1. One Root To Own Them All Black Hat US 2013 Jeff Forristal @ Bluebox 1

2. Outline Introduction Android APK Overview Jar and Jar Signer Exploit Analyze APK Install Process – Normal Case – Abnormal Case Vulnerability Point Patch Similar Approach Conclusion Reference 2

3. Introduction 3

4. Vulnerability Description 4

5. Attack Surface 5

6. Android APK Overview 6

7. Android APK APK stands for Android application package file. Just a Jar file with some other new files that Android need. 7

8. Android APK Content Package resource files: – Android Manifest – Some Pictures, Audio files…. – Etc… classes.dex META-INF/Manifest.MF 8

9. Compile Android APK What we usually do: – 1. writing code in Eclipse/ Android Studio – 2. press compile button – Simple and Easy 9

10. Compile Android APK 10

11. Compile Android APK 1. aapt will create R.java according to the following files: – Android Manifest – Recourses – Assets 2. use javac to compile source code with some libraries -> generate many *.class files. 3. use dx to transform Java bytecode into Dalvik bytecode -> many *.class files will be merged into 1 classes.dex 4. use apkbuilder to generate unsigned APK with following files: – classes.dex – Package Resources Files 5. use jarsigner to signed the unsigned APK into signed APK – E(unsigned APK, Key) = signed APK 11

12. Jar and JarSigner 12

13. Jar Jar stands for Java Archive Jar File Format is Same as Zip file File Contents: – *.classes – Resources – META-INF/Manifest.MF 13

14. Jar 14 Android APK

15. JarSigner Generate Signature for JAR (Java Archive) Verify Signature for Signed JAR file. Two Additional file placed in META-INF directory: – signature file with.SF as extension – signature block file with.DSA extension 15

16. JarSigner - Signing 16 aapt jarsigner

17. JarSigner - Signing 17 Integrity

18. JarSigner - Signing 18 Integrity

19. JarSigner - Signing 19 Identity

20. JarSigner - Signing 20 Identity

21. JarSigner - Signing 21 Certificate

22. 22 Public Key Digital Signature for the Certificate

23. Attempts 23

24. Attempts 24

25. Attempts 25

26. APK Install Process 26

27. Overview 27

28. PackageManager 28 PackageParser Installer PackageHandler Parsing Package And Verify Sending Command to installd Handle Event

29. Overview Parsing Verify Install 29

30. Parsing 30 JarFile.Class JarEntry.Class Android APK File 1 File 2 File 3 File 4 Central Directory

31. Parsing 31 JarFile.Class JarEntry.Class Android APK File 1 File 2 File 3 File 4 Central Directory File 1 Meta-Data File 2 Meta-Data File 3 Meta-Data File 4 Meta-Data End of Central Directory

32. Parsing, Verify and Install 1. Get entries list from Central Directory. 2. Create JarEntry object for each entry and put into mEntries HashMap. – The index is calculate by : secondHash(String entry name) 4. JarVerifier will verify each entries according to the mEntries. 5. After Verify, find classes.dex entry and install it. 32

33. Parsing, Verify and Install 1. Get entries list from Central Directory. 2. Create JarEntry object for each entry and put into mEntries HashMap. – The index is calculate by : secondHash(String entry name) 4. JarVerifier will verify each entries according to the mEntries. 5. After Verify, find classes.dex entry and install it. 33

34. Parsing, Verify and Install 1. Get entries list from Central Directory. 2. Create JarEntry object for each entry and put into mEntries HashMap. – The index is calculate by : secondHash(String entry name) 4. JarVerifier will verify each entries according to the mEntries. 5. After Verify, find classes.dex entry and install it. 34

35. Parsing, Verify and Install 1. Get entries list from Central Directory. 2. Create JarEntry object for each entry and put into mEntries HashMap. – The index is calculate by : secondHash(String entry name) 4. JarVerifier will verify each entries according to the mEntries. 5. After Verify, find classes.dex entry and install it. 35

36. Normal Case 36

37. 37 Manife st.xml ZipEntry object Classes.dex META- INF res …….. mEntries 1. Manifest.xml Meta-Data 2. META-INF Meta-Data 3. classes.dex Meta-Data 4. res Meta-Data End of Central Directory Android APK Manifest.xml META-INF res Central Directory classes.dex Parsing

38. 38 Manife st.xml ZipEntry object Classes.dex META- INF res …….. mEntries Verify

39. Install 39 1. Manifest.xml Meta-Data 2. META-INF Meta-Data 3. classes.dex Meta-Data 4. res Meta-Data End of Central Directory Android APK Manifest.xml META-INF res Central Directory installd classes.dex

40. What If … 40 Android APK Manifest.xml META-INF res Central Directory classes.dex res Central Directory Manifest.xml META-INF classes.dex

41. 41 Manife st.xml ZipEntry object Classes.dex META- INF res …….. mEntries Parsing classes.dex res Central Directory Manifest.xml META-INF classes.dex 1. Manifest.xml Meta-Data 2. META-INF Meta-Data 3. classes.dex Meta-Data 5. res Meta-Data End of Central Directory 4. classes.dex Meta-Data Classes.dex

42. 42 Manife st.xml ZipEntry object Classes.dex META- INF res …….. mEntries Classes.dex Verify !!!!!!

43. Install 43 classes.dex res Central Directory Manifest.xml META-INF classes.dex 1. Manifest.xml Meta-Data 2. META-INF Meta-Data 3. classes.dex Meta-Data 5. res Meta-Data End of Central Directory 4. classes.dex Meta-Data installd !!!!!!

44. 44