Android P Security Updates: What You Need to Know

Android P Security Updates
What You Need to Know
© Copyright 2018 NowSecure, Inc. All Rights Reserved. Proprietary information.

© Copyright 2018 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
AGENDA + SPEAKERS
BRIAN REED
CHIEF MOBILITY OFFICER
TONY RAMIREZ
MOBILE SECURITY ANALYST
● Mobile Security Landscape
● The State of Android 8
● Android Pie
● How Security Analysts Can Prepare
● Predictions & Recommendations

NowSecure #MobSec5
Weekly mobile security news update
SUBSCRIBE NOW:
www.nowsecure.com/go/subscribe

DEEP MOBILE SECURITY EXPERTISE
Open source
Books & Speaking
4
Mobile threat research is in our DNA
● Dream team of security researchers
● Every waking moment spent:
○ Discovering critical vulns
○ Identifying novel attack vectors
○ Creating/maintaining renowned
open-source mobile security tools/projects
The NowSecure Mission
● Save the world from unsafe mobile apps
● Educate enterprises on the latest mobile threats
● Maximize the security of apps enterprises
develop, purchase and use

MOBILE VULNS CONTINUE TO GROW
5
842
Disclosed vulnerabilities
(CVEs) in 2017
1533 Lifetime (2006-2017)
GOOGLE ANDROID

387
Disclosed vulnerabilities
(CVEs) in 2017
1371 Lifetime (2006-2017)
APPLE iOS
http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 https://www.cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49

INSIDE THE MOBILE ATTACK SURFACE
▪GPS spoofing
▪Buffer overflow
▪allowBackup Flag
▪allowDebug Flag
▪Code Obfuscation
▪Configuration manipulation
▪Escalated privileges
▪URL schemes
▪GPS spoofing
▪Integrity/tampering/repacking
▪Side channel attacks
▪App signing key unprotected
▪JSON-RPC
▪Automatic Reference Counting
6
DATA AT REST
CODE FUNCTIONALITY DATA IN TRANSIT
API BACKEND
▪Data caching
▪Data stored in application
directory
▪Decryption of keychain
▪Data stored in log files
▪Data cached in memory/RAM
▪Data stored in SD card
▪Platform vulnerabilities
▪Server misconfiguration
▪Cross-site scripting
▪Cross-site request forgery
▪Cross origin resource sharing
▪Brute force attacks
▪Side channel attacks
▪SQL injection
▪Privilege escalation
▪Data dumping
▪OS command execution
▪Weak input validation
▪Hypervisor attack
▪VPN
▪OS data caching
▪Passwords & data accessible
▪No/Weak encryption
▪TEE/Secure Enclave Processor
▪Side channel leak
▪SQLite database
▪Emulator variance
▪Wi-Fi (no/weak encryption)
▪Rogue access point
▪Packet sniffing
▪Man-in-the-middle
▪Session hijacking
▪DNS poisoning
▪TLS Downgrade
▪Fake TLS certificate
▪Improper TLS validation
▪HTTP Proxies
▪VPNs
▪Weak/No Local authentication
▪App transport security
▪Transmitted to insecure server
▪ Zip files in transit
▪Cookie “httpOnly” flag
▪Cookie “secure” flag
▪Android rooting/iOS jailbreak
▪User-initiated code
▪Confused deputy attack
▪Multimedia/file format parsers
▪Insecure 3rd party libraries
▪World Writable Files
▪World Writable Executables
▪Dynamic runtime injection
▪Unintended permissions
▪UI overlay/pin stealing
▪Intent hijacking
▪Zip directory traversal
▪Clipboard data
▪World Readable Files

NOWSECURE INDUSTRY BENCHMARKS
0 59 60-69 70-79 80-89 90-100
*Scoring algorithm based on Industry Standard CVSS Scored findings
Low RiskHgh Risk Caution
Typical failures: Local Auth, Cookies, iOS ATS, Keysize
Worst failures: RCE, Man in Middle Attack, Invalid Certificate,
Known Vulnerable 3rd Party Libraries, Unencrypted credentials/PII
in local files or over HTTP

THE STATE OF Oreo
[A YEAR IN REVIEW]

