One Root To Own Them All Black Hat US 2013 Jeff Bluebox 1

Outline Introduction Android APK Overview Jar and Jar Signer Exploit Analyze APK Install Process – Normal Case – Abnormal Case Vulnerability Point Patch Similar Approach Conclusion Reference 2

Introduction 3

Vulnerability Description 4

Attack Surface 5

Android APK Overview 6

Android APK APK stands for Android application package file. Just a Jar file with some other new files that Android need. 7

Android APK Content Package resource files: – Android Manifest – Some Pictures, Audio files…. – Etc… classes.dex META-INF/Manifest.MF 8

Compile Android APK What we usually do: – 1. writing code in Eclipse/ Android Studio – 2. press compile button – Simple and Easy 9

Compile Android APK 10

Compile Android APK 1. aapt will create R.java according to the following files: – Android Manifest – Recourses – Assets 2. use javac to compile source code with some libraries -> generate many *.class files. 3. use dx to transform Java bytecode into Dalvik bytecode -> many *.class files will be merged into 1 classes.dex 4. use apkbuilder to generate unsigned APK with following files: – classes.dex – Package Resources Files 5. use jarsigner to signed the unsigned APK into signed APK – E(unsigned APK, Key) = signed APK 11

Jar and JarSigner 12

Jar Jar stands for Java Archive Jar File Format is Same as Zip file File Contents: – *.classes – Resources – META-INF/Manifest.MF 13

Jar 14 Android APK

JarSigner Generate Signature for JAR (Java Archive) Verify Signature for Signed JAR file. Two Additional file placed in META-INF directory: – signature file with.SF as extension – signature block file with.DSA extension 15

JarSigner - Signing 16 aapt jarsigner

JarSigner - Signing 17 Integrity

JarSigner - Signing 18 Integrity

JarSigner - Signing 19 Identity

JarSigner - Signing 20 Identity

JarSigner - Signing 21 Certificate

22 Public Key Digital Signature for the Certificate

Attempts 23

Attempts 24

Attempts 25

APK Install Process 26

Overview 27

PackageManager 28 PackageParser Installer PackageHandler Parsing Package And Verify Sending Command to installd Handle Event

Overview Parsing Verify Install 29

Parsing 30 JarFile.Class JarEntry.Class Android APK File 1 File 2 File 3 File 4 Central Directory

Parsing 31 JarFile.Class JarEntry.Class Android APK File 1 File 2 File 3 File 4 Central Directory File 1 Meta-Data File 2 Meta-Data File 3 Meta-Data File 4 Meta-Data End of Central Directory

Parsing, Verify and Install 1. Get entries list from Central Directory. 2. Create JarEntry object for each entry and put into mEntries HashMap. – The index is calculate by : secondHash(String entry name) 4. JarVerifier will verify each entries according to the mEntries. 5. After Verify, find classes.dex entry and install it. 32

Parsing, Verify and Install 1. Get entries list from Central Directory. 2. Create JarEntry object for each entry and put into mEntries HashMap. – The index is calculate by : secondHash(String entry name) 4. JarVerifier will verify each entries according to the mEntries. 5. After Verify, find classes.dex entry and install it. 33

Parsing, Verify and Install 1. Get entries list from Central Directory. 2. Create JarEntry object for each entry and put into mEntries HashMap. – The index is calculate by : secondHash(String entry name) 4. JarVerifier will verify each entries according to the mEntries. 5. After Verify, find classes.dex entry and install it. 34

Parsing, Verify and Install 1. Get entries list from Central Directory. 2. Create JarEntry object for each entry and put into mEntries HashMap. – The index is calculate by : secondHash(String entry name) 4. JarVerifier will verify each entries according to the mEntries. 5. After Verify, find classes.dex entry and install it. 35

Normal Case 36

37 Manife st.xml ZipEntry object Classes.dex META- INF res …….. mEntries 1. Manifest.xml Meta-Data 2. META-INF Meta-Data 3. classes.dex Meta-Data 4. res Meta-Data End of Central Directory Android APK Manifest.xml META-INF res Central Directory classes.dex Parsing

38 Manife st.xml ZipEntry object Classes.dex META- INF res …….. mEntries Verify

Install Manifest.xml Meta-Data 2. META-INF Meta-Data 3. classes.dex Meta-Data 4. res Meta-Data End of Central Directory Android APK Manifest.xml META-INF res Central Directory installd classes.dex

What If … 40 Android APK Manifest.xml META-INF res Central Directory classes.dex res Central Directory Manifest.xml META-INF classes.dex

41 Manife st.xml ZipEntry object Classes.dex META- INF res …….. mEntries Parsing classes.dex res Central Directory Manifest.xml META-INF classes.dex 1. Manifest.xml Meta-Data 2. META-INF Meta-Data 3. classes.dex Meta-Data 5. res Meta-Data End of Central Directory 4. classes.dex Meta-Data Classes.dex

42 Manife st.xml ZipEntry object Classes.dex META- INF res …….. mEntries Classes.dex Verify !!!!!!

Install 43 classes.dex res Central Directory Manifest.xml META-INF classes.dex 1. Manifest.xml Meta-Data 2. META-INF Meta-Data 3. classes.dex Meta-Data 5. res Meta-Data End of Central Directory 4. classes.dex Meta-Data installd !!!!!!

44