Stealing Sensitive Data from Android Phones - The Hacker Way
-SRINIVAS
cnuhackz@gmail.com
Who Am I ???
• An Independent Security Researcher
• Security Consultant at Tata Consultancy Services
• Introduction to Android
• Android Architecture
• Android Internals
• Android Security Model
• Reverse Engineering
• Writ...
Why Android???
Android Market Share 2013
http://www.onbile.com/info/us-android-market-share/
ANDROID PLATFORM BASICS
Android is a software stack for mobile devices that includes an operating system,
middleware and key applications.
Develop...
Android was engineered from the beginning to be online.
Ability for users to extend the functionality of the device.
Abili...
Android Internals
Android platform is based on Linux technology.
Uses java Programming language
No monopoly status - Allow...
Android Architecture
Dalvik Virtual Machine
Register based
Interpreter only virtual machine.
The Dalvik VM executes files in the Dalvik Executa...
ANDROID APP BASICS
Android App will have an extension .apk
It’s nothing but a zip file.
Can be extracted using winrar, winzip etc.
Android Ap...
META-INF
res
AndroidManifest.xml
Classes.dex
Resources.arsc
App illustrated – User Perspective
Activity
Intents
Content Providers
Service
Broadcast Receivers
App illustrated – Developer Perspective
DEMO
ANDROID PLATFORM SECURITY
 Mandatory application sandbox for all applications
 Application-defined and user-granted permissions
 Robust security ...
Dalvik Virtual Machine
Every Android application runs in its own process.
The UID will typically be something like app_XX
...
 Declared in AndroidManifest.xml
 XML file contains all the components and permissions
 Binary XML formatted text. We c...
Attacking Android Devices
-The known ways
Exploitation1
 Find your target Device
 Check for exploits
 Exploit it
Malwares2
 DroidDream.
 Geinimi - Android malware with botnet-like capabilities.
 Trojan-SMS for Android FakePlayer.
 iCalendar ...
1. Reverse Engineering
2. Build from Scratch
Building Android Malwares
Legitimate developer
1 2
34
5
Hacker
Android Market
Third party market
User
1. Reverse Engineering
6
java
Byte code
Dalvik Code
.apk
.java
.class
.dex
javac
dx
Reverse Engineering
Tools
APK Tool – Smali files
Dex2jar, jdGUI...
DEMO
Hacker Market place
2. Develop from Scratch
Can Spy on SMS, CallLogs, Contacts, IMEI, Current Location, Browser History etc.
Implemented with Broadcast Receivers.
...
DEMO
DISCUSSION
[1] www.thenounproject.com
[2] http://mekeel.org
[3] http://www.gfi.com
[4] http://www.theverge.com
[5] http://www.google....
Greetzz!
Imran Mohammed
Sai Satish
Null HyderabadTeam
Sri. Sagi ManiRaju
Upcoming SlideShare
Loading in...5
×

Stealing sensitive data from android phones the hacker way

7,448

Published on

null Hyderabad Chapter - August 2013 Meet

Published in: Education, Technology
0 Comments
4 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
7,448
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
193
Comments
0
Likes
4
Embeds 0
No embeds

No notes for slide

Stealing sensitive data from android phones the hacker way

  1. 1. Stealing Sensitive Data from Android Phones - The Hacker Way -SRINIVAS cnuhackz@gmail.com
  2. 2. Who Am I ??? • An Independent Security Researcher • Security Consultant at Tata Consultancy Services
  3. 3. • Introduction to Android • Android Architecture • Android Internals • Android Security Model • Reverse Engineering • Writing Android Malwares • Demos • Discussion Agenda
  4. 4. Why Android???
  5. 5. Android Market Share 2013 http://www.onbile.com/info/us-android-market-share/
  6. 6. ANDROID PLATFORM BASICS
  7. 7. Android is a software stack for mobile devices that includes an operating system, middleware and key applications. Developed by Google and Open Handset Alliance What is Android?
  8. 8. Android was engineered from the beginning to be online. Ability for users to extend the functionality of the device. Ability for users to store their data on the devices. Core Features
  9. 9. Android Internals Android platform is based on Linux technology. Uses java Programming language No monopoly status - Allows anyone to develop own applications. Good news for Hackers 
  10. 10. Android Architecture
  11. 11. Dalvik Virtual Machine Register based Interpreter only virtual machine. The Dalvik VM executes files in the Dalvik Executable (.dex) format which is optimized for minimal memory. The VM is register-based, and runs classes compiled by a Java language compiler that have been transformed into the .dex format by the included “dx” tool. java Byte code Dalvik Code Dalvik VM .java .class .dex javac dx
  12. 12. ANDROID APP BASICS
  13. 13. Android App will have an extension .apk It’s nothing but a zip file. Can be extracted using winrar, winzip etc. Android App Basics
  14. 14. META-INF res AndroidManifest.xml Classes.dex Resources.arsc App illustrated – User Perspective
  15. 15. Activity Intents Content Providers Service Broadcast Receivers App illustrated – Developer Perspective
  16. 16. DEMO
  17. 17. ANDROID PLATFORM SECURITY
  18. 18.  Mandatory application sandbox for all applications  Application-defined and user-granted permissions  Robust security at the OS level through the Linux kernel  Secure inter process communication  Application signing Android Platform Security
  19. 19. Dalvik Virtual Machine Every Android application runs in its own process. The UID will typically be something like app_XX Runs with its own instance of the Dalvik virtual machine. UID 1000 Dalvik VM App 1 UID 1001 Dalvik VM App 2 UID 1002 Dalvik VM App 3 UID 1003 Dalvik VM App 4
  20. 20.  Declared in AndroidManifest.xml  XML file contains all the components and permissions  Binary XML formatted text. We cant read directly.  An App can only use the declared permissions (Theory  ) Android Permission Model
  21. 21. Attacking Android Devices -The known ways
  22. 22. Exploitation1
  23. 23.  Find your target Device  Check for exploits  Exploit it
  24. 24. Malwares2
  25. 25.  DroidDream.  Geinimi - Android malware with botnet-like capabilities.  Trojan-SMS for Android FakePlayer.  iCalendar acbcad45094de7e877b656db1c28ada2.  SMS_Replicator_Secret.apk. http://contagiodump.blogspot.in/ Some Popular Android Malwares
  26. 26. 1. Reverse Engineering 2. Build from Scratch Building Android Malwares
  27. 27. Legitimate developer 1 2 34 5 Hacker Android Market Third party market User 1. Reverse Engineering 6
  28. 28. java Byte code Dalvik Code .apk .java .class .dex javac dx Reverse Engineering Tools APK Tool – Smali files Dex2jar, jdGUI – java files
  29. 29. DEMO
  30. 30. Hacker Market place 2. Develop from Scratch
  31. 31. Can Spy on SMS, CallLogs, Contacts, IMEI, Current Location, Browser History etc. Implemented with Broadcast Receivers. Doesn’t make noise – because, it’s a service. Uploads everything to a remote server if internet is available on the device. Will store them as text file onto SDcard if Internet is not available. My Own Android Malware
  32. 32. DEMO
  33. 33. DISCUSSION
  34. 34. [1] www.thenounproject.com [2] http://mekeel.org [3] http://www.gfi.com [4] http://www.theverge.com [5] http://www.google.com Image Credits
  35. 35. Greetzz! Imran Mohammed Sai Satish Null HyderabadTeam Sri. Sagi ManiRaju
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×