CNIT 128 6. Analyzing Android Applications (Part 3)
•
0 likes•309 views
For a college class: Hacking Mobile Devices at CCSF Instructor: Sam Bowne More info: https://samsclass.info/128/128_S19.shtml
Report
Share
Report
Share
Download to read offline
Recommended
6. Analyzing Android Applications Part 2
For a college class: Hacking Mobile Devices at CCSF
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 6. Analyzing Android Applications (Part 1)
A lecture for a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 7. Attacking Android Applications (Part 2)
For a college class: Hacking Mobile Devices at CCSF
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 6. Analyzing Android Applications (Part 3 of 3)
This document discusses analyzing Android applications and reverse engineering. It covers generic exploit mitigation protections, rooting explained, and reverse engineering applications. For rooting, it discusses using exploits or an unlocked bootloader. For reverse engineering applications, it discusses pulling the APK from a phone, disassembling with tools like apktool, scanning for vulnerabilities, modifying the code with tools like Jadx, and repacking/signing the APK.
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
For a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 7. Attacking Android Applications (Part 1)
For a college class: Hacking Mobile Devices at CCSF
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)
For a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
Recommended
6. Analyzing Android Applications Part 2
For a college class: Hacking Mobile Devices at CCSF
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 6. Analyzing Android Applications (Part 1)
A lecture for a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 7. Attacking Android Applications (Part 2)
For a college class: Hacking Mobile Devices at CCSF
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 6. Analyzing Android Applications (Part 3 of 3)
This document discusses analyzing Android applications and reverse engineering. It covers generic exploit mitigation protections, rooting explained, and reverse engineering applications. For rooting, it discusses using exploits or an unlocked bootloader. For reverse engineering applications, it discusses pulling the APK from a phone, disassembling with tools like apktool, scanning for vulnerabilities, modifying the code with tools like Jadx, and repacking/signing the APK.
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
For a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 7. Attacking Android Applications (Part 1)
For a college class: Hacking Mobile Devices at CCSF
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)
For a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 7. Attacking Android Applications (Part 3)
For a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 2. Analyzing iOS Applications (Part 2)
For a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
This document discusses attacking Android applications by exploiting vulnerabilities in application components, insecure communications, and storage. It covers exposing security model quirks like downgrading permission levels, interacting with application components using intents, and analyzing the attack surface of applications. Specific attacks demonstrated include bypassing locks, exposing passwords through SQL injection, and overlaying interfaces to trigger unexpected actions.
Android Security
This presentation on Android Security was given for the course "Cryptography & Network Security" at the KU Leuven
Consulthink @ GDG Meets U - L'Aquila2014 - Codelab: Android Security -Il ke...
This document discusses Android key management and cryptography. It covers symmetric and asymmetric encryption algorithms like AES and RSA. It describes using the Android Keystore to securely store cryptographic keys and how PBKDF2 can be used to derive keys from passwords. It also demonstrates how apps can be reversed to extract hardcoded keys and discusses more secure alternatives like storing keys on a server.
Hacking Tizen: The OS of everything - Whitepaper
Samsung’s first Tizen-based devices are set to launch in the middle of 2015. This paper presents the research outcome on the security analysis of Tizen OS and it’s underlying security architecture.
The paper begins with a quick introduction to Tizen architecture and explains the various components of Tizen OS. This will be followed by Tizen’s security model where application sandboxing and resource access control will be explained. Moving on, an overview of Tizen’s Content Security Framework which acts as an in-built malware detection API will be covered.
Various vulnerabilities in Tizen will be discussed including issues like Tizen WebKit2 address spoofing and content injection, Tizen WebKit CSP bypass and issues in Tizen’s memory protection (ASLR and DEP).
Applications in Tizen can be written in HTML5/JS/CSS or natively using C/C++. As a bonus, an overview of pentesting Tizen applications will also be presented along with some of the security implications. There will be comparisons made to traditional Android applications and how these security issues differ with Tizen.
Permission in Android Security: Threats and solution
The document discusses permissions in Android security and outlines 3 main threats: permission re-delegation, over-privileged apps, and permission inheritance. It then describes 11 proposed solutions to these threats, categorizing each solution by type (system modification, Android service, or non-Android app), implementation level (system, app, or separate system), and running mode (static or dynamic). Finally, it notes areas for future work, such as combining solutions and evaluating solutions based on factors like performance and complexity.
Android Security
The incorporation of Security-Enhanced Linux in Android (SEAndroid) is an important security enhancement to the platform.
Android is built on top of the Linux kernel, with a collection of traditional and customized Linux libraries and daemons.
....
Andriod Pentesting and Malware Analysis
The document provides an overview of Android OS basics, including its history and key components. It discusses understanding APKs, Android's security model, and includes a brief look at popular Android malware. It also covers reversing Android malware and pentesting the Android platform, with demos. The speaker will discuss Android OS, APKs, the security model, rooting, malware, and reversing tools.
Android Security & Penetration Testing
These slides were presented at GDG MeetUp in Bangalore which was held on 21st September 2013. Uploading the slides to help the people who wanted the slide Deck
Arduino - Android Workshop Presentation
Slides for basic Hello World and develop an app for controlling arduino and robot.
This app uses the API call and parse the JSON response from arduino to show the status of robot.
A Closer Look on C&C Panels
a presentation at 5th BU RISCS Seminar of Practical Security. The presentation based on a talk at BlackHat 2014 by Aditya K. Sood
[Wroclaw #1] Android Security Workshop
The document summarizes an Android security workshop that took place on February 24th, 2016 in Poland. The workshop included sessions on Android fundamentals, application component security, and the OWASP top 10 mobile risks. It also covered reverse engineering and malware analysis. The document provides an agenda and summaries of the topics discussed in each session, including details on Android architecture, security features in Android 6.0, application permissions and components, and common mobile risks. It aims to provide attendees with a basic understanding of Android security concepts and methodologies for analyzing mobile applications for security issues.
Android security - an enterprise perspective
DEBUNKING ANDROID SECURITY MYTHS WITH DATA
In this talk I’m presenting some hot topics for European Corporation in the process to adopt Android as COSU devices.
How features introduced in Android 6.0, Google Mobile Services and third party extensions collaborate to provide to the market state of art solutions.
