Intro to Mobile Device Testing
$whoami Damian Profancik Senior Security Consultant NCC Group (formerly iSEC Partners) damian.profancik@nccgroup.trust @integrisec
North America Europe Australia Atlanta Austin Chicago New York San Francisco Seattle Sunnyvale Europe Manchester - Head Office Amsterdam Cheltenham Copenhagen Edinburgh Glasgow Leatherhead London Luxembourg Milton Keynes Munich Zurich Australia Sydney
Agenda What? Why? Attack Surface How?
What? iOS (iPhone/iPad) Android (Phones/Tablets) Windows Phone
Why? Ubiquitous Critical data Authentication
Attack Surface Web Server APIs Network Traffic Data on Device Data in Logs Data in Memory Application Source Code
How?
Jailbreak/Root Breaks app sandbox Access file system Allows SSH Allows debugging Disable protections (SSL pinning, JB/Root detection)
Bypass Jailbreak/Root Detection iOS tsProtector P Snoop-it Xcon Android RootCloak
Tools (APIs/Network) Proxy Burp OWASP ZAP Fiddler
Proxying Traffic Set proxy to listen on all interfaces
Proxying Traffic Download proxy CA certificate
Proxying Traffic Install CA certificate on device
Proxying Traffic Redirect traffic to proxy with Wifi Settings
Proxying Traffic Redirect traffic to proxy with VPN Windows: PPTP VPN – Routing and Remote Access Mac: VPNActivator
Proxying Traffic Redirect traffic to proxy with VPN
Bypass Certificate Pinning iOS SSL Kill Switch Snoop-it Android Android-SSL-TrustKiller
Attack Web Server APIs OWASP Top 10 (SQLi, XSS, XXE, etc.) Session Management Authentication/Authorization Logic Flaws Information Leaks
Analyze Network Traffic and Transport Sensitive Information in URLs HTTP SSL v2/v3 Invalid Certificates Weak Ciphers Insecure Renegotiation
Tools (Device Data/Logs) iOS SSH/SCP iFunbox iFile SQLite Reader Xcode (Plist) Keychain-Dumper Snoop-it class-dump-z gdb Android SSH/SCP SQLite Reader Android Studio keytool XML files adb
Tools (iFunbox)
Tools (Snoop-it)
Tools (iOS Logs – Xcode)
Tools (Android – Android Studio)
Tools (Device Memory) iOS Android gdb adb Android Monitor Heap Dump Allocation Tracker
What To Look For Credentials Encryption Keys Cookies Payment Cards Personally Identifiable Information Screenshots Session Tokens Cached Data
Attacking the App SQLite Injection Device XSS WebViews/JavaScript Bridge
Source Code Analysis Android iOS dex2jar apktool JAD Android Studio gdb Xcode
Q/A
Resources OWASP Mobile Top 10 - https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_- _Top_Ten_Mobile_Risks iOS Testing Cheatsheet - https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet Android Testing Cheatsheet - https://www.owasp.org/index.php/Android_Testing_Cheat_Sheet
Resources Network Android SSLyze - https://github.com/nabla-c0d3/sslyze Burp Suite - https://portswigger.net/burp Android Android Studio - http://developer.android.com/sdk/index.html Android-SSL-TrustKiller - https://github.com/iSECPartners/Android-SSL-TrustKiller dex2jar - https://github.com/pxb1988/dex2jar Apktool - http://ibotpeaches.github.io/Apktool/ JAD - http://varaneckas.com/jad/
Resources iOS Xcode - https://developer.apple.com/xcode/download/ SSL Kill Switch - https://github.com/iSECPartners/ios-ssl-kill-switch iFunbox - http://www.i-funbox.com/ snoop-it - https://code.google.com/archive/p/snoop-it/ class-dump-z - https://github.com/nygard/class-dump Keychain-Dumper - https://github.com/ptoomey3/Keychain-Dumper
$whoami Damian Profancik Senior Security Consultant NCC Group (formerly iSEC Partners) damian.profancik@nccgroup.trust @integrisec