SlideShare a Scribd company logo

Hide Android applications in images

•
•
Ange Albertini
Ange Albertini

by Axelle Apvrille & Ange Albertini presented at BlackHat Europe 2014, in Amsterdam PoC: https://github.com/cryptax/angeapk AngeCryption: http://corkami.googlecode.com/svn/trunk/src/angecryption/

Technology
1 of 42
Download to read offline
Hide Android Applications in Images Axelle Apvrille - FortiGuard Labs, Fortinet Ange Albertini, Corkami BlackHat Europe, Amsterdam, NH October 2014
What is this all about? Read the title! ;) BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
What is this all about? Read the title! ;) Hiding BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
What is this all about? Read the title! ;) Hiding Android Applications BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
What is this all about? Read the title! ;) Hiding Android Applications in ... BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
What is this all about? Read the title! ;) Hiding Android Applications in ... images BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
Who are we? Axelle axelle = { ‘‘realname’’ : ‘‘Axelle Apvrille’’, ‘‘job’’ : ‘‘Mobile/IoT Malware Analyst and Research’’, ‘‘company’’ : ‘‘Fortinet, FortiGuard Labs’’ } Ange ange = { ‘‘realname’’ : ‘‘Ange Albertini’’, ‘‘hobby’’ : ‘‘Corkami’’ } BlackHat Europe 2014 - A. Apvrille, A. Albertini 3/24
What is this? Nice? Thanks that’s GIMP art from me ;) BlackHat Europe 2014 - A. Apvrille, A. Albertini 4/24
It’s an image! file says... anakin.png: PNG image data, 636298042 x 1384184774, 19-bit PNG file format 89 50 4e 47 0d 0a 1a 0a 00 01 b4 40 61 61 61 61 |.PNG.......@a 25 ed 23 3a 52 80 fb c6 13 cc 54 4d 74 f5 78 87 |%.#:R.....TMt ba 7d b5 f6 93 63 43 f0 e0 b9 99 9b 37 06 cc 8f |.}...cC.....7 32 59 5b 55 da 14 e2 87 68 f7 89 e5 88 14 fe 76 |2Y[U....h.... 3e 0b cd 65 ec c4 7a 71 4d 95 c0 4e de 48 30 91 |>..e..zqM..N. ... BlackHat Europe 2014 - A. Apvrille, A. Albertini 5/24
It is more than that! AES Decrypt Valid PNG Valid Android Package (APK) BlackHat Europe 2014 - A. Apvrille, A. Albertini 6/24
Embed this “PNG” in an Android app? Imagine... ...if that PNG/APK is malicious! (Nearly) invisible to reverse engineering! The Android app is encrypted Arg! What will I see? A fat image The wrapping application Code that decrypts an asset Code that loads/installs an application But that depends how well the wrapping app is written It can be obfuscated... BlackHat Europe 2014 - A. Apvrille, A. Albertini 7/24
Demo Party time! Demo! Wake up! BlackHat Europe 2014 - A. Apvrille, A. Albertini 8/24
In case the demo crashes - lol The APK looks genuine Archive: PocActivity-debug.apk Length Date Time Name --------- ---------- ----- ---- 508720 2014-09-11 13:41 assets/anakin.png 1272 2014-09-11 14:03 res/layout/main.xml 1988 2014-09-11 14:03 AndroidManifest.xml 1444 2014-09-11 14:03 resources.arsc 7515 2014-09-11 14:03 res/drawable-hdpi/logo.png 2455 2014-09-11 14:03 res/drawable-ldpi/logo.png 4471 2014-09-11 14:03 res/drawable-mdpi/logo.png 8856 2014-09-11 14:03 classes.dex 634 2014-09-11 14:03 META-INF/MANIFEST.MF 687 2014-09-11 14:03 META-INF/CERT.SF 776 2014-09-11 14:03 META-INF/CERT.RSA --------- ------- 538818 11 files BlackHat Europe 2014 - A. Apvrille, A. Albertini 9/24
In case the demo crashes - lol The image looks genuine: assets/anakin.png BlackHat Europe 2014 - A. Apvrille, A. Albertini 10/24
In case the demo crashes - lol The image looks genuine: assets/anakin.png Perhaps a bit ’fat’ 508720 bytes (≈ 500K) for 382x385 pixels BlackHat Europe 2014 - A. Apvrille, A. Albertini 10/24
In case the demo crashes - lol adb install WrappingApk.apk BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
In case the demo crashes - lol BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
In case the demo crashes - lol We could use DexClassLoader to hide this BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
In case the demo crashes - lol We could use DexClassLoader to hide this BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
In case the demo crashes - lol We could use DexClassLoader to hide this BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
In case the demo crashes - lol Payload gets executed BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
How do we do that? 1. We write a payload APK BlackHat Europe 2014 - A. Apvrille, A. Albertini 12/24
How do we do that? 1. We write a payload APK 2. We encrypt it using AngeCryption: it looks like a valid PNG BlackHat Europe 2014 - A. Apvrille, A. Albertini 12/24
