2024_hackersuli_mobil_ios_android ______

SECURITY ISSUES IN MOBILE
APPLICATIONS
HACKERSULI, APRIL 2024

INTRODUCTION TO IOS
▸ Apple is a very strict vendor
▸ No unauthorized updates and app installation
▸ Strictly one iCloud account per device
▸ Since 2024, alternate app stores are allowed (sideloading)
▸ Apple oversees
▸ The hw, the OS, the API, all the external services (iCloud, iMessage, etc.)

IOS BASICS
▸ iOS is a full 64-bit OS, based on XNU, a hybrid of FreeBSD and Mach kernels
▸ Lots of restrictions on what apps can do
▸ Kernel level protections in place to separate apps
▸ iOS sandboxing in place (Seatbelt) in a Mandatory Access Control approach
▸ iOS is a closely controlled app ecosystem
▸ Only Apple provided apps can be used (on non-jailbroken devices at least)
▸ Apple controls each OS and app installation on every device, every time

IOS AND JAILBREAK
iOS16 Jailbreak available

IOS BASICS - THE SECURE ENCLAVE
▸ A Trusted Processing Module
▸ A separate computer with its own RAM, ROM, power supply, DMA channels etc.
▸ Takes its code from the main iOS image in an encrypted format (SEPOS)
▸ The keys have leaked in 2017
▸ Performs cryptographic operations
▸ The keys never leave the unit
▸ Bundled with the Keychain, the disk encryption engine, the TouchID/FaceID etc.
▸ Even the RAM memory pages are encrypted

IOS BASICS - THE SECURE ENCLAVE

IOS DATA STORAGE - WHAT DOES AN APP STORE?
▸ What your code in the app stores intentionally
▸ Whatever in the app bundle (connect strings, API keys etc.), Documents,
NSUserDefaults, NSData, CoreData etc., Material in the KeyChain
▸ What your code frameworks happen to store
▸ Cookies, WebKit caches, Logs (local logs, NSLog etc.)
▸ What the 3rd party SDKs store in your app
▸ Logs, Analytics data, Ad cookies, caches etc.

IOS DATA STORAGE - INFORMATION IN THE BUNDLE

IOS DATA STORAGE - INFORMATION IN THE BUNDLE
▸ A React Native app with Firebase back-end
▸ An excerpt from the con
fi
g XML

IOS BASICS - FULL DISK ENCRYPTION
▸ Full disk encryption
▸ Every
fi
le is AES encrypted with a unique key
▸ Transparent from a developer/user point of view
▸ The hardware key is incorporated (not brute-forcible of
fl
ine)
▸ The users’ PIN is incorporated
▸ One of the coolest bit of engineering in consumer devices

IOS BASICS - FULL DISK ENCRYPTION

IOS BASICS - SECURE DATA STORAGE
▸ The sandbox
▸ Not possible for the app to reach out of its sandbox, kernel level protection
mechanisms
▸ Apple has to vouch for any app
▸ From iOS8
▸ App binaries: /var/containers/Bundle/Application
▸ Sandboxes: /var/mobile/Containers/Data/Application/

▸ How can sandboxes leave the device?
▸ iCloud backups
▸ Local backups
▸ (Local direct access to the sandboxes)

▸ Typical issues
▸ Sensitive data (passwords, tokens, private keys, etc.) in the sandbox
▸ Application state serialised to NSUserDefaults.plist
▸ Local application PIN bypass
▸ Failed authentication attempts bypass

▸ https://apps.apple.com/us/app/bither-bitcoin-wallet/
id899478936
▸ Local PIN screen can be bypassed through manually
editing the NSUserDefaults

IOS BASICS - TLS IOS
▸ App Transport Security
▸ No plain-text connections are allowed.
▸ The X.509 Certi
fi
cate has a SHA256
fi
ngerprint and must be signed with at
least a 2048-bit RSA key or a 256-bit Elliptic-Curve Cryptography (ECC) key.
▸ Transport Layer Security (TLS) version must be 1.2 or above and must
support Perfect Forward Secrecy (PFS) through Elliptic Curve Dif
fi
e-Hellman
Ephemeral (ECDHE) key exchange and AES-128 or AES-256 symmetric
ciphers.

▸ ATS exception can be manually requested
▸ Apple requires manual review of apps for plain-text traf
fi
c
▸ “An application that loads encrypted media content that contains no
personalized information
▸ Connections to devices that cannot be upgraded to use secure connections
▸ Connection to a server that is managed by another entity and does not
support secure connections”

▸ App Transport Security in practice
▸ No plain-text HTTP connections
▸ No self-signed certi
fi
cates
▸ Only accepted trust anchors are accepted
▸ Perfect Forward Secrecy is enforced
▸ In theory, it is possible to use you own CA, but de
fi
nitely not recommended

▸ Certi
fi
cate Pinning
▸ Provides protection for cases when a CA gets compromised
▸ We pin one CA, a leaf cert or the entire chain
▸ The CA still needs to be trusted by the OS
▸ Can be implemented in the info.plist