MAJOR FEATURES ADDED IN Oreo [2017]
● WebView Changes (multi process)
● Safe Browsing API for Webviews
● UI Overlay detection
● SSLv3 support dropped

MAJOR FEATURES ADDED IN Oreo [2017]
● App Install permissions
● OS downgrade protection
● Dev Options requires priv
● SECCOMP filtering
● Play Protect

Pie

NON-SDK RESTRICTIONS
● Use non-SDK interfaces may affect the behavior of your app
● Non-SDK interfaces are Java methods or fields that are not
apart of the office Android SDK
● Non-SDK interfaces when referenced directly, via reflection,
or JNI are restricted
● Greylisted APIs will print logs and may display a toast if
used in the app
● Blacklisted APIs will throw an error if used in the app
● Manual install on Android P device required to test

PRIVACY IMPROVEMENTS
● Limited access to sensors in background
○ Camera and Microphone access are
restricted from app
○ Accelerometer and other sensors won’t
report

PRIVACY IMPROVEMENTS
● New Permission Group
○ CALL_LOG Group - Better control over
access to phone call information, numbers,
and device serial number
■ READ_PHONE_STATE permission

TLS BY DEFAULT
● cleartextTrafficPermitted is set to false by default
● Must explicitly set cleartextTrafficPermitted to true for
domains that require HTTP in the Network Security Config
A Security Analyst’s Guide to
Network Security Configuration in
Android P
<network-security-config>
<domain-config cleartextTrafficPermitted="false">
<domain includeSubdomain="true">example.com</domain>
</domain-config>
<base-config cleartextTrafficPermitted="false">
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
</network-security-config>
Read the Blog

ANDROID PROTECTED CONFIRMATION
● For user confirmation of protected
actions
● Meant to be used as an integrity check
○ The user has seen the statement and
agrees with the request
● You still need to encrypt your network
communications

ANDROID BACKUP ENCRYPTION
● Android 9 and + allow apps backups to be
encrypted using client side secret
○ Pin, Password, or Pattern
● Requires:
○ android:allowBackup="true"
○ Device Pin/Password/Pattern
○ requireFlags="clientSideEncryption"
■ Part of your android:fullBackupContent

StrongBox Keymaster
● Hardware security implementation of
Keymaster HAL
● True random-number generator
● Anti-tamper mechanisms
● Secure Storage
● Separate CPU
OTHER ANDROID 9 SECURITY QUICK HITS
18
Hostname Verification Changes
● Android P implements RFC 2818
● Subject Alt Name field will be used
for Hostname Verification instead of
Common Name Field
targetSdkVersion
● Target API level must be Level 26
● Number will increase with each
release
● Expect mandatory target API level to
be 28 next year
APK Signature Scheme v3
● Allows for rotation of signatures
Expanded SECCOMP Filter
● Secure Computing (SECCOMP) filter
applied to all apps
● System calls can expose the kernel
to attack
Per-App SELinux Domains
● Files must be shared via content
provider
DNS over TLS
● Support for DNS query encryption

RECOMMENDATIONS,
PREDICTIONS,
& NEXT STEPS

NETWORK SECURITY CONFIGURATION
DEFAULTS
Android 6 and below Android 7 and 8 Android 9
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
<certificates src="user" />
</trust-anchors>
</base-config>
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
</trust-anchors>
</base-config>
<base-config cleartextTrafficPermitted="false">
<trust-anchors>
</trust-anchors>
</base-config>

NSC BEST PRACTICES
● Make sure your APIs honor NSC
● Explicitly set user as the only certificate source when
possible.
● NSC does not perform Hostname verification

ANDROID BACKUP BEST PRACTICES
● If android:allowBackup="true" - confirm if sensitive
data is in the app and what locations they exist.
● Confirm if locations exist in
android:fullBackupContent config file
● Confirm config file uses
requireFlags="clientSideEncryption"

WHAT ABOUT SECURITY TESTING
IMPLICATIONS?
● All apps should be targeting API level 26 at least
● NSC Defaults make affect the results of your testing
● Hostname verification testing
● Backup config

ANDROID Q PREDICTIONS
● Android Quiche or Quesadilla?
● Likely continue closing more security edge cases & privacy
items
● Certificate Transparency part of NSC
● Additional permission groups
● App Store requirements

