�ݺ�ߣ

Android Hax

Jon Oberheide
jon@oberheide.org

Jon Oberheide - Android Hax - SummerCon 2010 �ݺ�ߣ # 1

Agenda

• Android Security Overview

• Market and the Mystical GTalkService

• The RootStrap PDP

• Wrap-Up / Q&A


Android Overview

•
Base platform
•
ARM core
•
Linux 2.6.3x kernel
•
Native Libraries
•
libc, WebKit, etc
•
Dalvik VM
•
Register-based VM
•
Runs dex bytecode
•
Applications
•
Developed in Java
•
Runs on Dalvik VM
•
Linux process 1-1

Jon Oberheide - Android Hax - SummerCon 2010

Hardware Features

●
ARM11 TrustZone?
●
Unused!

●
ARM11 Jazelle JVM?
●
Unused!

●
ARMv6 eXecute-Never (XN)?
●
Unused!


Linux Environment

Executable Non-
stack/heap! randomized
Mobile ASLR sucks. mmap/brk!


Permission-Based Model

●
Apps explicitly request
pre-defined permissions
●
Examples:
●
Cellular: calls, SMS, MMS
●
Network, bluetooth, wifi
●
Hardware settings: vibrate,
backlight, etc
●
Location: coarse/fine
●
App data: contacts, calendar


App Sandboxing

●
“Sandboxed” by standard UNIX uid/gid
●
generated unique per app at install

●
High-level permissions restricted by
Android runtime framework


App Distribution

●
Application signing
●
No CAs
●
Self-signed by developers

●
Android Market
●
$25 signup, anyone can publish
●
Anonymous sign-up possible


App Piracy

●
Trivial copy protection provided by market

Off? On?
●
Apps stored ●
Apps stored in
in /data/app/ /data/app-private/
●
Accessible to ●
Only accessible
users if rooted phone


Agenda




• Wrap-Up / Q&A


Perceived Market Flow

BROWSE INSTALL PAY INSTALLED!

ACTUAL Market Flow

• Google is a sneaky panda!
– You don't actually download / install the app
through the market application

• When you click install in market app
– Google servers push an out-of-band message
down to you via persistent data connection
– Triggers INSTALL_ASSET intent to start install
– Intent handler fetches APK and installs


Dex Bytecode RE


GTalkService Connection

• Persistent data connection
– Speaks XMPP
– Same connection now used for
C2DM push service
• It's SSL, but...
• If you MITM or C2DM spoof
– Remote intent / app install
• If you pop GTalkService servers
– Push down code to all Android phones in the world?

Disclaimer

• Useful though if you want to fetch a
large amount of apps and do some
fuzzing, analysis, whatever
– I've got a repo of ~10k apps


Agenda




• Wrap-Up / Q&A


Android Native Code

• Dalvik VM != sandbox
– Not limited to executing dex bytecode
– Can pop out of the VM to execute native code
• Linux kernel = swiss cheese
– Wonderful attack surface
– Any 3rd party app can root your phone by exploiting a
kernel vulnerability via native code
• Native code packaged within APKs
– But why limit execution of native code to build-time
packaged modules?

RootStrap

• Enter, RootStrap
– Silent runtime fetching and execution of remote
ARM payloads
– Not really a bot..more of a general purpose
distributed computing platform ;-)

• Currently available
in Android market


RootStrap Example


Native ARM Code Delivery

• Fetch index file
– Lists available exploits and module names
– http://jon.oberheide.org/rootstrap/index
• Yank down ARM modules
– Dumped to Android app private storage
– eg. /data/data/org.rootstrap/files, not ./libs
• Load via JNI and execute each payload
– System.load(“.../files/root1.so”);
– result = root1();


How to Build a Mobile Botnet

• Build some fun legit-looking games / apps
– Include RootStrap functionality
– Periodically phone home to check for new payloads

• As soon as new kernel vuln discovered, push
out exploit payload
– Before providers push out OTA patch
– Trivial to win that race, slow OTA updates

• Rootkit a bunch of phones!

A Wolf in Vampire's Clothing?

• RootStrap app is boring and not sneaky
– No one would intentionally download it
– Need something legit looking to get a
significant install base

• How about an RootStrap-enabled app
claiming to be a preview for the upcoming
Twilight Eclipse movie?!?


Fake Twilight Eclipse App


Andy and Jaime Don't Like It :-(

• Still, 200+ downloads
in under 24 hours

• With a legit-looking
app/game, you could
collect quite an install
base for RootStrap


RootStrap Payloads

• sock_sendpage NULL deref
– Old, but still works on some phones
– fork/execve from JNI is a bit wacky

• Supervisor App vulns?
– su without approval
– “jailbroken” phone is less safe

• Meterpretux?

Agenda




• Wrap-Up / Q&A


Wrap-Up

• Native code support sucks.
– Not so easy to take away
– Build-time signing / loader verification?
• Android homework
– Poke at the GTalkService code paths
– Write some RootStrap payloads
– Port to other platforms?
– Fuzz the new Android Acrobat app!

Q&A

QUESTIONS?
Jon Oberheide
@jonoberheide
jon@oberheide.org
http://jon.oberheide.org


�ݺ�ߣ

Android Hax

More Related Content

Android Hax