This talk will answer to questions like:
1. Android threats, real or FUD?
2. Security updates, why are they critical for the Enterprise market
3. Security and Long Life Cycle of Android devices, what are the market best practices
This session is powered by Zebra
Android App Hacking - Erez Metula, AppSec
This document summarizes an expert presentation on hacking Android apps. It discusses the top 10 most common Android app vulnerabilities according to OWASP, including weak server-side controls, insecure data storage, lack of transport layer security, unintended data leakage, poor authorization and authentication, broken cryptography, client-side injections, making security decisions via untrusted inputs, improper session handling, and lack of binary protections. Specific attack examples for each vulnerability are provided.
Hacker Halted 2014 - Reverse Engineering the Android OS
Introduction to the Android OS. the Android Developers Kit, Android Emulators, Rooting Android devices, de-compiling Android Apps. Dex2jar, Java JD_GUI and so on. During the presentation I will pull an App apart and show how to bypass a login screen.
What better way to express the Zombie Apocalypse then with mobile devices. They are ubiquitous. they are carried everywhere, they go everywhere. Having a decent understanding of the Operating System and it’s vulnerabilities can go a long way towards keeping your device protected.
Getting started with Android Programming
This document provides an overview of Android for developers getting started with Android programming. It discusses what Android is, the history and versions of Android, the architecture and features of the Android operating system, popular Android devices, and Android's app marketplace. The key points are: Android is an open source, Linux-based OS acquired by Google; it has gone through many versions codenamed after desserts; the architecture includes the Linux kernel, libraries, runtime and framework; and it powers a wide range of devices led by smartphones.
Android 101 - Introduction to Android Development
This document provides an introduction to Android development. It covers topics such as setting up the development environment, understanding the file system structure, using activities and fragments, handling fragmentation across different devices, and some best practices. The document discusses tools like Android Studio, the build system, and debugging tools. It also explains concepts like the activity lifecycle, saving activity state, targeting different versions and configurations, and using support libraries for backwards compatibility.
Csw2016 chaykin having_funwithsecuremessengers_and_androidwear
This document summarizes vulnerabilities in Android inter-process communication (IPC) and how they can be exploited. It presents three examples:
1) A vulnerability in MobiDM that allows hijacking intents.
2) Hijacking pending intents used by push notification services to spoof identity and notifications.
3) Exploiting pending intents used in Android Wear and Android Auto to intercept and spoof voice replies, allowing spam through these platforms.
The document notes some victims of these exploits, how to detect them using an Xposed module, and mixed results in getting fixes from messaging apps. It concludes by discussing Microsoft's approach to mobile security.
Whats different in android L, M, N and O
Every new Android version introduces changes and improvements. Even if you're targeting an older Android version in your application, you need to understand what is the trajectory that the OS in following to be prepared. This presentation is targeting the enterprise mobility developers.
CNIT 128: Android Implementation Issues (Part 2)
This document discusses exploiting Android devices through practical physical and remote attacks. It covers bypassing lock screens through USB debugging bugs, removing key files, and abusing application issues. It also discusses exploiting browser vulnerabilities through JavaScript interfaces. Remote attacks include browser and PDF viewer exploits that can lead to privilege escalation and maintaining root access through a custom su binary. Man-in-the-middle exploits through wireless networking are also mentioned.
CNIT 128 8. Android Implementation Issues (Part 2)
This document discusses exploiting Android devices through practical physical and remote attacks. It covers bypassing lock screens through USB debugging bugs, removing key files, and abusing application issues. Remote exploits discussed include browser and application memory corruption, JavaScript interface attacks, and maintaining privileged access through "minimal su". The document also mentions man-in-the-middle exploits and privilege escalation techniques.
More Related Content
What's hot
CNIT 128 7. Attacking Android Applications (Part 3)
For a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128 2. Analyzing iOS Applications (Part 2)
For a college class: Hacking Mobile Devices at CCSF
Based on "The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell
Instructor: Sam Bowne
More info: https://samsclass.info/128/128_S19.shtml
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
This document discusses attacking Android applications by exploiting vulnerabilities in application components, insecure communications, and storage. It covers exposing security model quirks like downgrading permission levels, interacting with application components using intents, and analyzing the attack surface of applications. Specific attacks demonstrated include bypassing locks, exposing passwords through SQL injection, and overlaying interfaces to trigger unexpected actions.
Android Security
This presentation on Android Security was given for the course "Cryptography & Network Security" at the KU Leuven
Consulthink @ GDG Meets U - L'Aquila2014 - Codelab: Android Security -Il ke...
This document discusses Android key management and cryptography. It covers symmetric and asymmetric encryption algorithms like AES and RSA. It describes using the Android Keystore to securely store cryptographic keys and how PBKDF2 can be used to derive keys from passwords. It also demonstrates how apps can be reversed to extract hardcoded keys and discusses more secure alternatives like storing keys on a server.
Hacking Tizen: The OS of everything - Whitepaper
Samsung’s first Tizen-based devices are set to launch in the middle of 2015. This paper presents the research outcome on the security analysis of Tizen OS and it’s underlying security architecture.
The paper begins with a quick introduction to Tizen architecture and explains the various components of Tizen OS. This will be followed by Tizen’s security model where application sandboxing and resource access control will be explained. Moving on, an overview of Tizen’s Content Security Framework which acts as an in-built malware detection API will be covered.
Various vulnerabilities in Tizen will be discussed including issues like Tizen WebKit2 address spoofing and content injection, Tizen WebKit CSP bypass and issues in Tizen’s memory protection (ASLR and DEP).
Applications in Tizen can be written in HTML5/JS/CSS or natively using C/C++. As a bonus, an overview of pentesting Tizen applications will also be presented along with some of the security implications. There will be comparisons made to traditional Android applications and how these security issues differ with Tizen.
Permission in Android Security: Threats and solution
The document discusses permissions in Android security and outlines 3 main threats: permission re-delegation, over-privileged apps, and permission inheritance. It then describes 11 proposed solutions to these threats, categorizing each solution by type (system modification, Android service, or non-Android app), implementation level (system, app, or separate system), and running mode (static or dynamic). Finally, it notes areas for future work, such as combining solutions and evaluating solutions based on factors like performance and complexity.
Android Security
The incorporation of Security-Enhanced Linux in Android (SEAndroid) is an important security enhancement to the platform.
Android is built on top of the Linux kernel, with a collection of traditional and customized Linux libraries and daemons.