How do we do that? 1. We write a payload APK 2. We encrypt it using AngeCryption: it looks like a valid PNG 3. We hack it (a little) BlackHat Europe 2014 - A. Apvrille, A. Albertini 12/24
How do we do that? 1. We write a payload APK 2. We encrypt it using AngeCryption: it looks like a valid PNG 3. We hack it (a little) 4. We implement another APK containing the PNG BlackHat Europe 2014 - A. Apvrille, A. Albertini 12/24
Power: controlling encryption! Ciphertext Genuine PNG encrypt Plaintext Android Package (APK) Is this possible? BlackHat Europe 2014 - A. Apvrille, A. Albertini 13/24
AES encryption in practice key:’MySecretKey12345’ block:’a block of text.’ key:’MySecretKey12346’ block:’a block of text.’ key:’MySecretKey12345’ block:’a block of text!’ BlackHat Europe 2014 - A. Apvrille, A. Albertini 14/24
Can we control the output? With a tiny change in the key in the key or the block, the output block is completely different BlackHat Europe 2014 - A. Apvrille, A. Albertini 15/24
Can we control the output? With a tiny change in the key in the key or the block, the output block is completely different We can’t control the output The output block is (more or less) ’unpredictable’ BlackHat Europe 2014 - A. Apvrille, A. Albertini 15/24
Can we control the output? With a tiny change in the key in the key or the block, the output block is completely different We can’t control the output The output block is (more or less) ’unpredictable’ Yes, we can! But there’s a trick - AngeCryption BlackHat Europe 2014 - A. Apvrille, A. Albertini 15/24
Controlling AES with AngeCryption It will look the same ... but be slightly different The APK will look the same to Android The PNG will look the same to our eyes encrypt Android does not see the diff Manipulate Plaintext encrypt Your eye does not see the diff so that it encrypts to this PNG BlackHat Europe 2014 - A. Apvrille, A. Albertini 16/24
Trick no. 1: dummy PNG chunk Header: 0x89 PNG r n 0x1a n Chunk length Chunk Id Chunk data Chunk CRC32 BlackHat Europe 2014 - A. Apvrille, A. Albertini 17/24
Trick no. 1: dummy PNG chunk Header: 0x89 PNG r n 0x1a n Chunk length Chunk Id Chunk data Chunk CRC32 APK AES decrypt AES encrypt BlackHat Europe 2014 - A. Apvrille, A. Albertini 17/24
Trick no. 2: appended zip data Payload APK EOCD 1 AES−1( ... Anakin Skywalker ... ) EOCD 2 APK BlackHat Europe 2014 - A. Apvrille, A. Albertini 18/24
Crypto background AES is a block cipher It can only process a block of 16 bytes BlackHat Europe 2014 - A. Apvrille, A. Albertini 19/24
What if my plaintext is longer?! Chaining - 101 We use chaining We apply AES on block ... well, that’s for ECB (Electronic Code Book). Not very good. Other chainings CBC, CFB, OFB... (see FIPS 81) We’ll use CBC : Cipher Block Chaining BlackHat Europe 2014 - A. Apvrille, A. Albertini 20/24
Cipher Block Chaining (CBC) - 101 IV is Initialization Vector Trick no.3: controlling first block We have our plaintext P0 and ciphertext C0 We select a key K We compute IV: IV = AES−1 K (C0) ⊕ P0 BlackHat Europe 2014 - A. Apvrille, A. Albertini 21/24
Trick no.4: controlling other blocks Basically... obvious! Encrypting then decrypting is like doing nothing and reciprocally Want ciphertext to be bitmap of Anakin? Select plaintext = AES−1(bitmapofAnakin) AES(plaintext) = AES(AES−1(bitmapofAnakin)) = bitmap of Anakin BlackHat Europe 2014 - A. Apvrille, A. Albertini 22/24
Full picture Payload APK EOCD 1 Appended data = chunks for Anakin Dummy bytes so that size multiple of 16 EOCD 2 APK BlackHat Europe 2014 - A. Apvrille, A. Albertini 23/24
Full picture Payload APK EOCD 1 Appended data = chunks for Anakin Dummy bytes so that size multiple of 16 EOCD 2 APKPNG BlackHat Europe 2014 - A. Apvrille, A. Albertini 23/24
Full picture Payload APK EOCD 1 Appended data = chunks for Anakin Dummy bytes so that size multiple of 16 EOCD 2 APKPNG File Header Dummy chunk AES encrypt Chunk CRC 32 Chunk IHDR containing Anakin Skywalker Chunk(s) IDAT Chunk IEND AES(Dummy) AES(EOCD) Ignored BlackHat Europe 2014 - A. Apvrille, A. Albertini 23/24
Thank You ! Status Works on Android 4.4.2 June 2014: Android Security Team notified ≈ fixed Contact info Me: @cryptax or aapvrille at fortinet dot com Ange: @angealbertini or ange at corkami dot com References AngeCryption: http://corkami.googlecode.com/svn/trunk/src/angecryption/ Code: https://github.com/cryptax/angeapk - soon after conf’ Corkami: https://code.google.com/p/corkami/ Fortinet’s blog: http://blog.fortinet.com Thanks to : @veorq, Android Security Team BlackHat Europe 2014 - A. Apvrille, A. Albertini 24/24

