Android Security Evaluation Framework

Transcription

1 INTRODUCING... A S E F Android Security Evaluation Framework - Parth Patel

2 $ whoami_

3 Agenda Manual Research Automation - A S E F Let s solve problems Conclusion

4 Android OS Open Source

5 Security Evaluation of Android Apps

6 Developer Android APP Store Developer Attacker Developer Attacker User

7 Developer Android APP Store Developer Attacker Developer Attacker Bouncer?

8 Developer Android APP Store Developer Attacker Attacker Developer Bouncer?

9 Developer Attacker A A A? User

10 Permissions

11 Manual Research

12 Behavioral Analysis of Apps

13 Utilities for Behavioral Analysis Android SDK - Emulator (Android Virtual Device - AVD) - Android Debug Bridge - adb - Android Asset Packaging Tool - aapt Wireshark dex2jar IDE - eclipse

14 Limitations of Manual Research

15 Introducing... A S E F

16 A S E F as a Black Box Malware Aggressive Adware A S E F Bandwidth Vulnerabilities

17 A S E F Passive Active Interpret Initialization Launch Parsing Normalization Test Cycle Analyzing Organization Results

18 i/p A S E F Phase 1: Passive Initialization Mode Configurator adb refresh Device Detect (virtual/physical) Default Virtual Device = Google Safe Browsing API = Host IP = interface = Session cleanup Enable USB debugging Creates Virtual Device

19 Location of an APP Location of APPs A S E F Phase 1: Passive Normalization Mode Array of.apk path Extractor Extracted APPs

20 A S E F Phase 1: Passive Organization Mode Converter Test Result Archive %HAPK->{$apk} = ( { pkgnm => $PKGNM, launchact => $LAUNCHACT, vercode => $VERCODE, vername => $VERNAME, applable => $APPLABLE, adbstart => "", adbstop => ""}, ); TEST_05_11_12-19:53:56 TEST_05_11_12-20:20:19 TEST_05_13_12-11:38:28 TEST_NIGHTLY_SCAN2 1.apk 2.apk 3.apk adb_log.txt network_traffic.txt adb_log.txt network_traffic.txt adb_log.txt network_traffic.txt

21 A S E F Phase II : Active Launch Mode Virtual Not Running Boot Boot check Display unlock Device Launcher Running

22 start - adb log start - tcpdump start-timestamp Extensive mode kernel log memory dump services running Tm Tm Tm Installation mode Launch mode Activity mode Uninstallation mode kernel log memory dump services running kernel log memory dump services running kernel log memory dump services running stop - adb logcat stop - tcpdump stop-timestamp A S E F Phase II : Active Test Cycle

23 A S E F Phase III : Interpret Parsing Mode Analyzing Mode Results Network Activity Traffic Analyzer URLs/IPs Data tx / BandWidth Google s Safe Browsing API Access rate of URL/IP malware aggressive adware Data usage Bandwidth Vulnerability Detector Associated Permissions Decompilation / APIs used Signatures %HVULN %HAPK Unique permissions of Apps Reconstructing source code Unique APIs Vulnerabilities Permission mapping API mapping apk unzip dex2jar jar2class class2jad Source Code Black listing Found/Add App to the blacklist Black listed

24 A S E F Demo

25 Statistics & Results

26 Apps leaking private information

27 6 Apps - Leaking private data Safe Apps- 74 Total Apps = 80

28 phone number IMIE number

29

30

31 Bandwidth Usage

32 bytes Data usage - 3 min Test Cycle

33 Aggressive Adware

34 (No of Servers accessed) / App 3 min Test Cycle

35 (Access-rate) / App 3 min Test Cycle Threshold

36 Ad req/sec Aggressive Adware

37 Permission mapping

38 mount/unmount filesystem Send SMS Write Contacts Internet Read Contacts Vibrate Permission distribution game apps

39 Vulnerability Scanning

40 No of total Apps No of Vulnerable Apps No of Apps Non-updated Android Apps

41 No of total Apps No of Vulnerable Apps Adobe Flash Player Mozilla Firefox 12 0 No of Apps A S E F Scan - Before updates

42 No of total Apps No of Vulnerable Apps No of Apps

43 No of total Apps No of Vulnerable Apps No of Apps A S E F Scan - After updates 6

44

45

46 Extending the Framework

47 start - cmd line tool start-timestamp start - adb log start - tcpdump Installation mode Command line tools Launch mode Activity mode Uninstallation mode stop - adb logcat stop - tcpdump stop - cmd line tool stop-timestamp

48 Extending the Framework

49 Let s solve problems...

50 A S E F to scan an APP STORE Protect & Promote

51 A S E F in Large Organizations

52 Android APP THE NIGHT PHOENIX

53 NIGHT PHOENIX & A S E F Package Manager NIGHT PHOENIX Extractor of A S E of.apk path apkzip A S E F Server unzip ANDROID

54 NIGHT PHOENIX?? Alarm Manager

55 Who watches THE WATCHMEN

56 THE NIGHT PHOENIX Internet Write external storage

57 THE DARK PHOENIX

58 It is just the beginning...

59 Next Generation of A S E F Scalability - Load balancer module Automated/Custom signature generation Distinguishing updates - Security Fixes UI reporting with correlated results and statistics A S E F in cloud Offline scanning - Crawler module

60 Conclusion?

61 Thank You Twitter [email protected] android-security-evaluation-framework--a-s-e-f A S E F