....
Andriod Pentesting and Malware Analysis
The document provides an overview of Android OS basics, including its history and key components. It discusses understanding APKs, Android's security model, and includes a brief look at popular Android malware. It also covers reversing Android malware and pentesting the Android platform, with demos. The speaker will discuss Android OS, APKs, the security model, rooting, malware, and reversing tools.
Android Security & Penetration Testing
These slides were presented at GDG MeetUp in Bangalore which was held on 21st September 2013. Uploading the slides to help the people who wanted the slide Deck
Arduino - Android Workshop Presentation
Slides for basic Hello World and develop an app for controlling arduino and robot.
This app uses the API call and parse the JSON response from arduino to show the status of robot.
A Closer Look on C&C Panels
a presentation at 5th BU RISCS Seminar of Practical Security. The presentation based on a talk at BlackHat 2014 by Aditya K. Sood
[Wroclaw #1] Android Security Workshop
The document summarizes an Android security workshop that took place on February 24th, 2016 in Poland. The workshop included sessions on Android fundamentals, application component security, and the OWASP top 10 mobile risks. It also covered reverse engineering and malware analysis. The document provides an agenda and summaries of the topics discussed in each session, including details on Android architecture, security features in Android 6.0, application permissions and components, and common mobile risks. It aims to provide attendees with a basic understanding of Android security concepts and methodologies for analyzing mobile applications for security issues.
Android security - an enterprise perspective
DEBUNKING ANDROID SECURITY MYTHS WITH DATA
In this talk I’m presenting some hot topics for European Corporation in the process to adopt Android as COSU devices.
How features introduced in Android 6.0, Google Mobile Services and third party extensions collaborate to provide to the market state of art solutions.
This talk will answer to questions like:
1. Android threats, real or FUD?
2. Security updates, why are they critical for the Enterprise market
3. Security and Long Life Cycle of Android devices, what are the market best practices
This session is powered by Zebra
Android App Hacking - Erez Metula, AppSec
This document summarizes an expert presentation on hacking Android apps. It discusses the top 10 most common Android app vulnerabilities according to OWASP, including weak server-side controls, insecure data storage, lack of transport layer security, unintended data leakage, poor authorization and authentication, broken cryptography, client-side injections, making security decisions via untrusted inputs, improper session handling, and lack of binary protections. Specific attack examples for each vulnerability are provided.
Hacker Halted 2014 - Reverse Engineering the Android OS
Introduction to the Android OS. the Android Developers Kit, Android Emulators, Rooting Android devices, de-compiling Android Apps. Dex2jar, Java JD_GUI and so on. During the presentation I will pull an App apart and show how to bypass a login screen.
What better way to express the Zombie Apocalypse then with mobile devices. They are ubiquitous. they are carried everywhere, they go everywhere. Having a decent understanding of the Operating System and it’s vulnerabilities can go a long way towards keeping your device protected.
Getting started with Android Programming
This document provides an overview of Android for developers getting started with Android programming. It discusses what Android is, the history and versions of Android, the architecture and features of the Android operating system, popular Android devices, and Android's app marketplace. The key points are: Android is an open source, Linux-based OS acquired by Google; it has gone through many versions codenamed after desserts; the architecture includes the Linux kernel, libraries, runtime and framework; and it powers a wide range of devices led by smartphones.
Android 101 - Introduction to Android Development
This document provides an introduction to Android development. It covers topics such as setting up the development environment, understanding the file system structure, using activities and fragments, handling fragmentation across different devices, and some best practices. The document discusses tools like Android Studio, the build system, and debugging tools. It also explains concepts like the activity lifecycle, saving activity state, targeting different versions and configurations, and using support libraries for backwards compatibility.
Csw2016 chaykin having_funwithsecuremessengers_and_androidwear
This document summarizes vulnerabilities in Android inter-process communication (IPC) and how they can be exploited. It presents three examples:
1) A vulnerability in MobiDM that allows hijacking intents.
2) Hijacking pending intents used by push notification services to spoof identity and notifications.
3) Exploiting pending intents used in Android Wear and Android Auto to intercept and spoof voice replies, allowing spam through these platforms.
The document notes some victims of these exploits, how to detect them using an Xposed module, and mixed results in getting fixes from messaging apps. It concludes by discussing Microsoft's approach to mobile security.
Whats different in android L, M, N and O
Every new Android version introduces changes and improvements. Even if you're targeting an older Android version in your application, you need to understand what is the trajectory that the OS in following to be prepared. This presentation is targeting the enterprise mobility developers.
What's hot (20)
CNIT 128 7. Attacking Android Applications (Part 3)
CNIT 128 7. Attacking Android Applications (Part 3)
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
Consulthink @ GDG Meets U - L'Aquila2014 - Codelab: Android Security -Il ke...
Consulthink @ GDG Meets U - L'Aquila2014 - Codelab: Android Security -Il ke...
Permission in Android Security: Threats and solution
Permission in Android Security: Threats and solution
Hacker Halted 2014 - Reverse Engineering the Android OS
Hacker Halted 2014 - Reverse Engineering the Android OS
Csw2016 chaykin having_funwithsecuremessengers_and_androidwear
Csw2016 chaykin having_funwithsecuremessengers_and_androidwear
Similar to CNIT 128 6. Analyzing Android Applications (Part 3)
CNIT 128: Android Implementation Issues (Part 2)
This document discusses exploiting Android devices through practical physical and remote attacks. It covers bypassing lock screens through USB debugging bugs, removing key files, and abusing application issues. It also discusses exploiting browser vulnerabilities through JavaScript interfaces. Remote attacks include browser and PDF viewer exploits that can lead to privilege escalation and maintaining root access through a custom su binary. Man-in-the-middle exploits through wireless networking are also mentioned.
CNIT 128 8. Android Implementation Issues (Part 2)
This document discusses exploiting Android devices through practical physical and remote attacks. It covers bypassing lock screens through USB debugging bugs, removing key files, and abusing application issues. Remote exploits discussed include browser and application memory corruption, JavaScript interface attacks, and maintaining privileged access through "minimal su". The document also mentions man-in-the-middle exploits and privilege escalation techniques.