Recommended

Windowsforensics
WindowsforensicsWindowsforensics
Windowsforensics
Santosh Khadsare
 
Security Analyst Workshop - 20200212
Security Analyst Workshop - 20200212Security Analyst Workshop - 20200212
Security Analyst Workshop - 20200212
Florian Roth
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensics
sdavis532
 
Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems
Cleverence Kombe
 
SCADA Security Presentation
SCADA Security PresentationSCADA Security Presentation
SCADA Security Presentation
Filip Maertens
 
Windows forensic
Windows forensicWindows forensic
Windows forensic
MD SAQUIB KHAN
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)
LJ PROJECTS
 

Recommended

Windowsforensics
WindowsforensicsWindowsforensics
Windowsforensics
Santosh Khadsare
 
Security Analyst Workshop - 20200212
Security Analyst Workshop - 20200212Security Analyst Workshop - 20200212
Security Analyst Workshop - 20200212
Florian Roth
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensics
sdavis532
 
Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems Intrusion Detection Systems and Intrusion Prevention Systems
Intrusion Detection Systems and Intrusion Prevention Systems
Cleverence Kombe
 
SCADA Security Presentation
SCADA Security PresentationSCADA Security Presentation
SCADA Security Presentation
Filip Maertens
 
Windows forensic
Windows forensicWindows forensic
Windows forensic
MD SAQUIB KHAN
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
Ben Boyd
 
Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)Computer Security and Intrusion Detection(IDS/IPS)
Computer Security and Intrusion Detection(IDS/IPS)
LJ PROJECTS
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for Beginners
SKMohamedKasim
 
CRYPTOGRAPHY & NETWORK SECURITY
CRYPTOGRAPHY & NETWORK SECURITYCRYPTOGRAPHY & NETWORK SECURITY
CRYPTOGRAPHY & NETWORK SECURITY
Jyothishmathi Institute of Technology and Science Karimnagar
 
Cryptanalysis and Attacks
Cryptanalysis and AttacksCryptanalysis and Attacks
Cryptanalysis and Attacks
Shahbaz Anjam
 
Create a software key logger
Create a software key logger Create a software key logger
Create a software key logger
GiralFaurel
 
Security in Cyber-Physical Systems
Security in Cyber-Physical SystemsSecurity in Cyber-Physical Systems
Security in Cyber-Physical Systems
Bob Marcus
 
Android Malware Detection Mechanisms
Android Malware Detection MechanismsAndroid Malware Detection Mechanisms
Android Malware Detection Mechanisms
Talha Kabakus
 
100+ Cyber Security Interview Questions and Answers in 2022
100+ Cyber Security Interview Questions and Answers in 2022100+ Cyber Security Interview Questions and Answers in 2022
100+ Cyber Security Interview Questions and Answers in 2022
Temok IT Services
 
Secure Code Warrior - CRLF injection
Secure Code Warrior - CRLF injectionSecure Code Warrior - CRLF injection
Secure Code Warrior - CRLF injection
Secure Code Warrior
 
Threat Hunting with Cyber Kill Chain
Threat Hunting with Cyber Kill ChainThreat Hunting with Cyber Kill Chain
Threat Hunting with Cyber Kill Chain
Suwitcha Musijaral CISSP,CISA,GWAPT,SNORTCP
 
