Static analysis- Application info- Application capabilities- Code analysis - Code structure analysis - API usage analysis - View IL code 34
  35. 35. Dynamic analysis- Log application stack trace - Method names - Method parameters - Return values- Run custom code - On method enter - Replace method - On method exit - Change parameters values 35
  36. 36. DEEP DIVE: FINDING VULNERABILITIES
  37. 37. DEMO
  38. 38. How it works(1) Changing CIL code(2) Emulator console (writing/reading) Target Add Instrumented Resign and Emulator application hooks (1) application deploy Instrumented application Repeat Log data (2) Hooked Tangerine log Emulator console output (2) 38
  39. 39. CIL Instrumentation 39
  40. 40. Limitations- Emulator only- Does not help to overcome obfuscated code- Does not work with system assemblies- Applications from store need to be decrypted- Windows Phone 7 only 40
  41. 41. Cloud Compilation, WP8 CloudC# Source CIL MDIL MDIL Code C# Compiler Assembly Assembly Compiler Download Device Native Native Image MDIL Run DLL Assembly Generator 41
  42. 42. MDIL in workR0 = thisR1 = aR0 + 0x10 = j, where j is a field from base class 42
  43. 43. MDILDumphttp://github.com/WalkingCat/mdildump/ 43
  44. 44. Future work- Support Windows Phone 8 applications - MDIL instrumentation - Windows Phone RT- Add new features - Code graphical representation - Data flow analysis- Fix bugs ;) 44
  45. 45. CONCLUSION
  46. 46. Conclusion- Greater attack surface in WP8 - App-to-App - Applications that use native code - New technologies- Logical bugs never die 46
  47. 47. Thanks- Evgeny Bechkalo- DSecRG team 47
  48. 48. Q&ADmitry Evdokimov d.evdokimov@erpscan.com @evdokimovdsAndrey Chasovskikh http://andreycha.info @andreychaTangerine: http://github.com/andreycha/tangerine

×