Mobile Security

8ksec - AndroPseudoProtect: Ultimate Device Security # Reconnaisance # 1. Broadcast Receivers Broadcast receivers are protected and set to DYNAMIC_RECEIVER_NOT_EXPORTED meaning the registered broadcast receiver can only receive broadcasts from apps signed with this app’s signature. It is threfore not exploitable and no need to dig deeper. However reading further down in the manifest, when the Broadcast Receiver is defined, it is does not implement this permission and is set to exported true. This is definitely a security misconfiguration. This means that any app can send a broadcast targeting our app and it will be handled by the SecurityReceiver: <receiver android:name="com.

Static Analysis With Drozer # Package information # I started by enumerating the permissions declared by the app using the command run app.package.list -f insecureshop: Package: com.insecureshop Application Label: InsecureShop Process Name: com.insecureshop Version: 1.0 Data Directory: /data/user/0/com.insecureshop APK Path: /data/app/~~FIyUrbvYY3VB_X0IA7U5Iw==/com.insecureshop-Az0TW47ZRtrdfG9MlqBcNQ==/base.apk UID: 10110 GID: [3003] Shared Libraries: [/system/framework/android.test.base.jar] Shared User ID: null Uses Permissions: - android.permission.INTERNET - android.permission.READ_EXTERNAL_STORAGE - android.permission.WRITE_EXTERNAL_STORAGE - android.permission.READ_CONTACTS - android.permission.WAKE_LOCK Defines Permissions: - com.insecureshop.permission.READ The IPC attack surface # To evaluate the attack surface exposed via Android’s IPC layer, I ran the command run app.package.attacksurface com.insecureshop, which returned the following output: Attack Surface: 6 activities exported 0 broadcast receivers exported 1 content providers exported 1 services exported is debuggable The exported IPC components give an attacker several entry points into the app.

GOAL: Intercept network traffic in FactsDroid and view/modify the API requests and responses between FactsDroid and the backend server without statically patching the provided APK. The objective is to successfully implement a Man-in-The-Middle (MITM) attack that allows you to manipulate the facts being displayed to the user, potentially inserting custom content or modifying the retrieved facts before they reach the application. Upon installing the app using adb install factsdroid.apk, I immediately see this error message when launching the app: In order to bypass the root check, I injected the Frida anti-root script into my APK: frida -U --codeshare dzonerzy/fridantiroot -f com.