Mallory is a man-in-the-middle proxy tool that was created to simplify common tasks in mobile application assessments such as setting up proxies and dealing with multiple protocols. It can intercept both HTTP and HTTPS traffic as well as other protocols like SSH and DNS. The tool has both a graphical user interface and programmatic APIs to modify intercepted traffic streams for tasks like fuzzing. It was demonstrated intercepting and modifying traffic for protocols like VNC and SSL.

1. Presented by:
Jeremy Allen
Rajendra Umadas
April 21, 2011
Network Stream Hacking with
Mallory

2. Agenda
• Who are we? • What annoys us?
– Rajendra Umadas – Proxy setup
– Jeremy Allen – Throwaway Tools
– Wasted or
Redundant effort
• What do we do?
– Mobile Application
Assessments, • What did we do
Thick Clients, about it?
COTS (lots of other – Mallory!
assessments)

3. Who Are We

4. Who are we: Jeremy Allen
Jeremy Allen
 Principal Consultant
 iOS Assessment Lead
 Writes a lot of Python
 Try to break things before the bad guys do

5. Who are we: Rajendra Umadas
Rajendra Umadas
 Consultant
 Mobile Application Hacker
 Does not afraid of anything
 Mobile Application Security = fun;

6. What we do

7. What we do: Assessment Types
Application Assessments
 Mobile Applications
 Acronym and Name Overload:
QUALCOMM/BREW, RIM, Windows Mobile,
Windows Phone, iPhone, Android …
 Web Applications
 XSS, SQL Injection – Pays the bills, still how many
get owned
 Other Apps
 Thick clients, binary protocols, “harder” targets

8. What we do: Tools
HTTP Proxy
 When is a HTTP Proxy Not Enough?
 Protocols that just use HTTP for transport
 Unidentified network streams in tested
application

9. What we do: Tools
Other Tools
 What tools exist that are good for MiTM and
app testing for application assessments?
 dsniff, cain, tcpdump ,wireshark (about
that…), others

10. Solution

11. Solution: Mallory
“The enemy knows the system” –
Claude Shannon

12. Solution
Hard Way
 ARP
 DNS Spoofing
 iptables and custom scripts
 Packet level techniques

13. Solution
Easy Way

14. Solution
Demo
 Intro to Mallory GUI

15. Soltuion: Mallory Architecture

16. Solution
What have others done with
Mallory?
 WSJ Application Privacy Research

17. Solution
Application Testing
 WSJ Application Privacy Research
 Chose Mallory because it is pervasive
 Apps don’t matter, Mallory can see the traffic

18. Demos + Deep Dive

19. Demos and Deep Dive

20. Solution
GUI Configuration
 Common tasks are fast, easy (configuring
mallory, editing TCP streams)
 Uncommon tasks are possible, fairly easy
(rules, known protocols)
 Rare tasks are harder, require some trickery
(python plugins, python code)

21. Solution
GUI Configuration
 Getting traffic to the stream editor
 Echo Server
 Rules Config Demo

22. Solution
Demo – Something More
Serious
 TCP Stream Editing
 All flows and datagrams go to a database
 Show database in advanced view

23. Solution
Programmatic Modification
 What about places where editing is harder?
 DEMO – Modifying VNC Keystrokes

24. Solution
What about Fuzzing?
 Fuzzing Paradigms
 File fuzzing
 Network fuzzing

25. Solution
How does Mallory Fuzz?
 ProxFuzz
 Opportunistic Fuzzing
 Protocol Depth

26. Solution
How does Mallory Fuzz?
 DEMO

27. Solution
Fuzzing Results
 Can vary greatly
 Depends on your app
 We have seen good returns with opportunistic
fuzzing

28. Solution
Common App Testing Problem
 SSL

29. Solution
Mallory Knows SSL
 DEMO - SSL

30. Solution
SSL Usage
 Mallory acts as a CA
 Generates Certs in Memory
 Makes Look Alike Certs

31. Solution
SSL Usage
 Mallory acts as a CA
 Generates Certs in Memory
 Makes Look Alike Certs

32. Conclusion

33. Conclusion
Conclusion
 Mallory is a MiTM Proxy
 Focus on streams and datagrams
 Mallory can decode and MiTM: HTTP, HTTPS,
SSL, DNS, SSH
 Mallory make common app testing tasks easy