CRYPTOGRAPHY AND NETWORK SECURITY
CRYPTOGRAPHY AND NETWORK SECURITYCRYPTOGRAPHY AND NETWORK SECURITY
CRYPTOGRAPHY AND NETWORK SECURITY
Kathirvel Ayyaswamy
 
Introduction to IDS & IPS - Part 1
Introduction to IDS & IPS - Part 1Introduction to IDS & IPS - Part 1
Introduction to IDS & IPS - Part 1
whitehat 'People'
 
SOCstock 2021 The Cloud-native SOC
SOCstock 2021 The Cloud-native SOC SOCstock 2021 The Cloud-native SOC
SOCstock 2021 The Cloud-native SOC
Anton Chuvakin
 
Maturity Model of Security Disciplines
Maturity Model of Security Disciplines Maturity Model of Security Disciplines
Maturity Model of Security Disciplines
Florian Roth
 
DDoS Attack Detection & Mitigation in SDN
DDoS Attack Detection & Mitigation in SDNDDoS Attack Detection & Mitigation in SDN
DDoS Attack Detection & Mitigation in SDN
Chao Chen
 
Intrusion Detection System
Intrusion Detection SystemIntrusion Detection System
Intrusion Detection System
Mohit Belwal
 
Adversary Emulation Workshop
Adversary Emulation WorkshopAdversary Emulation Workshop
Adversary Emulation Workshop
prithaaash
 
Threat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptxThreat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptx
Infosec
 
Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]
David Sweigert
 
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
Anton Chuvakin
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
Splunk
 
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
Aditya K Sood
 
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
viaForensics
 

More Related Content

What's hot

Create a software key logger
Create a software key logger Create a software key logger
Create a software key logger
GiralFaurel
 
Android Malware Detection Mechanisms
Android Malware Detection MechanismsAndroid Malware Detection Mechanisms
Android Malware Detection Mechanisms
Talha Kabakus
 
Threat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptxThreat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptx
Infosec
 

What's hot (20)

Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for Beginners
 
CRYPTOGRAPHY & NETWORK SECURITY
CRYPTOGRAPHY & NETWORK SECURITYCRYPTOGRAPHY & NETWORK SECURITY
CRYPTOGRAPHY & NETWORK SECURITY
 
Cryptanalysis and Attacks
Cryptanalysis and AttacksCryptanalysis and Attacks
Cryptanalysis and Attacks
 
Create a software key logger
Create a software key logger Create a software key logger
Create a software key logger
 
Security in Cyber-Physical Systems
Security in Cyber-Physical SystemsSecurity in Cyber-Physical Systems
Security in Cyber-Physical Systems
 
Android Malware Detection Mechanisms
Android Malware Detection MechanismsAndroid Malware Detection Mechanisms
Android Malware Detection Mechanisms
 
100+ Cyber Security Interview Questions and Answers in 2022
100+ Cyber Security Interview Questions and Answers in 2022100+ Cyber Security Interview Questions and Answers in 2022
100+ Cyber Security Interview Questions and Answers in 2022
 
Secure Code Warrior - CRLF injection
Secure Code Warrior - CRLF injectionSecure Code Warrior - CRLF injection
Secure Code Warrior - CRLF injection
 
Threat Hunting with Cyber Kill Chain
Threat Hunting with Cyber Kill ChainThreat Hunting with Cyber Kill Chain
Threat Hunting with Cyber Kill Chain
 
CRYPTOGRAPHY AND NETWORK SECURITY
CRYPTOGRAPHY AND NETWORK SECURITYCRYPTOGRAPHY AND NETWORK SECURITY
CRYPTOGRAPHY AND NETWORK SECURITY
 
Introduction to IDS & IPS - Part 1
Introduction to IDS & IPS - Part 1Introduction to IDS & IPS - Part 1
Introduction to IDS & IPS - Part 1
 
SOCstock 2021 The Cloud-native SOC
SOCstock 2021 The Cloud-native SOC SOCstock 2021 The Cloud-native SOC
SOCstock 2021 The Cloud-native SOC
 
Maturity Model of Security Disciplines
Maturity Model of Security Disciplines Maturity Model of Security Disciplines
Maturity Model of Security Disciplines
 
DDoS Attack Detection & Mitigation in SDN
DDoS Attack Detection & Mitigation in SDNDDoS Attack Detection & Mitigation in SDN
DDoS Attack Detection & Mitigation in SDN
 
Intrusion Detection System
Intrusion Detection SystemIntrusion Detection System
Intrusion Detection System
 
