1. ON THE SECURITY OF ANDROID COMMUNICATION APPS September 2015 By Shasi Pokharel Bachelor Of Information Technology (Honours) Supervisors: Dr. Raymond Choo, Dr. Jixue Liu

2. Why Android: Share of Total Smartphone Market: 82.8%  iOS: 13.9% (up to Quarter 2, 2015; Source: idc.com) Number of Apps in Google Play: 1.6 million  App Store: 1.5 million (up to July, 2015; Source: statista.com) Share of Mobile attack Target: 99% - as January, 2014; Source: Kaspersky Lab

3. Focus:  Study popular Android communication apps  An adversary model  Case study apps

4. Communication Apps: VoIP Apps:  Growing popularity  Free app to app call, Cheaper app to phone call  Voice Call, Video Call, Conference Call, Text messages  Cross-Platform Mobile Browsers  Application to browse web pages in Mobile

5. VoIP Communication Encoding/Decoding : Analog Voice > Digital data > Analog Voice Characteristics of Codecs  Bit rate (Kbps)  Sample Size (Byte)  Sample Interval (ms)  Packet Per second (PPS) Constant Bit Rate (CBR) or Variable Bit Rate(VBR) Proprietary Codecs

6. Parts of VoIP Communication Signalling Control Session (SIP)  Session establishment  Codec negotiation RTP session  Voice data transfer

7. Identify Codec from intercepted packets If Signalling Control Session is not encrypted.

8. VoIP communication security  Encryption  Signalling Control Session Encryption  RTP packets Encryption  Proprietary Codec

9. Identify Codec from intercepted packets If Signalling Control Session is encrypted:  Calculate bit rate for each seconds from RTP payload  If (bitrate is constant)  Constant Bit rate(CBR) codec is used  Select matching or closest bitrate codecs  If (bitrate is dynamic)  Variable Bit rate (VBR) codec is used  Select “opus” decoder tool for decoding

10. Formula 1: Calculate Bit rate from RTP payload

11. Identify Codec from intercepted packets

12. Decoder Tools For CBR codec: RTP to wave decoders are freely available:  G.711, G.722, GSM : decoded by CloudShark  G.729, ILBC : decoder tool available for download  For VBR: we created a java applications  Takes each RTP packet from captured file  Decodes using official native libraries  Add header for linear wave sound  Save as wave file

13. Result

14. Part 2: Mobile Browser Lightweight Browsers:  Faster for web page loading  Growing popularity  Limited Plugins

15. Selected Browsers for Experiment

16. Browser Cache  Saves web resources when downloaded for the first time  Are loaded to the browser, when user access the same site  Contain: HTML file, CSS, JavaScript and media files

17. Android File System for applications Internal Storage: MODE_PRIVATE; accessible only by creator application, by default External Storage: Accessible to all applications

18. Cache Storage of the browsers Dolphin:  Cache resources: /sdcard/TunnyBrowser/Cache/webViewCache  Screenshots of tabs: /sdcard/TunnyBrowser/Cache/tablist_cache  Speed dial URLs: /sdcard/TunnyBrowser/Cache/speeddial_covers UC Browser:  Cache resources: sdcard/UCDownloads/cache/com.UCMobile.inti/  Data Traffic detail: /sdcard/UCDownloads/config/TrafficStats.db  Detailed browsing data: /sdcard/UCDownloads/offline/ApplicationCache.db

19. Cache Storage of the browsers Samsung Stock Browser:  Cache resources: /data/data/com.sec.android.app.sbrowser/cache/Cache/  Screenshots : /data/data/com.sec.android.app.sbrowser/files/thumbnail.bmp1 (Permission: Mode 644) CM Browser:  Cache Resources: /data/data/com.ksmobile.cb/app_webview/Cache  Browser History: /sdcard/CheetahBrowser/.data/

20. Why use External storage ? Larger Cache storage Capability Avoid risk of file deletion by System

21. Proposed adversary model Adversary Capability: Install application in user’s device Goals:  Know URLs visited by user  Know searched items : searched by user  Know the content of the webpage, visited by user

22. Application User Permission required:  WRITE_EXTERNAL_STORAGE  ACCESS_NETWORK_STATE Permission granted by Android, without users approval  READ_EXTERNAL_STORAGE  INTERNET

23. Targeted activities of application Know, when user started using browser Copy cache files to the Internal storage Upload files to the server Change content (Poison) in cache

24. Work Flow of the application

25. Result

26. Video: Getting Browsed content From Samsung Stock browser.

27. Conclusion Many Android users private information is at risk Adversary can:  Listen What the user is talking  See what the user is Browsing

28. Thank You