Android overview
Android is an open source operating system designed primarily for touchscreen mobile devices. It uses Linux for core functions like memory and process management and includes features like an open application marketplace (Google Play), built-in security protections, and regular updates to newer platform versions codenamed after desserts. Android's flexibility allows it to run on a variety of hardware, expand its functionality through customization, and offer developers an easy environment to create applications for a wide user base.
Android village @nullcon 2012
This document provides an overview of a two-day training on Android hacking and security. Day 1 covers Android architecture basics, development, and penetration testing fundamentals. Topics include the operating system, file system, security model, application components, and setting up a penetration testing lab. Day 2 covers more advanced topics like malware analysis, common exploits, custom ROM development, and forensics. The document outlines the agenda and key learning points for each topic.
CNIT 128 Ch 4: Android
Slides for a college course at City College San Francisco. Based on "Hacking Exposed Mobile: Security Secrets & Solutions", by Bergman, Stanfield, Rouse, Scambray, Geethakumar, Deshmukh, Matsumoto, Steven and Price, McGraw-Hill Osborne Media; 1 edition (July 9, 2013) ISBN-10: 0071817018.
Instructor: Sam Bowne
Class website: https://samsclass.info/128/128_S17.shtml
Android Attacks
This document provides an overview of attacking Android devices. It discusses Android's architecture and security model, popular versions and their vulnerabilities, and methods for remotely accessing a device and elevating privileges. The presenters demonstrate gaining root access on an Android 2.1 device through a browser vulnerability and vendor kernel bug. They discuss options for backdooring devices at the application or system level for persistent remote access.
128-ch4.pptx
This document discusses Android security and hacking techniques. It covers the Android architecture including its use of Linux kernels and Java libraries. It describes Android's permission model and how apps are sandboxed. It discusses techniques for hacking Android like rooting devices, decompiling apps, intercepting network traffic, and exploiting intents. It also covers ways attackers can leak information and how to mitigate security risks.
Android introduction and rooting technology
Android is an open source Platform or a software stack for mobile. It is a Google product. but still as it is a open source so anyone can develop its application It run on dalvik VM and its applications are written in java. Android is a terrifically growing mobile platform and also a user loveable OS for mobile phone. We can see that its new versions are coming with a small or can say with in a minimum interval . Recently we have android 5.0 and on its release google had announced for android 5.0.1 also.
The Android OS project was started in 2001. Initially developed by Android, Inc., which Google backed financially and later bought in 2005, Android was unveiled in 2007 along with the founding of the Open Handset Alliance.
1-HISTORY OF ANDROID:-
In 2005 Google buys android Incorporation and started dalvik. At that time it is not possible for Google to go out and buy the companies to work on android, so Google in 2007 announced Android as an Open Handset Alliance so it a point to be noted that know android is not owned by only by Google or Google is the owner of android but OHA is the owner of android. 2008 to 2010 the android become a biggest used platform for mobile, it was world wide accepted mobile platform domain. In 2011 the chairman of Google Mr. Eric had decided to more to other device also like gaming, tablets, Tv watches, Car GPRS systems, etc.
YEAR TASK
2005 Google buys ANDROID Inc.
2007 Open Handset Alliance. Announced FIRST SDK.
2008 Android become the domain of mobile platform
2011 Games, tablets, watches,etc
Why Dalvik VM not Java VM (JVM) ?
Android runs java app so why don’t we use java vm ?
because of two good reasons
1- business.
2- Technical.
Business is Java is owned by Oracle. So We have to buy license for java VM. Due to which Android will no longer be free, and there is no reason that why Google will give profit to Oracle. And it is not easy for Google to buy license from oracle for each VM After all it is the reason for its pride. There are main two technical reasons
1-battery consumption of java vm. As java is optimized and is designed to run on Intel chips easily and Intel chips need more and more power to run and in mobiles the battery in main consistent so intel chips are replaced by armed chips, so it is not possible to run java vm on it.
2- Memory consumption in java vm to run any app first we have to load it class for memory to Hard disk or RAM, so to run first we have to wait for vm to search and load class in HD or RAM. And in mobile we don’t have such a large memory that we load classes every before running any app. So it better to replace JVM with dalvik vm which use classes but there is no need to load it in RAM it run it directly.
Difference b\w Delvik and ART
0 In dalvik runtime, the JIT in bounded to CPU but ART frees the CPU from translating DEX to machine code during app’s execution thus reduce energy consumption.
o ART is faster as it directly convert. DEX byte-code to NAT
Android
• Introduction Of Android
• History Of Android
• Android Versions
• Android Architecture
• Features Of Android
• Advantages Of Android And Disadvantages
• Conclusion
Implementing Trusted Endpoints in the Mobile World
This document discusses mobile endpoint security and summarizes key technologies used in iOS and Android. It outlines secure boot processes, code signing, sandboxing, app vetting, data encryption, secrets protection, and security policy enforcement capabilities. It also examines the specific endpoint security needs of LINE apps and services given its large diverse user base. Finally, it evaluates additional security technologies like trusted execution environments and whitebox cryptography that could help provide consistent protection across platforms and devices.
CNIT 128 7. Attacking Android Applications (Part 3)
This document discusses techniques for attacking Android applications, including accessing storage and logging, exploiting insecure communications, and other vectors. Specifically, it covers accessing application data stored on the device or SD card, intercepting network traffic, exploiting flaws in how applications implement security like SSL validation, manipulating the runtime using tools like Frida to change app behavior, and more. The goal is to summarize the key topics and techniques discussed for attacking the security of Android applications.
Barcode scanning on Android
if you think that ZXing is all you need to do barcode scanning on Android and you're happy with it, this presentation is not for you.
Barcodes are a very old technology that is not going away anytime soon and if you need to scan a lot of barcodes, better to know what are the alternatives.
DEF CON 24 - Dinesh and Shetty - practical android application exploitation
The document provides an overview of a workshop on practical Android application exploitation. The workshop aims to teach skills for performing reverse engineering, static and dynamic testing, and binary analysis of Android applications. It will use demonstrations and hands-on exercises with custom applications like InsecureBankv2. The workshop focuses on discovery and remediation, targeting intermediate to advanced skill levels. It will cover tools, techniques, and common vulnerabilities to exploit Android applications.
Android
Android is an open-source operating system used for mobile devices and other electronics. It was developed by Android Inc. which was bought by Google in 2005. It uses a modified version of the Linux kernel and other open source software, allowing developers to write managed code using Java. The Android software architecture includes libraries, an application framework, and the Dalvik virtual machine. While powerful, Android still faces some limitations like occasional lag and heat generation that newer versions aim to improve on.