Adversary Emulation Workshop
Adversary Emulation WorkshopAdversary Emulation Workshop
Adversary Emulation Workshop
 
Threat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptxThreat hunting foundations: People, process and technology.pptx
Threat hunting foundations: People, process and technology.pptx
 
Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]Overview of the Cyber Kill Chain [TM]
Overview of the Cyber Kill Chain [TM]
 
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 

Viewers also liked

BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
Aditya K Sood
 
Cyber as WMD- April 2015- GFSU
Cyber as WMD- April 2015- GFSUCyber as WMD- April 2015- GFSU
Cyber as WMD- April 2015- GFSU
Mohit Rampal
 
ToorCon 14 : Malandroid : The Crux of Android Infections
ToorCon 14 : Malandroid : The Crux of Android InfectionsToorCon 14 : Malandroid : The Crux of Android Infections
ToorCon 14 : Malandroid : The Crux of Android Infections
Aditya K Sood
 
Via forensics thotcon-2013-mobile-security-with-santoku-linux
Via forensics thotcon-2013-mobile-security-with-santoku-linuxVia forensics thotcon-2013-mobile-security-with-santoku-linux
Via forensics thotcon-2013-mobile-security-with-santoku-linux
viaForensics
 
Cyber Security for Critical Infrastrucutre-ppt
Cyber Security for Critical Infrastrucutre-pptCyber Security for Critical Infrastrucutre-ppt
Cyber Security for Critical Infrastrucutre-ppt
Mohit Rampal
 
BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...
BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...
BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...
Aditya K Sood
 
Android– forensics and security testing
Android– forensics and security testingAndroid– forensics and security testing
Android– forensics and security testing
Santhosh Kumar
 

Viewers also liked (18)

BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
BlackHat Arsenal 2014 - C-SCAD : Assessing Security Flaws in C-SCAD WebX Clie...
 
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
Beginners guide-to-reverse-engineering-android-apps-pau-oliva-fora-viaforensi...
 
Cyber as WMD- April 2015- GFSU
Cyber as WMD- April 2015- GFSUCyber as WMD- April 2015- GFSU
Cyber as WMD- April 2015- GFSU
 
ToorCon 14 : Malandroid : The Crux of Android Infections
ToorCon 14 : Malandroid : The Crux of Android InfectionsToorCon 14 : Malandroid : The Crux of Android Infections
ToorCon 14 : Malandroid : The Crux of Android Infections
 
sebis research profile
sebis research profilesebis research profile
sebis research profile
 
BlackHat USA 2013 Arsenal - Sparty : A FrontPage and SharePoint Security Audi...
BlackHat USA 2013 Arsenal - Sparty : A FrontPage and SharePoint Security Audi...BlackHat USA 2013 Arsenal - Sparty : A FrontPage and SharePoint Security Audi...
BlackHat USA 2013 Arsenal - Sparty : A FrontPage and SharePoint Security Audi...
 
Mobile analysis-kung-fu-santoku-style-viaforensics-rsa-conference-2014
Mobile analysis-kung-fu-santoku-style-viaforensics-rsa-conference-2014Mobile analysis-kung-fu-santoku-style-viaforensics-rsa-conference-2014
Mobile analysis-kung-fu-santoku-style-viaforensics-rsa-conference-2014
 
Via forensics thotcon-2013-mobile-security-with-santoku-linux
Via forensics thotcon-2013-mobile-security-with-santoku-linuxVia forensics thotcon-2013-mobile-security-with-santoku-linux
Via forensics thotcon-2013-mobile-security-with-santoku-linux
 
One Phish, Two Phish, Red Phish, Your Account Details Just Got Stolen
One Phish, Two Phish, Red Phish, Your Account Details Just Got StolenOne Phish, Two Phish, Red Phish, Your Account Details Just Got Stolen
One Phish, Two Phish, Red Phish, Your Account Details Just Got Stolen
 
Cyber Security for Critical Infrastrucutre-ppt
Cyber Security for Critical Infrastrucutre-pptCyber Security for Critical Infrastrucutre-ppt
Cyber Security for Critical Infrastrucutre-ppt
 
Blackhat USA 2015: BGP Stream Presentation
Blackhat USA 2015: BGP Stream PresentationBlackhat USA 2015: BGP Stream Presentation
Blackhat USA 2015: BGP Stream Presentation
 
M.Tech. Cyber Security & Incident Response
M.Tech. Cyber Security & Incident ResponseM.Tech. Cyber Security & Incident Response
M.Tech. Cyber Security & Incident Response
 
Shodan- That Device Search Engine
Shodan- That Device Search EngineShodan- That Device Search Engine
Shodan- That Device Search Engine
 
APT 28 :Cyber Espionage and the Russian Government?
APT 28 :Cyber Espionage and the Russian Government?APT 28 :Cyber Espionage and the Russian Government?
APT 28 :Cyber Espionage and the Russian Government?
 
BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...
BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...
BlackHat 2014 Briefings - Exploiting Fundamental Weaknesses in Botnet C&C Pan...
 
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
 
Android– forensics and security testing
Android– forensics and security testingAndroid– forensics and security testing
Android– forensics and security testing
 
Social Media at NASA, 2012 Edition
Social Media at NASA, 2012 EditionSocial Media at NASA, 2012 Edition
Social Media at NASA, 2012 Edition
 

More from Ange Albertini

Beyond your studies
Beyond your studiesBeyond your studies
Beyond your studies
Ange Albertini
 

More from Ange Albertini (20)

Technical challenges with file formats
Technical challenges with file formatsTechnical challenges with file formats
Technical challenges with file formats
 
Relations between archive formats
Relations between archive formatsRelations between archive formats
Relations between archive formats
 
Abusing archive file formats
Abusing archive file formatsAbusing archive file formats
Abusing archive file formats
 
TimeCryption
TimeCryptionTimeCryption
TimeCryption
 
You are *not* an idiot
You are *not* an idiotYou are *not* an idiot
You are *not* an idiot
 
Improving file formats
Improving file formatsImproving file formats
Improving file formats
 
KILL MD5
KILL MD5KILL MD5
KILL MD5
 
No more dumb hex!
No more dumb hex!No more dumb hex!
No more dumb hex!
 
Beyond your studies
Beyond your studiesBeyond your studies
Beyond your studies
 
An introduction to inkscape
An introduction to inkscapeAn introduction to inkscape
An introduction to inkscape
 
The challenges of file formats
The challenges of file formatsThe challenges of file formats
The challenges of file formats
 
Exploiting hash collisions
Exploiting hash collisionsExploiting hash collisions
Exploiting hash collisions
 
Infosec & failures
Infosec & failuresInfosec & failures
Infosec & failures
 
Connecting communities
Connecting communitiesConnecting communities
Connecting communities
 
TASBot - the perfectionist
TASBot - the perfectionistTASBot - the perfectionist
TASBot - the perfectionist
 
Caring for file formats
Caring for file formatsCaring for file formats
Caring for file formats
 
Hacks in video games
Hacks in video gamesHacks in video games
Hacks in video games
 
Trusting files (and their formats)
Trusting files (and their formats)Trusting files (and their formats)
Trusting files (and their formats)
 
Let's write a PDF file
Let's write a PDF fileLet's write a PDF file
Let's write a PDF file
 
PDF: myths vs facts
PDF: myths vs factsPDF: myths vs facts
PDF: myths vs facts
 

Recently uploaded

Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
WSO2
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
Igalia
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
panagenda
 

Recently uploaded (20)

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
A Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source MilvusA Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source Milvus
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot ModelNavi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
 

