หัวข้อ: Mysterious Crypto in Android Biometrics วิทยากร: Pongsakorn Sommalai งาน: 2600 Thailand Meeting #51 Date: Wednesday, October 2, 2019 at 6:30 PM – 8:30 PM Event URL: https://www.facebook.com/events/559009754638956/

1. Mysterious Crypto in Android
Biometrics
Responsible: Mr. Pongsakorn Sommalai
Version (Date): 1.0 (2019-10-02)
Confidentiality class: Public
บจก.สยามถนัดแฮก

2. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Mr. Pongsakorn (Bongtrop) Sommalai
Penetration Tester
Siam Thanat Hack Company Limited
Whoami
It’s me.

3. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Overview
3
- Introduction
- Android Biometrics (Authentication) Security
- Android Keystore
- Cryptographic Library in Android
- Biometric Prompt
- Example Applications
- AndroidKeyStore
- The better way (let's discuss)

4. Introduction
บจก.สยามถนัดแฮก

5. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
What is Biometrics (Authentication)?
5
http://fintechnews.sg/18096/mobile-payment/singaporeans-interested-in-biometrics-authentication-and-payments/

6. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Password & PIN

7. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Password & PIN
000000

8. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
8
1 2
Celeb’s Opinion

9. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public

10. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Today’s Scenario
10
Scenario: The sophisticated threat actors or APT malware with access to the
victim’s device.
Not these:

11. Android Biometric
Implementation
บจก.สยามถนัดแฮก

12. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
What is Keystore ?
12
A safe box which can store cryptographic keys.

13. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
FriendZone Technology and the Trusted Execution Environment (TEE)
13

14. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
TrustZone Technology and the Trusted Execution Environment (TEE)
14

15. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
AndroidKeyStore and his Friend
15

16. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Key Material in AndroidKeyStore
16
- Generate in secure world
- Encrypt in secure world
- Decrypt in secure world
- XXX in secure world
Can you gimme a key? Can you decrypt for me?

17. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Cryptographic Library in Android
17
https://developer.android.com/guide/topics/security/cryptography

18. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Biometric Prompt
18
https://android-developers.googleblog.com/2018/06/better-biometrics-in-android-p.html

19. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Example Application #1
19
// For the "insecure" method, the app relies on onAuthenticationSucceeded function being called
btInsecureActivity.setOnClickListener(new View.OnClickListener() {
@Override
public void onClick(View view) {
new BiometricPrompt(MainActivity.this, executor, new BiometricPrompt.AuthenticationCallback() {
@Override
public void onAuthenticationSucceeded(@NonNull BiometricPrompt.AuthenticationResult result) {
super.onAuthenticationSucceeded(result);
i = new Intent(MainActivity.this, InsecureActivity.class);
startActivity(i);
}
}).authenticate(promptInfo);
}
});
Let’s play !!

20. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Example Application #1
20

21. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Example Application #2
21
KeyStore + Cryptographic + BiometricPrompt

22. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Example Application #2
22
Generate Key
Init Phrase
Encrypt a Secret Store it Somewhere
Fetch Key
Access Phrase
Authenticate Decrypt a Secret
Secure
World
Secure
World
Secure
World
Only
Object

23. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Example Application #2
23
Take a Look at the Source Code !!

24. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Interesting Property of a Key
24
- isInsideSecureHardware
- isInvalidatedByBiometricEnrollment
- isUserAuthenticationRequired
- isUserAuthenticationRequirementEnforcedBySecureHardware
- isUserAuthenticationValidWhileOnBody
- userAuthenticationValidityDurationSeconds

25. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Example Application #SDHMobile
25
Let’s play with this scenario !!

26. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Store encrypted PIN or TOKEN for authentication.
Is it secure ?
26

27. Possible Attacks on
AndroidKeyStore
บจก.สยามถนัดแฮก

28. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
AndroidKeyStore Recap
28
- Generate in secure world
- Encrypt in secure world
- Decrypt in secure world
- XXX in secure world
Can you gimme a key? Can you decrypt it for me?
However, the key must be stored in somewhere right?

29. The better ways (let’s discuss)
บจก.สยามถนัดแฮก

30. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Challenge Response Authentication (Symmetric)
30

31. บจก.สยามถนัดแฮก
Responsible / Version: Mr. Pongsakorn Sommalai / 1.0 (2019-10-02)
Confidentiality class: Public
Challenge Response Authentication (Asymmetric)
31

32. Q & A
บจก.สยามถนัดแฮก
Contact us:
pentest@sth.sh