3. Android Architecture.pptx
The document provides an overview of the Android architecture including:
- The Android platform consists of hardware, operating system, libraries and runtime. The Linux kernel provides low-level functionality.
- Key components include libraries, the Dalvik VM, and frameworks for activities, content providers, and notifications.
- Each app is sandboxed and has its own unique ID, files system space, and database. Permissions allow access to device features.
- The Android SDK and IDEs like Eclipse are used for app development. The emulator and tools allow app building, debugging, and deployment.
Lick my Lollipop
Željko je razvijalec pri podjetju INFINUM, kjer sodeluje pri razvoju različnih Android aplikacij. Na predavanju je detaljno predstavil kaj nam novega prinaša Android 5.0 kot so Material design, ART runtime, MultiDexSupport in drugo ter odgovoril na vprašanje, zakaj bo Android tudi v prihodnosti najbolj zastopljen operacijski sistem na področju mobilnih tehnologij.
Presentation On Android
Android is a mobile operating system developed by Google, based on the Linux kernel and designed primarily for touchscreen mobile devices such as smartphones and tablets. Android's user interface is mainly based on direct manipulation, using touch gestures that loosely correspond to real-world actions, such as swiping, tapping and pinching, to manipulate on-screen objects, along with a virtual keyboard for text input. In addition to touchscreen devices, Google has further developed Android TV for televisions, Android Auto for cars, and Android Wear for wrist watches, each with a specialized user interface. Variants of Android are also used on notebooks, game consoles, digital cameras, and other electronics.
Android has the largest installed base of all operating systems (OS) of any kind.Android has been the best selling OS on tablets since 2013, and on smartphones it is dominant by any metric.
Initially developed by Android, Inc., which Google bought in 2005,Android was unveiled in 2007 along with the founding of the Open Handset Alliance – a consortium of hardware, software, and telecommunication companies devoted to advancing open standards for mobile devices.As of July 2013, the Google Play store has had over one million Android applications ("apps") published – including many "business-class apps"that rival competing mobile platforms – and over 50 billion applications downloaded.An April–May 2013 survey of mobile application developers found that 71% of developers create applications for Android,and a 2015 survey found that 40% of full-time professional developers see Android as their priority target platform, which is comparable to Apple's iOS on 37% with both platforms far above others.In September 2015, Android had 1.4 billion monthly active devices.
Android's source code is released by Google under open source licenses, although most Android devices ultimately ship with a combination of open source and proprietary software, including proprietary software required for accessing Google services.Android is popular with technology companies that require a ready-made, low-cost and customizable operating system for high-tech devices.Its open nature has encouraged a large community of developers and enthusiasts to use the open-source code as a foundation for community-driven projects, which deliver updates to older devices, add new features for advanced users or bring Android to devices originally shipped with other operating systems. The success of Android has made it a target for patent (and copyright) litigation as part of the so-called "smartphone wars" between technology companies.
Presentation On Android
Android is a mobile operating system developed by Google, based on the Linux kernel and designed primarily for touchscreen mobile devices such as smartphones and tablets. Android's user interface is mainly based on direct manipulation, using touch gestures that loosely correspond to real-world actions, such as swiping, tapping and pinching, to manipulate on-screen objects, along with a virtual keyboard for text input. In addition to touchscreen devices, Google has further developed Android TV for televisions, Android Auto for cars, and Android Wear for wrist watches, each with a specialized user interface. Variants of Android are also used on notebooks, game consoles, digital cameras, and other electronics.
Android has the largest installed base of all operating systems (OS) of any kind.Android has been the best selling OS on tablets since 2013, and on smartphones it is dominant by any metric.
Initially developed by Android, Inc., which Google bought in 2005,Android was unveiled in 2007 along with the founding of the Open Handset Alliance – a consortium of hardware, software, and telecommunication companies devoted to advancing open standards for mobile devices.As of July 2013, the Google Play store has had over one million Android applications ("apps") published – including many "business-class apps"that rival competing mobile platforms – and over 50 billion applications downloaded.An April–May 2013 survey of mobile application developers found that 71% of developers create applications for Android,and a 2015 survey found that 40% of full-time professional developers see Android as their priority target platform, which is comparable to Apple's iOS on 37% with both platforms far above others.In September 2015, Android had 1.4 billion monthly active devices.
Android's source code is released by Google under open source licenses, although most Android devices ultimately ship with a combination of open source and proprietary software, including proprietary software required for accessing Google services.Android is popular with technology companies that require a ready-made, low-cost and customizable operating system for high-tech devices.Its open nature has encouraged a large community of developers and enthusiasts to use the open-source code as a foundation for community-driven projects, which deliver updates to older devices, add new features for advanced users or bring Android to devices originally shipped with other operating systems. The success of Android has made it a target for patent (and copyright) litigation as part of the so-called "smartphone wars" between technology companies.
Android Things: Android for IoT
Android Things is Google's latest platform for building IoT devices. It is based on Android and uses existing Android development tools. After initial attempts with Brillo and Weave, Android Things reverts back to the traditional Android architecture of system services and HALs. It extends the Android API with new capabilities for IoT and includes a peripheral manager service to interact with hardware. Images are provided for Intel Edison and Raspberry Pi 3, with sizes ranging from 11MB to 420MB. Apps can access peripherals through new APIs while a launcher tailored for IoT replaces the traditional Android launcher.
Mobile security
The document discusses various aspects of Android security. It covers kernel security features like process isolation and permissions. It describes how the application sandbox isolates apps and assigns unique IDs. It also discusses system security mechanisms like encryption, verified boot, and updates. Common Android vulnerabilities are outlined like rooting, repackaging apps, update attacks, and drive-by downloads.
