Mobile Security Framework is an open source automated mobile application testing framework capable of static and dynamic analysis of Android and iOS apps. It performs various analyses including permission analysis, API monitoring, and HTTP traffic analysis. The framework supports analyzing APK, IPA, and source code. It is available on GitHub and includes demos of static analysis on sample APK and IPA files. The presentation also describes a mobile security CTF challenge involving two Android apps, GETSECRET and SENDSECRET, that can be solved by analyzing the apps with Mobile Security Framework or other reversing techniques.

1. G4H Webcast
Ajin Abraham
Automated Security Analysis of
Mobile Applications with Mobile
Security Framework.

2. Mobile Security Framework
Mobile Security Framework is an intelligent, all-
in-one open source mobile application
(Android/iOS) automated pen-testing
framework capable of performing static and
dynamic analysis.

3. Inputs
• Android, iOS binaries (APK, IPA)
• Android Zipped Source Code (eclipse, Android
Studio)
• iOS Zipped Source Code
• Android Binary - Static and Dynamic Analysis
• Android Source – Static Analysis
• iOS Binary and Source – Static Analysis
(TIZEN support, on it’s way)

4. Open Source Project
• Feel free to contribute:
• Source: https://github.com/ajinabraham/YSO-
Mobile-Security-Framework
• Issues: https://github.com/ajinabraham/YSO-
Mobile-Security-Framework/issues

5. Setting it Up
Android
• Python 2.7
• Django 1.8
• Oracle Java - JDK 1.7+
iOS
• Python 2.7
• Django 1.8
• Oracle Java - JDK 1.7+
• Mac

6. Static Analysis
• Android
– INFORMATION GATHERING
– DECOMPILE TO JAVA & SMALI
– PERMISSION ANALYSIS
– MANIFEST ANALYSIS
– JAVA CODE ANALYSIS
– ANDROID API INFO
– FILE ANALYSIS
– URLS, EMAIL, FILES, STRINGS, ANDROID
COMPONENTS
– REPORT GENERATION

7. DEMO
• Static Analysis of APK
• Static Analysis of Zipped Source Code

8. Static Analysis
• iOS - Binary
– BASIC INFORMATION
– BINARY ANALYSIS
– FILE ANALYSIS
– LIBRARIES
– FILES
– REPORT GENERATION
• iOS - Source
– BASIC INFORMATION
– CODE ANALYSIS
– iOS API INFORMATION
– FILE ANALYSIS
– URL, EMAIL, FILES, LIBRARIES
– REPORT GENERATION

9. DEMO
• Static Analysis of IPA Binary
• Static Analysis of Zipped Source Code

10. Dynamic Analyzer - Architecture
Dynamic Analyzer
AGENTS
Install and Run APK
HTTP(S) Proxy
Invoke Agents in VM
Results
HTTP(S) Traffic
Android VM
Application Data
Agent Collected Information
Start HTTP(S) Web Proxy

11. Dynamic Analysis
• SCREENSHOT
• HTTP(S) TRAFFIC
• LOGCAT and DUMPSYS
• DROIDMON API MONITOR
• DYNAMIC URLS and EMAILS
• DUMPED APPLICATION DATA
• FILE ANALYSIS ON APPLICATION DATA
• REPORT GENERATION
• UNDER DEVELOPMENT

12. DEMO
• Under Dev +
• Lot’s
• Hoping that things will work ! 

13. Interesting Facts
• Free and Open Source
• Support VM, and Rooted Phones with our agents
installed.
• Complete Mobile Application Security Testing
(Android, iOS and Tizen*).
• Reporting
Future Plans
- Pentesting Server Side components of Hybrid
Applications.
-Exploitation Module.

14. G4H Mobile Security CTF
GETSECRET.apk SENDSECRET.apk

15. G4H Mobile Security CTF
• CTF Entry point is GETSECRET, you need to capture
the secret send from SENDSECRET to GET Secret.
• Vulnerabilities.
SENDSECRET
Exported Activity
.ValidateAccess
Logical Vulnerability
Send secret to any application
with package name as
opensecurity.getsecret
and Activity name as GetFlag
GETSECRET
Hardcoded Password
LoginActivity
Exported Activities
AskSecret
GetFlag
Logging Sensitive Information
Logging the Secret

16. G4H - CTF- How to Solve
1. Reversing DexGuard, find the logic, reverse
the hardcoded secret to decrypt the AES
encrypted flag
2. Bypass Login of GETSECRET - Wait till the
Random no matches. -> SendSecret sends
the Secret. Collect the Secret form Log and
Enter it in GetFlag activity to get the Flag.
3. Easiest - Patch the APK and recompile it

17. Sorry
• Can’t cover Reversing DexGuard.
• Blog post removed!
• The license I have, deny reversing DexGuard
technology.

18. Thanks
• G4H Team
• Bharadwaj Machiraju
Contact:
@ajinabraham
ajin25@gmail.com
http://opensecurity.in