Hide Android applications in images

  • 1. Hide Android Applications in Images Axelle Apvrille - FortiGuard Labs, Fortinet Ange Albertini, Corkami BlackHat Europe, Amsterdam, NH October 2014
  • 2. What is this all about? Read the title! ;) BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
  • 3. What is this all about? Read the title! ;) Hiding BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
  • 4. What is this all about? Read the title! ;) Hiding Android Applications BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
  • 5. What is this all about? Read the title! ;) Hiding Android Applications in ... BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
  • 6. What is this all about? Read the title! ;) Hiding Android Applications in ... images BlackHat Europe 2014 - A. Apvrille, A. Albertini 2/24
  • 7. Who are we? Axelle axelle = { ‘‘realname’’ : ‘‘Axelle Apvrille’’, ‘‘job’’ : ‘‘Mobile/IoT Malware Analyst and Research’’, ‘‘company’’ : ‘‘Fortinet, FortiGuard Labs’’ } Ange ange = { ‘‘realname’’ : ‘‘Ange Albertini’’, ‘‘hobby’’ : ‘‘Corkami’’ } BlackHat Europe 2014 - A. Apvrille, A. Albertini 3/24
  • 8. What is this? Nice? Thanks that’s GIMP art from me ;) BlackHat Europe 2014 - A. Apvrille, A. Albertini 4/24
  • 9. It’s an image! file says... anakin.png: PNG image data, 636298042 x 1384184774, 19-bit PNG file format 89 50 4e 47 0d 0a 1a 0a 00 01 b4 40 61 61 61 61 |.PNG.......@a 25 ed 23 3a 52 80 fb c6 13 cc 54 4d 74 f5 78 87 |%.#:R.....TMt ba 7d b5 f6 93 63 43 f0 e0 b9 99 9b 37 06 cc 8f |.}...cC.....7 32 59 5b 55 da 14 e2 87 68 f7 89 e5 88 14 fe 76 |2Y[U....h.... 3e 0b cd 65 ec c4 7a 71 4d 95 c0 4e de 48 30 91 |>..e..zqM..N. ... BlackHat Europe 2014 - A. Apvrille, A. Albertini 5/24
  • 10. It is more than that! AES Decrypt Valid PNG Valid Android Package (APK) BlackHat Europe 2014 - A. Apvrille, A. Albertini 6/24
  • 11. Embed this “PNG” in an Android app? Imagine... ...if that PNG/APK is malicious! (Nearly) invisible to reverse engineering! The Android app is encrypted Arg! What will I see? A fat image The wrapping application Code that decrypts an asset Code that loads/installs an application But that depends how well the wrapping app is written It can be obfuscated... BlackHat Europe 2014 - A. Apvrille, A. Albertini 7/24
  • 12. Demo Party time! Demo! Wake up! BlackHat Europe 2014 - A. Apvrille, A. Albertini 8/24
  • 13. In case the demo crashes - lol The APK looks genuine Archive: PocActivity-debug.apk Length Date Time Name --------- ---------- ----- ---- 508720 2014-09-11 13:41 assets/anakin.png 1272 2014-09-11 14:03 res/layout/main.xml 1988 2014-09-11 14:03 AndroidManifest.xml 1444 2014-09-11 14:03 resources.arsc 7515 2014-09-11 14:03 res/drawable-hdpi/logo.png 2455 2014-09-11 14:03 res/drawable-ldpi/logo.png 4471 2014-09-11 14:03 res/drawable-mdpi/logo.png 8856 2014-09-11 14:03 classes.dex 634 2014-09-11 14:03 META-INF/MANIFEST.MF 687 2014-09-11 14:03 META-INF/CERT.SF 776 2014-09-11 14:03 META-INF/CERT.RSA --------- ------- 538818 11 files BlackHat Europe 2014 - A. Apvrille, A. Albertini 9/24
  • 14. In case the demo crashes - lol The image looks genuine: assets/anakin.png BlackHat Europe 2014 - A. Apvrille, A. Albertini 10/24
  • 15. In case the demo crashes - lol The image looks genuine: assets/anakin.png Perhaps a bit ’fat’ 508720 bytes (≈ 500K) for 382x385 pixels BlackHat Europe 2014 - A. Apvrille, A. Albertini 10/24
  • 16. In case the demo crashes - lol adb install WrappingApk.apk BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
  • 17. In case the demo crashes - lol BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
  • 18. In case the demo crashes - lol We could use DexClassLoader to hide this BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
  • 19. In case the demo crashes - lol We could use DexClassLoader to hide this BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
  • 20. In case the demo crashes - lol We could use DexClassLoader to hide this BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
  • 21. In case the demo crashes - lol Payload gets executed BlackHat Europe 2014 - A. Apvrille, A. Albertini 11/24
  • 22. How do we do that? 1. We write a payload APK BlackHat Europe 2014 - A. Apvrille, A. Albertini 12/24
  • 23. How do we do that? 1. We write a payload APK 2. We encrypt it using AngeCryption: it looks like a valid PNG BlackHat Europe 2014 - A. Apvrille, A. Albertini 12/24
  • 24. How do we do that? 1. We write a payload APK 2. We encrypt it using AngeCryption: it looks like a valid PNG 3. We hack it (a little) BlackHat Europe 2014 - A. Apvrille, A. Albertini 12/24