Similar to CNIT 128 6. Analyzing Android Applications (Part 3) (20)
CNIT 128 8. Android Implementation Issues (Part 2)
CNIT 128 8. Android Implementation Issues (Part 2)
Implementing Trusted Endpoints in the Mobile World
Implementing Trusted Endpoints in the Mobile World
CNIT 128 7. Attacking Android Applications (Part 3)
CNIT 128 7. Attacking Android Applications (Part 3)
DEF CON 24 - Dinesh and Shetty - practical android application exploitation
DEF CON 24 - Dinesh and Shetty - practical android application exploitation
More from Sam Bowne
Cyberwar
The document discusses various topics related to cyberwar including Mastodon, Lockheed-Martin's kill chain model, and Mitre's ATT&CK framework. It notes that China, Russia, Iran, and North Korea pose major cyber threats according to the FBI and CISA. China is described as the broadest cyber espionage threat. Russia conducts destructive malware and ransomware operations. Iran's growing cyber expertise makes it a threat. North Korea's program poses an espionage, cybercrime, and attack threat and continues cryptocurrency heists.
3: DNS vulnerabilities
- DNS vulnerabilities can arise from configuration errors, architecture mistakes, vulnerable software implementations, protocol weaknesses, and failure to use security extensions.
- Common mistakes include single points of failure, exposure of internal information, leakage of internal queries, unnecessary recursiveness, failure to restrict access, and unprotected zone transfers.
- Software vulnerabilities have included buffer overflows and flaws in randomization of source ports, transaction IDs, and domain name ordering that enable cache poisoning and man-in-the-middle attacks.
8. Software Development Security
This chapter discusses software development security. It covers topics like programming concepts, compilers and interpreters, procedural vs object-oriented languages, application development methods like waterfall vs agile models, databases, object-oriented design, assessing software vulnerabilities, and artificial intelligence techniques. The key aspects are securing the entire software development lifecycle from initial planning through operation and disposal, using secure coding practices, testing for vulnerabilities, and continually improving processes.
4 Mapping the Application
For a Securing Web Applications class at college.
More info: https://samsclass.info/129S/129S_S23.shtml
3. Attacking iOS Applications (Part 2)
This document discusses attacking iOS applications by exploiting vulnerabilities in the iOS runtime, interprocess communication, and through injection attacks. Specifically, it covers instrumenting the iOS runtime using method swizzling, attacking applications using interprocess communication techniques like application extensions, and exploiting entry points like UIWebViews, client-side data stores, and file handling routines to perform injection attacks on iOS apps.
12 Elliptic Curves
This document provides an overview of elliptic curve cryptography including what an elliptic curve is, the elliptic curve discrete logarithm problem (ECDLP), Diffie-Hellman key agreement and digital signatures using elliptic curves. It discusses NIST standard curves like P-256 and Curve25519 as well as choosing appropriate curves and potential issues like attacks if randomness is not properly implemented or an invalid curve is used.
11. Diffie-Hellman
The document discusses the Diffie-Hellman key exchange protocol. It describes how Diffie-Hellman works by having two parties agree on a shared secret over an insecure channel without transmitting the secret itself. It also covers potential issues like using proper cryptographic techniques to derive keys from the shared secret and using safe prime numbers to prevent attacks.
2a Analyzing iOS Apps Part 1
This document provides an overview of analyzing iOS apps, including jailbreaking mobile devices. It discusses iOS security features like code signing and sandboxing. It explains how to set up a test environment for analyzing apps by jailbreaking a device and using Unix tools. Key files like property lists and databases that can be explored are also outlined.
9 Writing Secure Android Applications
This document discusses various techniques for writing secure Android apps, including minimizing unnecessary permissions and exposure, securing data storage and communication, and making apps difficult to reverse engineer. It provides examples of implementing essential security mechanisms like permission protection and securing activities, content providers, and web views. It also covers more advanced techniques such as protection level downgrades, obfuscation, and tamper detection.
12 Investigating Windows Systems (Part 2 of 3)
The document discusses investigating Windows systems by analyzing the Windows Registry. It describes the purpose and structure of the Registry, including the main hive files and user-specific hives. It provides an overview of important Registry keys that can contain forensic artifacts, such as system configuration keys, network information keys, user and security information keys, and auto-run keys that can indicate malware persistence. Specific Registry keys and values are highlighted that are most useful for analyzing evidence on a compromised system, including ShellBags, UserAssist, MRU lists, and Internet Explorer TypedURLs and TypedPaths. Tools for Registry analysis like RegRipper, AutoRuns, and Nirsoft utilities are also mentioned.
10 RSA
This document provides an overview of the RSA cryptosystem. It begins with the mathematical foundations of RSA, including the group ZN* and Euler's totient function. It then covers the RSA trapdoor permutation using modular exponentiation and key generation. The document discusses encrypting and signing with RSA, as well as implementations using libraries and algorithms like square-and-multiply. It concludes with topics like side-channel attacks, optimizations for speed, and ways implementations can fail like the Bellcore attack on RSA-CRT.
12 Investigating Windows Systems (Part 1 of 3
This document provides an overview of analyzing the Windows file system, NTFS metadata, and logs to investigate security incidents and recover deleted files. It discusses the Master File Table (MFT) structure, timestamps, alternate data streams, prefetch files, event logs, and scheduled tasks. The MFT stores file metadata including attributes, timestamps, and data runs. File deletion only marks the MFT entry inactive, allowing recovery of deleted file contents and metadata. Event and security logs can reveal lateral movement and suspicious processes. Prefetch files indicate program execution history. Scheduled tasks configure automated programs through .job files logged by Task Scheduler.
9. Hard Problems
This document discusses computational hardness and complexity classes related to cryptography. It covers the computational complexity of problems like factoring large numbers and the discrete logarithm problem. These problems are assumed to be hard, even for quantum computers, and form the basis for cryptographic techniques. The document also discusses how cryptography could be broken if faster algorithms were found for these problems or if the key sizes used were too small.
8 Android Implementation Issues (Part 1)
This document discusses exploiting vulnerabilities in Android devices. It covers identifying pre-installed apps that could provide access, techniques for remotely or locally exploiting devices, and the different privilege levels an attacker may obtain including non-system app access, installed package access, ADB shell access, system user access, and root user access. Specific exploitation techniques mentioned include exploiting update mechanisms, remote code loading, webviews, listening services, and messaging apps. Tools discussed include Drozer, Ettercap, and Burp.
11 Analysis Methodology
This document provides an overview of the incident response analysis methodology process. It discusses defining objectives, understanding the situation and available resources, identifying leadership, avoiding impossible tasks like proving a negative, asking why to define scope, knowing where data is stored, accessing raw data, selecting analysis methods like searching for malware or using tools like VirusTotal, manual review, filtering data, statistical analysis using tools like Sawmill, string searching, analyzing unallocated space, and file carving. It stresses periodically evaluating results to ensure progress and only making definitive statements if supported by evidence.
