ºÝºÝߣ

ºÝºÝߣShare a Scribd company logo

Cracking the Mobile Application Code

?Download as PPTX, PDF?
?
c0c0n - International Cyber Security and Policing Conference
c0c0n - International Cyber Security and Policing Conference

Cracking the Mobile Application Code by Sreenarayan A. at c0c0n - International Cyber Security and Policing Conference http://is-ra.org/c0c0n/speakers.html

1 of 24
Cracking the Mobile Application Code - Sreenarayan A Paladion Mobile Security Team
Take Away for the day ? Purpose of Decompiling Mobile Applications ? Methodology of Decompilation ? Live Demo¡¯s: ¨C Android App ¨C iOS (iPhone / iPad App) ¨C Blackberry Apps / Nokia App
Why is security relevant for Mobile Platform? ? 400% Increase in the number for Organizations Developing Mobile Platform based applications. ? 300% Increase in the no of Mobile Banking Applications. ? 500% Increase in the number of people using the Mobile Phones for their day to day transactions. ? 82% Chances of end users not using their Mobile Phones with proper caution. ? 79% Chances of Mobile Phone users Jail Breaking their Phones. ? 65% Chances of Mobile Phone users not installing Anti-virus on their Mobile Phones. ? 71% Chances of any application to get misused. ? 57% Chances of a user losing his sensitive credentials to a hacker.
Market Statistics of Mobile Users
Mobile Market Trends
Different Types of Mobile Applications ? WAP Mobile Applications ? Native Mobile Applications ? Hybrid Mobile Applications
Different Types of Mobile Applications
Different Types of Mobile Architecture
Cracking the Mobile Application Code
Why did we learn the above types?? ? Which applications can be Decompiled? ¨C WAP Mobile Applications ? ¨C Native Mobile Applications ? ¨C Hybrid Mobile Applications ? ? We have to get to know of the basics!
Cracking the Mobile Application Code
Cracking the Mobile Application Code ?What do you mean by Reverse Engineering? ?What do you mean by Decompilation? -> What is Compilation? Questions to be answered: ?What are the goals/purpose of Cracking the code? ?What is the methodology of Decompilation? ?What the tools which can be used to Decompile? ?Can Decompilation be done on all platforms? 1. ANDROID ? 2. iPHONE / iPAD ? 3. BLACKBERRY ? 4. NOKIA ?
Goal of cracking the Mobile Application Code
Goals of Cracking the Source Code ?¡°UNDERSTAND THE WORKING OF THE APPLICATION AND TO FIGURE OUT THE LOOPHOLES!¡± ?To find Treasure Key Words (password , keys , sql, algo, AES, DES, Base64, etc) ?Figure out the Algorithms Used and their keys. ?By-passing the client side checks by rebuilding the app. ?E.g. Password in Banking Application (Sensitive Information) ?E.g. Angry Birds Malware (Stealing Data) ?E.g. Zitmo Malware (Sending SMS) ?We have understood the goals, how to achieve them? Methodology.
Methodology of Cracking
Methodology / Study S1: Gaining access to the executable S2: Understanding the Technology used to code the application. S3: Finding out ways to derive the Object Code from the Executable. S4: Figuring out a way to derive the Class Files from the Object Code. S5: Figuring out a way to derive the Function Definitions from the Object Code
JUMP TO DEMO¡¯s
Demo - Reverse Engineer the Android Application ?Tools used: -De-compresser (Winrar / Winzip / 7zip) -Dex2jar -Jar Decompiler ?Steps 1. .apk -> .dex 2. .dex -> .jar 3. .jar -> .java ? Demo ? Limitations
Demo - Reverse Engineer the iOS Application ?Tools used: -iExplorer -Windows Explorer -oTool -Classdumpz ?Steps 1. .app -> Garbage (Object Code) (DVM) 2. Object Code -> .Class ? Demo ? Limitations
Demo - Reverse Engineer the Blackberry Application ?Tools used: -JD ¨C GUI (Java Decompiler) -Notepad ?There are two types of Application files found in Blackberry: 1. .Jar (.jad -> .jar) 2. .Cod (.jad -> .cod (Blackberry Code Files) ?Steps 1. .jar -> .java (JD-GUI) Or 1. Notepad to open .cod (No luck!) ? Demo ? Limitation
Tip - Reverse Engineer the Windows Phone Application ?Tools used: -.net decompiler -Visual Studio with Windows Phone SDK
Palisade Articles ? iOS vs Android Testing ? Mobile Data Encryption ? Mobile Application Security Testing ? Demystifying the Android ? And ¡­ ? Website link: palpapers.paladion.net
? Questions and Answers ? Quiz ? Feedback
Thank You Sreenarayan.india@gmail.com Sreenarayan.a@paladion.net Twitter: Ace_Sree