LEVERAGE NOWSECURE
MOBILE APPSEC TESTING
FOR Android P

NOWSECURE AUTOMATION PLATFORM
NowSecure AUTO
NowSecure WORKSTATION
NowSecure INTEL
NowSecure SERVICES
Continuous Integration Continuous Monitoring
Automated Security Testing in SDLC
for Dev, QA & Security Teams
Deep Pen Testing Analysis
of Complex, High Risk Mobile
Apps for Security Analysts
Public App Store Risk Data
for EMM, Threat & Security Teams
Expert Pen Testing, Training &
Mobile App Security Programs for
App Owners, Dev & Security Teams
Data
Repository
Dashboards &
Reports
Advanced
Configuration
Device
Farm
Compliance
Mapping
Analysis
Engine
26

LEVERAGE NOWSECURE TO PREP FOR ANDROID P
NowSecure AUTO NowSecure INTEL
Continuous Integration Continuous Monitoring
Automated Security Testing in SDLC
for Dev, QA & Security Teams
Public App Store Risk Data
for EMM, Threat & Security Teams
Data
Repository
Dashboards &
Reports
Advanced
Configuration
Device
Farm
Compliance
Mapping
Analysis
Engine
27
Automatically test all your apps in
the Dev pipeline before and after
iOS 12 release
Analyze the risk of all your 3rd party
apps currently in use or considering
to deploy on iOS12

NOWSECURE APPSEC TESTING COVERAGE CHECKLIST
✓ Man in the Middle: Cert Validation
✓ Man in the Middle: Cert Pinning
✓ Man in the Middle: HTTP Connections
✓ SSL Downgrade
✓ Unprotected TLS traffic
✓ Cookie integrity
✓ Certificate Validity
✓ App Transport Security
✓ …
✓ App files & Log Files
✓ Keychain
✓ SD Card
✓ World Writable Files
✓ World Readable Files
✓ RAM
✓ Unencrypted credential storage
✓ SQLite Databases
✓ Secure Enclave Processor
✓ …
✓ Development flags
✓ Automatic Reference Counting
✓ Stack Smashing
✓ Bad Authentication/Authorization
✓ Root access
✓ Path Traversal
✓ SQL Injection
✓ Vulnerable 3rd party libraries
✓ Heartbleed
✓ Bad cryptography
✓ Obfuscation
✓ …
CODE FUNCTIONALITY DATA IN MOTIONDATA AT REST
Data Center
& App Backend
Network &
Cloud Services
Android
APPS
FRAMEWORKS
NATIVE LIBRARIES
MEMORY
KERNEL
HARDWARE
TEST
APP
28
AUTOMATED MOBILE APP SECURITY TESTING PLATFORM

INSIDE NOWSECURE MOBILE APP RISK SCORING
29

NOWSECURE COMING ATTRACTIONS
ATARC Federal Mobile Summit
Aug 30, 2018 | Washington D.C.
DevSecCon Boston 2018
Sep 10-11, 2018 | Boston, MA
Chicago Cybersecurity Meetup
Aug 23, 2018 | Chicago, IL
CIOarena Chicago
Sep 5, 2018 | Chicago, IL
DevOps World / Jenkins World 2018
Sep 17-19, 2018 | San Jose, CA
ISSA Austin
Sep 18, 2018 | Austin, TX
ISSA New England
Sep 25, 2018 | San Jose, CA
AppSec USA
Oct 10-11, 2018 | San Jose, CA

OPEN Q&A
BRIAN REED
CHIEF MOBILITY OFFICER
TONY RAMIREZ
MOBILE SECURITY ANALYST
Use the “Ask a Question” tab below the slides

Let’s talk
NowSecure
+1 312.878.1100
@NowSecureMobile
www.nowsecure.com
Subscribe to #MobSec5
A digest of the week’s mobile security news that matters
https://www.nowsecure.com/go/subscribe

Android P Security Updates: What You Need to Know

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Android P Security Updates: What You Need to Know

Similar to Android P Security Updates: What You Need to Know (20)

More from NowSecure

More from NowSecure (13)

Android P Security Updates: What You Need to Know