8. Authenticated Encryption
This document discusses authenticated encryption, which both encrypts messages and authenticates them with a tag. It covers several authenticated encryption schemes:
1. Authenticated Encryption with Associated Data (AEAD) which encrypts a plaintext and authenticates additional associated data with a tag.
2. AES-GCM, the standard authenticated cipher, which uses AES in Galois/Counter Mode. It has two layers - encryption then authentication.
3. OCB, faster than GCM but limited by licensing. It blends encryption and authentication into one layer.
4. SIV, considered the safest as it is secure even if nonces are reused, but it is not streamable.
7. Attacking Android Applications (Part 2)
This document summarizes part 2 of a course on attacking Android applications. It discusses how application components like activities and services can be exploited if not properly protected. Specific vulnerabilities in the Sieve password manager application are demonstrated, including insecure content providers, SQL injection, and an insecure file-backed content provider. The document also covers how services and broadcast receivers can be abused if not protected correctly.
7. Attacking Android Applications (Part 1)
This document discusses attacking Android applications through their components. It covers exploiting vulnerabilities in an app's security model, intercepting communications, and compromising application containers or internet servers that apps rely on. Specific attacks examined include bypassing the lock screen, tapjacking, accessing private app data through recently used screenshots, and changing a PIN without knowing the old one using fragment injection. The document provides examples of how to interact with an app's activities, services, content providers and permissions through intents and other techniques.
5. Stream Ciphers
The document discusses stream ciphers and how they can be implemented in either hardware or software. It describes how stream ciphers work by generating a pseudorandom bitstream from a key and nonce that is XOR'd with the plaintext. Hardware-oriented stream ciphers were initially more efficient to implement than block ciphers using dedicated circuits like LFSRs. However, LFSR-based designs are insecure and modern software-oriented stream ciphers like Salsa20 are more efficient on CPUs. The document cautions that stream ciphers can be broken if the key and nonce are reused or if there are flaws in the implementation.
6 Scope & 7 Live Data Collection
Live data collection on Windows systems can be done using prebuilt kits like Mandiant Redline or Velociraptor, by creating your own scripted toolkit using built-in and free tools to collect processes, network connections, system logs and other volatile data, while following best practices like testing your methods first and being cautious of malware on investigated systems.
More from Sam Bowne (20)
Recently uploaded
Chapter wise All Notes of First year Basic Civil Engineering.pptx
Chapter wise All Notes of First year Basic Civil Engineering
Syllabus
Chapter-1
Introduction to objective, scope and outcome the subject
Chapter 2
Introduction: Scope and Specialization of Civil Engineering, Role of civil Engineer in Society, Impact of infrastructural development on economy of country.
Chapter 3
Surveying: Object Principles & Types of Surveying; Site Plans, Plans & Maps; Scales & Unit of different Measurements.
Linear Measurements: Instruments used. Linear Measurement by Tape, Ranging out Survey Lines and overcoming Obstructions; Measurements on sloping ground; Tape corrections, conventional symbols. Angular Measurements: Instruments used; Introduction to Compass Surveying, Bearings and Longitude & Latitude of a Line, Introduction to total station.
Levelling: Instrument used Object of levelling, Methods of levelling in brief, and Contour maps.
Chapter 4
Buildings: Selection of site for Buildings, Layout of Building Plan, Types of buildings, Plinth area, carpet area, floor space index, Introduction to building byelaws, concept of sun light & ventilation. Components of Buildings & their functions, Basic concept of R.C.C., Introduction to types of foundation
Chapter 5
Transportation: Introduction to Transportation Engineering; Traffic and Road Safety: Types and Characteristics of Various Modes of Transportation; Various Road Traffic Signs, Causes of Accidents and Road Safety Measures.
Chapter 6
Environmental Engineering: Environmental Pollution, Environmental Acts and Regulations, Functional Concepts of Ecology, Basics of Species, Biodiversity, Ecosystem, Hydrological Cycle; Chemical Cycles: Carbon, Nitrogen & Phosphorus; Energy Flow in Ecosystems.
Water Pollution: Water Quality standards, Introduction to Treatment & Disposal of Waste Water. Reuse and Saving of Water, Rain Water Harvesting. Solid Waste Management: Classification of Solid Waste, Collection, Transportation and Disposal of Solid. Recycling of Solid Waste: Energy Recovery, Sanitary Landfill, On-Site Sanitation. Air & Noise Pollution: Primary and Secondary air pollutants, Harmful effects of Air Pollution, Control of Air Pollution. . Noise Pollution Harmful Effects of noise pollution, control of noise pollution, Global warming & Climate Change, Ozone depletion, Greenhouse effect
Text Books:
1. Palancharmy, Basic Civil Engineering, McGraw Hill publishers.
2. Satheesh Gopi, Basic Civil Engineering, Pearson Publishers.
3. Ketki Rangwala Dalal, Essentials of Civil Engineering, Charotar Publishing House.
4. BCP, Surveying volume 1
How to deliver Powerpoint Presentations.pptx
"How to make and deliver dynamic presentations by making it more interactive to captivate your audience attention"
What is Digital Literacy? A guest blog from Andy McLaughlin, University of Ab...
What is Digital Literacy? A guest blog from Andy McLaughlin, University of Aberdeen
Your Skill Boost Masterclass: Strategies for Effective Upskilling
Your Skill Boost Masterclass: Strategies for Effective UpskillingExcellence Foundation for South Sudan
Strategies for Effective Upskilling is a presentation by Chinwendu Peace in a Your Skill Boost Masterclass organisation by the Excellence Foundation for South Sudan on 08th and 09th June 2024 from 1 PM to 3 PM on each day.Hindi varnamala | hindi alphabet PPT.pdf
हिंदी वर्णमाला पीपीटी, hindi alphabet PPT presentation, hindi varnamala PPT, Hindi Varnamala pdf, हिंदी स्वर, हिंदी व्यंजन, sikhiye hindi varnmala, dr. mulla adam ali, hindi language and literature, hindi alphabet with drawing, hindi alphabet pdf, hindi varnamala for childrens, hindi language, hindi varnamala practice for kids, https://www.drmullaadamali.com
Bed Making ( Introduction, Purpose, Types, Articles, Scientific principles, N...