More Related Content

Cracking the Mobile Application Code

  • 1. Cracking the Mobile Application Code - Sreenarayan A Paladion Mobile Security Team
  • 2. Take Away for the day ? Purpose of Decompiling Mobile Applications ? Methodology of Decompilation ? Live Demo¡¯s: ¨C Android App ¨C iOS (iPhone / iPad App) ¨C Blackberry Apps / Nokia App
  • 3. Why is security relevant for Mobile Platform? ? 400% Increase in the number for Organizations Developing Mobile Platform based applications. ? 300% Increase in the no of Mobile Banking Applications. ? 500% Increase in the number of people using the Mobile Phones for their day to day transactions. ? 82% Chances of end users not using their Mobile Phones with proper caution. ? 79% Chances of Mobile Phone users Jail Breaking their Phones. ? 65% Chances of Mobile Phone users not installing Anti-virus on their Mobile Phones. ? 71% Chances of any application to get misused. ? 57% Chances of a user losing his sensitive credentials to a hacker.
  • 4. Market Statistics of Mobile Users
  • 6. Different Types of Mobile Applications ? WAP Mobile Applications ? Native Mobile Applications ? Hybrid Mobile Applications
  • 7. Different Types of Mobile Applications
  • 8. Different Types of Mobile Architecture
  • 10. Why did we learn the above types?? ? Which applications can be Decompiled? ¨C WAP Mobile Applications ? ¨C Native Mobile Applications ? ¨C Hybrid Mobile Applications ? ? We have to get to know of the basics!
  • 11. Cracking the Mobile Application Code
  • 12. Cracking the Mobile Application Code ?What do you mean by Reverse Engineering? ?What do you mean by Decompilation? -> What is Compilation? Questions to be answered: ?What are the goals/purpose of Cracking the code? ?What is the methodology of Decompilation? ?What the tools which can be used to Decompile? ?Can Decompilation be done on all platforms? 1. ANDROID ? 2. iPHONE / iPAD ? 3. BLACKBERRY ? 4. NOKIA ?
  • 13. Goal of cracking the Mobile Application Code
  • 14. Goals of Cracking the Source Code ?¡°UNDERSTAND THE WORKING OF THE APPLICATION AND TO FIGURE OUT THE LOOPHOLES!¡± ?To find Treasure Key Words (password , keys , sql, algo, AES, DES, Base64, etc) ?Figure out the Algorithms Used and their keys. ?By-passing the client side checks by rebuilding the app. ?E.g. Password in Banking Application (Sensitive Information) ?E.g. Angry Birds Malware (Stealing Data) ?E.g. Zitmo Malware (Sending SMS) ?We have understood the goals, how to achieve them? Methodology.
  • 16. Methodology / Study S1: Gaining access to the executable S2: Understanding the Technology used to code the application. S3: Finding out ways to derive the Object Code from the Executable. S4: Figuring out a way to derive the Class Files from the Object Code. S5: Figuring out a way to derive the Function Definitions from the Object Code
  • 18. Demo - Reverse Engineer the Android Application ?Tools used: -De-compresser (Winrar / Winzip / 7zip) -Dex2jar -Jar Decompiler ?Steps 1. .apk -> .dex 2. .dex -> .jar 3. .jar -> .java ? Demo ? Limitations
  • 19. Demo - Reverse Engineer the iOS Application ?Tools used: -iExplorer -Windows Explorer -oTool -Classdumpz ?Steps 1. .app -> Garbage (Object Code) (DVM) 2. Object Code -> .Class ? Demo ? Limitations
  • 20. Demo - Reverse Engineer the Blackberry Application ?Tools used: -JD ¨C GUI (Java Decompiler) -Notepad ?There are two types of Application files found in Blackberry: 1. .Jar (.jad -> .jar) 2. .Cod (.jad -> .cod (Blackberry Code Files) ?Steps 1. .jar -> .java (JD-GUI) Or 1. Notepad to open .cod (No luck!) ? Demo ? Limitation
  • 21. Tip - Reverse Engineer the Windows Phone Application ?Tools used: -.net decompiler -Visual Studio with Windows Phone SDK
  • 22. Palisade Articles ? iOS vs Android Testing ? Mobile Data Encryption ? Mobile Application Security Testing ? Demystifying the Android ? And ¡­ ? Website link: palpapers.paladion.net
  • 23. ? Questions and Answers ? Quiz ? Feedback