▸ Certi
fi
cate Pinning

IOS - DEEP LINKING
▸ When a link allows an app to directly navigate the user to a subview
▸ iOS supports two methods
▸ Custom URL handlers reddit://
▸ Deep linking https://www.reddit.com/whatever
▸ Kind-of-IPC on iOS

IOS - DEEP LINKING
▸ Developers need to tell what to do in the following call

IOS - DEEP LINKING
▸ NSURL provides a secure way to parse URLs
▸ But... URL parsed manually?
▸ ?param1=value1&param1=value2&param1=value3
▸ ?param1=value1=value2=value3
▸ Arbitrary navigation within the app?
SCHEME://LOGIN.PASSWORD@ADDRESS:PORT/
PATH/TO/RESOURCE?QUERYSTRING#FRAGMENT

INTRODUCTION - ANDROID
▸ Freedom for users
▸ No centralised app management, no mandated app store (like with iOS)
▸ No centralised enforcement of OS versions
▸ Gives real, impactful decisions to users
▸ Security features
▸ Encryption
▸ Device administrator application

ANDROID THREATS
▸ Negligent users, users not installing patches or manually disabling features
▸ Physical theft and stolen devices
▸ Hostile network environments, Man-in-the-Middle attacks
▸ Negligent vendors, perfectly usable devices with no more updates
▸ Malware attacking legitimate apps, direct attacks on mobile banking apps and
crypto wallets
▸ Fragmented ecosystem

ANDROID BASICS
▸ The OS and hw vendors are different with contradicting interests
▸ No crypto unit enforced
▸ No full disk encryption
▸ Lots of devices with different security features (e.g. facial recognition
cameras or
fi
ngerprint readers)

ANDROID - DATA STORAGE
▸ Data storage in the bundle
▸ See the iOS section :)

▸ The sandbox
▸ Should be treated as public, can be found in /data/data/...
▸ On a rooted device, trivial to access
▸ Can be leaked through cloud backups - 3 different policy settings...
▸ allowBackup
▸ android:dataExtractionRules
▸ android:fullBackupContent

▸ External storage
▸ World readable, world writable
▸ Mounted for '/sdcard/'
▸ Scoped storage from 10 Q, but can be opted out
▸ Due to wide spread abuse of the ACCESS_EXTERNAL_STORAGE permission
▸ File path based access model changed

ANDROID - TLS
▸ Network Security Con
fi
g, NSC
▸ Introduced in 7.0 Nougat
▸ Certi
fi
cate Pinning trivially achievable

ANDROID - IPC
▸ Permissions
▸ Normal: operates within the sandbox. User approval is not needed, granted automatically
upon installation
▸ Dangerous: involves private data. User approval is needed
▸ Signature: only those apps can use it, which were signed using the same certi
fi
cate as the
de
fi
ner app. Granted automatically upon installation
▸ SignatureOrSystem: signature + system apps can use the permission. Granted
automatically upon installation
▸ KnownSigner: from 12 (API 31), signer identity can be mandated in the Manifest

ANDROID - IPC, INTENT
▸ A message, delivered to an app component
▸ It can carry information/data or initiate some action
▸ Android uses Intents all over the place
▸ Intent types
▸ Implicit (broadcast, all subscribed components receive the intent)
▸ Explicit (‘app X, activity Y, take this image.')

ANDROID - IPC
▸ Android apps consist of four components
▸ Activities
▸ Services
▸ Content providers
▸ Broadcast listeners

ANDROID - IPC, EXPORTEDNESS
▸ Explicitly exported
▸ Implicitly exported

ANDROID - IPC, EXPORTEDNESS
▸ An exported component will receive all explicit intents
▸ Your Activity expects an image? Prepare it for all sorts of other input types
▸ From Android 14, all components must be explicitly declared for
exportedness

ANDROID - IPC, EXPORTEDNESS ISSUES
▸ Issue: activities with improper bounds checking
▸ The user is presented with an activity (non-privileged one) and is able to
navigate to another, privileged one
▸ Settings menu on the login screen
▸ ‘Show logs’ menu on the login screen
▸ A sensitive Activity is exported and can be directly invoked

ANDROID - IPC, CVE-2013-6271
▸ The lock screen can be bypassed on Android on some Samsung ROMs in
com.android.settings.ChooseLockGeneric:
▸ shell@android:/ $ am start -n com.android.settings/
com.android.settings.ChooseLockGeneric --ez con
fi
rm_credentials false --ei
lockscreen.password_type 0 --activity-clear-task

ANDROID - IPC ISSUES

ANDROID - IPC, AMAZON PHOTOS APP
▸ Public Activity sends OAuth2 access token to an argument URL

ANDROID - IPC, AMAZON PHOTOS APP
▸ Exploit

2024_hackersuli_mobil_ios_android ______

More Related Content

Similar to 2024_hackersuli_mobil_ios_android ______

More from hackersuli

Recently uploaded

2024_hackersuli_mobil_ios_android ______