Topic : Bed making
Subject : Nursing Foundation
ANATOMY AND BIOMECHANICS OF HIP JOINT.pdf
it describes the bony anatomy including the femoral head , acetabulum, labrum . also discusses the capsule , ligaments . muscle that act on the hip joint and the range of motion are outlined. factors affecting hip joint stability and weight transmission through the joint are summarized.
বাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
বাংলাদেশের অর্থনৈতিক সমীক্ষা ২০২৪ [Bangladesh Economic Review 2024 Bangla.pdf] কম্পিউটার , ট্যাব ও স্মার্ট ফোন ভার্সন সহ সম্পূর্ণ বাংলা ই-বুক বা pdf বই " সুচিপত্র ...বুকমার্ক মেনু 🔖 ও হাইপার লিংক মেনু 📝👆 যুক্ত ..
আমাদের সবার জন্য খুব খুব গুরুত্বপূর্ণ একটি বই ..বিসিএস, ব্যাংক, ইউনিভার্সিটি ভর্তি ও যে কোন প্রতিযোগিতা মূলক পরীক্ষার জন্য এর খুব ইম্পরট্যান্ট একটি বিষয় ...তাছাড়া বাংলাদেশের সাম্প্রতিক যে কোন ডাটা বা তথ্য এই বইতে পাবেন ...
তাই একজন নাগরিক হিসাবে এই তথ্য গুলো আপনার জানা প্রয়োজন ...।
বিসিএস ও ব্যাংক এর লিখিত পরীক্ষা ...+এছাড়া মাধ্যমিক ও উচ্চমাধ্যমিকের স্টুডেন্টদের জন্য অনেক কাজে আসবে ...
Leveraging Generative AI to Drive Nonprofit Innovation
In this webinar, participants learned how to utilize Generative AI to streamline operations and elevate member engagement. Amazon Web Service experts provided a customer specific use cases and dived into low/no-code tools that are quick and easy to deploy through Amazon Web Service (AWS.)
Beyond Degrees - Empowering the Workforce in the Context of Skills-First.pptx
Iván Bornacelly, Policy Analyst at the OECD Centre for Skills, OECD, presents at the webinar 'Tackling job market gaps with a skills-first approach' on 12 June 2024
clinical examination of hip joint (1).pdf
described clinical examination all orthopeadic conditions .
BBR 2024 Summer Sessions Interview Training
Qualitative research interview training by Professor Katrina Pritchard and Dr Helen Williams
Solutons Maths Escape Room Spatial .pptx
Solutions of Puzzles of Mathematics Escape Room Game in Spatial.io
Recently uploaded (20)
Chapter wise All Notes of First year Basic Civil Engineering.pptx
Chapter wise All Notes of First year Basic Civil Engineering.pptx
Liberal Approach to the Study of Indian Politics.pdf
Liberal Approach to the Study of Indian Politics.pdf
What is Digital Literacy? A guest blog from Andy McLaughlin, University of Ab...
What is Digital Literacy? A guest blog from Andy McLaughlin, University of Ab...
spot a liar (Haiqa 146).pptx Technical writhing and presentation skills
spot a liar (Haiqa 146).pptx Technical writhing and presentation skills
Your Skill Boost Masterclass: Strategies for Effective Upskilling
Your Skill Boost Masterclass: Strategies for Effective Upskilling
Bed Making ( Introduction, Purpose, Types, Articles, Scientific principles, N...
Bed Making ( Introduction, Purpose, Types, Articles, Scientific principles, N...
বাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
বাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
Leveraging Generative AI to Drive Nonprofit Innovation
Leveraging Generative AI to Drive Nonprofit Innovation
Beyond Degrees - Empowering the Workforce in the Context of Skills-First.pptx
Beyond Degrees - Empowering the Workforce in the Context of Skills-First.pptx
NEWSPAPERS - QUESTION 1 - REVISION POWERPOINT.pptx
NEWSPAPERS - QUESTION 1 - REVISION POWERPOINT.pptx
B. Ed Syllabus for babasaheb ambedkar education university.pdf
B. Ed Syllabus for babasaheb ambedkar education university.pdf
Film vocab for eal 3 students: Australia the movie
Film vocab for eal 3 students: Australia the movie
CNIT 128 6. Analyzing Android Applications (Part 3)
- 1. CNIT 128 Hacking Mobile Devices 6. Analyzing Android Applications Part 3
- 2. Topics • Part 1 • Creating Your First Android Environment • Understanding Android Applications • Part 2 • Understanding the Security Model: p 205-222 • Part 3 • Understanding the Security Model: p 222ff • Reverse-Engineering Applications
- 3. Topics in Part 3 • Generic Exploit Mitigation Protections • Rooting Explained • Reverse-Engineering Applications
- 5. Exploit Mitigations • Make the underlying OS more secure • So even unpatched legacy code is safer • Many of these mitigations are inherited from Linux
- 14. Root Access • By default Android doesn't allow users to use root • Rooting typically adds a su binary • Allows elevation to root • So su itself must run as root
- 15. SUID Permissions • Runs with owner's permissions • Even when launched by someone else
- 16. Security of su • On Linux, it asks for a password to allow elevation • On Android, it pops up a box like this
- 17. Rooting Methods • Using an exploit • Using an unlocked bootloader
- 18. Exploits • Gingerbreak • Exploited vold to write to the Global Offset Table (GOT) in Android 2.2 and 3.0 • Bug in Google's original Android • Exynos abuse • Bug in driver for exynos processors, used by Samsung • Only affected some devices
- 19. • Samsung Admire • Exploited dump files and logs to change pemissions on adb • Worked only on specific device • Ace Iconia • Pre-installed SUID binary with code injection vulnerabiliti Exploits
- 20. • Master Key • Make a modified system app • Re-install it with the same signature • Works on most Android versions prior to 4.2 • Towelroot • Exploits locks used when threading • Rooted many devices Exploits
- 21. • Flash new firmware onto device • A new recovery image, or • A rooted kernel image containing su • May void warranty or brick your phone Unlocked Bootloader
- 23. Cyagenmod • Link Ch 6h
- 24. • Link Ch 6i
- 26. In the Projects • Pulling an APK from the phone with adb • Disassemble with apktool
- 27. Vulnerability Scanning • Qark and AndroBugs
- 28. Jadx
- 29. Code Modification