Is My App Secure ?

transcript

Neo: Is my App Secure ?

Herman Duarte @hdontwit Cláudio André @clviper

Agenda

●  Who ●  Objectives ●  Approach ●  Building blocks ●  Analysis Statistics ●  How we did it ●  Interesting findings ●  Q&A

Herman Duarte @hdontwit

Cláudio André @clviper

-  We work @ Integrity S.A. -  Awesome co-workers and awesome

workplace. -  We identify security issues for our clients to

help them lower their security risks.

-  Evaluate iOS and Android apps from a security point of view.

-  Automate pentest tasks for both Android and

iOS -  Share results. -  Have fun :)

Objectives

Approach

+50 Apps

Client

Network

Server

Vulns by Owasp Risk

Android Vulns by Owasp Risk

iOS Vulns by Owasp Risk

Insecure Data Storage

Transport Layer Security

Android iOS

Certificate Pinning

iOS Background Screenshot

Android Obfuscation

Android Obfuscated Apps By Category

iOS Binary Protection

All apps analyzed have the following security features enabled in the binary: ●  PIE (Posi=on Independent Executable aka ASLR) ●  ARC (Automa=c Reference Coun=ng) ●  SSPRO (Stack Smashing Protec=on) ●  Encrypted binary

-  iOS and Android Security Analyser Tools -  Command line. -  Way to mass analyse ipas and apks. -  Search and Downloads apps (Android only) -  Bulk decryption of apps (iOS only) -  Bulk install, uninstall and backup of apps -  Easy way to extend heuristics check (Android only,

for now)

iStat & Droidstat

https://youtu.be/bOtosGya_G4

https://youtu.be/zPKUj8rb_ok

Droidstat – Intro Video

Droidstat - Checks Config File

https://youtu.be/uWJZa0vgbQ4

Droidstat – Example Findings Video

Interesting Findings

Invoice Registration App (Android)

-  Under 100.000 installs. -  The credentials used for this service is used

on multiple Portuguese Government Public Services websites.

Invoice Registration App

Recommendations: -  Use right TLS implementations that correctly

validate TLS certificates. -  Use strong cryptographic algorithms to store

sensitive information.

Invoice Registration App – Dev Response

“As for the problems, although I think that both are difficult to replicate in a real case , I recognize that the app can be improved , taking this into account we will release an update until the weekend to solve the problems.” June 9

Invoice Registration App – Dev Response

“As for the problems, although I think that both are difficult to replicate in a real case , I recognize that the app can be improved , taking this into account we will release an update until the weekend to solve the problems.” June 9 “The update of this weekend corrects the problems mentioned. Thanks again for the analysis.” June 22

Shopping App (Android & iOS)

-  Between 1M and 5M installs -  More than 10M users.

Shopping App (Android & iOS)

Recommendations: -  Correctly override TLS implementations or

use the framework’s default one, that correctly validate certificates chains.

Mr.Smith: So, you’re asking me if your app is secure?

M2 - Insecure Data Storage

●  In iOS some applications still uses property list files (.plist), or NSUserDefaults (files created in the app Documents folder) to store sensitive information, instead of the keychain.

●  In Android some applications store sensitive information

in shared preferences file and SQLite databases without any type of encryption.

M3 - Insufficient Transport Layer Protection

●  The OS’s framework already does the hard work in TLS, so what we have seen is that the majority of TLS is correctly implemented; Nonetheless when developers override the default implementation, most of the time bad things happen.

●  We have seen that in Android, Certificate Pinning, is

more used that in iOS applications.

M4 - Unintended Data Leakage

●  In iOS the background screenshot information leakage happens most of the time, because it is a side effect of the OS behaviour, that most of developers are not aware of.

M10 - Lack of Binary Protections

●  Regarding Obfuscation we have seen in Android that there are not many apps obfuscated although the SDK comes with tools to do this out of the box.

●  In iOS because of default configurations of XCode,

binary security features (e.g. PIE, ARC, SSPRO) are applied in all of the apps analyzed.

Is My App Secure ?

Mobile