  • 25. How do we do that? 1. We write a payload APK 2. We encrypt it using AngeCryption: it looks like a valid PNG 3. We hack it (a little) 4. We implement another APK containing the PNG BlackHat Europe 2014 - A. Apvrille, A. Albertini 12/24
  • 26. Power: controlling encryption! Ciphertext Genuine PNG encrypt Plaintext Android Package (APK) Is this possible? BlackHat Europe 2014 - A. Apvrille, A. Albertini 13/24
  • 27. AES encryption in practice key:’MySecretKey12345’ block:’a block of text.’ key:’MySecretKey12346’ block:’a block of text.’ key:’MySecretKey12345’ block:’a block of text!’ BlackHat Europe 2014 - A. Apvrille, A. Albertini 14/24
  • 28. Can we control the output? With a tiny change in the key in the key or the block, the output block is completely different BlackHat Europe 2014 - A. Apvrille, A. Albertini 15/24
  • 29. Can we control the output? With a tiny change in the key in the key or the block, the output block is completely different We can’t control the output The output block is (more or less) ’unpredictable’ BlackHat Europe 2014 - A. Apvrille, A. Albertini 15/24
  • 30. Can we control the output? With a tiny change in the key in the key or the block, the output block is completely different We can’t control the output The output block is (more or less) ’unpredictable’ Yes, we can! But there’s a trick - AngeCryption BlackHat Europe 2014 - A. Apvrille, A. Albertini 15/24
  • 31. Controlling AES with AngeCryption It will look the same ... but be slightly different The APK will look the same to Android The PNG will look the same to our eyes encrypt Android does not see the diff Manipulate Plaintext encrypt Your eye does not see the diff so that it encrypts to this PNG BlackHat Europe 2014 - A. Apvrille, A. Albertini 16/24
  • 32. Trick no. 1: dummy PNG chunk Header: 0x89 PNG r n 0x1a n Chunk length Chunk Id Chunk data Chunk CRC32 BlackHat Europe 2014 - A. Apvrille, A. Albertini 17/24
  • 33. Trick no. 1: dummy PNG chunk Header: 0x89 PNG r n 0x1a n Chunk length Chunk Id Chunk data Chunk CRC32 APK AES decrypt AES encrypt BlackHat Europe 2014 - A. Apvrille, A. Albertini 17/24
  • 34. Trick no. 2: appended zip data Payload APK EOCD 1 AES−1( ... Anakin Skywalker ... ) EOCD 2 APK BlackHat Europe 2014 - A. Apvrille, A. Albertini 18/24
  • 35. Crypto background AES is a block cipher It can only process a block of 16 bytes BlackHat Europe 2014 - A. Apvrille, A. Albertini 19/24
  • 36. What if my plaintext is longer?! Chaining - 101 We use chaining We apply AES on block ... well, that’s for ECB (Electronic Code Book). Not very good. Other chainings CBC, CFB, OFB... (see FIPS 81) We’ll use CBC : Cipher Block Chaining BlackHat Europe 2014 - A. Apvrille, A. Albertini 20/24
  • 37. Cipher Block Chaining (CBC) - 101 IV is Initialization Vector Trick no.3: controlling first block We have our plaintext P0 and ciphertext C0 We select a key K We compute IV: IV = AES−1 K (C0) ⊕ P0 BlackHat Europe 2014 - A. Apvrille, A. Albertini 21/24
  • 38. Trick no.4: controlling other blocks Basically... obvious! Encrypting then decrypting is like doing nothing and reciprocally Want ciphertext to be bitmap of Anakin? Select plaintext = AES−1(bitmapofAnakin) AES(plaintext) = AES(AES−1(bitmapofAnakin)) = bitmap of Anakin BlackHat Europe 2014 - A. Apvrille, A. Albertini 22/24
  • 39. Full picture Payload APK EOCD 1 Appended data = chunks for Anakin Dummy bytes so that size multiple of 16 EOCD 2 APK BlackHat Europe 2014 - A. Apvrille, A. Albertini 23/24
  • 40. Full picture Payload APK EOCD 1 Appended data = chunks for Anakin Dummy bytes so that size multiple of 16 EOCD 2 APKPNG BlackHat Europe 2014 - A. Apvrille, A. Albertini 23/24
  • 41. Full picture Payload APK EOCD 1 Appended data = chunks for Anakin Dummy bytes so that size multiple of 16 EOCD 2 APKPNG File Header Dummy chunk AES encrypt Chunk CRC 32 Chunk IHDR containing Anakin Skywalker Chunk(s) IDAT Chunk IEND AES(Dummy) AES(EOCD) Ignored BlackHat Europe 2014 - A. Apvrille, A. Albertini 23/24
  • 42. Thank You ! Status Works on Android 4.4.2 June 2014: Android Security Team notified ≈ fixed Contact info Me: @cryptax or aapvrille at fortinet dot com Ange: @angealbertini or ange at corkami dot com References AngeCryption: http://corkami.googlecode.com/svn/trunk/src/angecryption/ Code: https://github.com/cryptax/angeapk - soon after conf’ Corkami: https://code.google.com/p/corkami/ Fortinet’s blog: http://blog.fortinet.com Thanks to : @veorq, Android Security Team BlackHat Europe 2014 - A. Apvrille, A. Albertini 24/24