Android security knowledge, including dynamic and static analysis, and a brief overview of MultiDex.

I. Overview

Let's explore some basic knowledge related to Android security. We'll cover static analysis and dynamic analysis. Static analysis is a technique that involves analyzing the source code of an application while it's not running, in order to identify vulnerabilities. Dynamic analysis, on the other hand, involves analyzing the structure of hooking or ELF executable files while the application is running, in order to identify vulnerabilities. Key security checks for mobile applications include: 1) Whether the OS modification detection function is implemented, 2) Program integrity verification, 3) Whether sensitive information is exposed in memory, 4) Whether sensitive information is stored on the device, and 5) Circumventing authentication steps through forced screen execution.

II. A collection of knowledge related to Android security.

The main points are: Dynamic analysis, Static analysis, MultiDexThis will be a review-style post related to previous articles. Therefore, please bear in mind that the initial paragraph may lack a clear structure. First, similar to iOS, Android also includes features in apps to protect devices from malicious code apps. Developer's signatureThis is essential. Apps without signatures cannot be installed or run, and the signature itself makes it difficult to tamper with. Smishing (using text messages to steal personal information and extort money)When performing an attack, the target is identified based on the website address. To determine whether the attacking device is actually attempting to extract personal information and to verify which device is being used, what steps should be taken? This is also something to consider during web development, but it relates to the operating system. user agentSince the user agent value is available, it allows the attacker to identify the target device and then attempt an attack. This also enables web service operators to differentiate between mobile and PC devices by displaying different web pages based on the user agent, and to distribute malware tailored to specific operating systems.

※ TIP: When identifying virtual Android apps like Nox Player or LD Player, it's also important to check for additional information such as Bluetooth connectivity, mobile carrier details, and phone number.

※ From a network infrastructure perspective, network segmentation is also used to separate the internal network and guest network, thereby maintaining security.

While previous posts mentioned that iPhones have strong security, it's important to note that both iPhones and Android devices can be vulnerable due to the use of C programming language. This is particularly relevant when developing applications for both platforms, as developers may inadvertently include common C code in their projects. In the case of Android, C code can be executed through native libraries.

The practical exercise involved decompiling and repackaging Android APK files, analyzing and modifying the code. I am providing only the relevant decompilation and compilation commands. Additionally, I have included relevant Google documentation related to Android assembly language (Smali).

java -jar apktool_2.5.0.jar(java의 디컴파일, 컴파일 도구) d(디컴파일 옵션) apk(디컴파일 할 apk명) path(저장경로 및 디렉토리명)
java -jar apktool_2.5.0.jar b(컴파일 옵션) directory(컴파일 할 소스 코드 담긴 디렉토리) -o(이 옵션 다음에 apk 저장할 디렉토리) apk(새로 만들 apk명)

Dalvik bytecode  |  Android Open Source Project  |  Android Open Source Project

Dalvik Executable format  |  Android Open Source Project  |  Android Open Source Project

Ⅲ. Static Analysis and Dynamic Analysis

Static analysisThis refers to a situation where the application is not running. In the source codeThis is a technique for identifying defects. Decompile The analysis is performed by examining the source code through the APK file, either in assembly language or the original source code. Several tools can be used for this purpose, including APKtool and jadx, as mentioned earlier. In Android, it is possible to examine the `AndroidManifest.xml` file and the signing information to get a general idea of the permissions being used and whether the application is malicious. In the DEX structure, each function classes.dexBecause it is bound by rules,

Based on this structure, I will attempt to analyze the source code.

Dynamic analysisThis is an analysis technique used to identify vulnerabilities in an application while it is running. It involves modifying user input or the application's execution flow to determine how vulnerabilities might arise. Specifically, it involves modifying data or the application's execution flow while it is running. Attracting; capturingThis is necessary. By using Frida, a tool well-known for hooking, we can examine the classes and methods within an application, understand how they function, and even modify their behavior. FridaWhile it is based on JavaScript and has some pre-built structures, you need to create the code logic yourself. In addition, it also uses Java. JEBThere is also a commercial software that utilizes this. It's said that ELF (Executable and Linkable Format) files, which originally referred to executable files in the Unix family, are often dynamically loaded on Android. These files are written in C/C++ and will function through Native Libraries, due to their connection with the Linux system, which forms the foundation of Android.

Looking at the table, there are five key items that need to be checked on a mobile application. First, Detection of O/U (Over/Under) modulationThis is a check to determine whether the system administrator has full control over the device, including the ability to manage the operating system. In the case of Android: RootingFor iPhones, Escaping from prisonThis is because, when a regular user roots or "jails" their device, the security system, known as a "sandbox," may lose its functionality, making the device extremely vulnerable. Furthermore, if the device is compromised by malware, all data stored on it could be stolen, leading to a serious situation.

※ While many programs are designed for mobile devices, some programs can also be used on PCs and may require elevated system privileges. This can pose a security risk, as these programs could potentially be exploited to access information on your PC. For example, programs like VMware and Nox Player, which allow direct access to the kernel, are particularly risky.

Therefore, to detect such OS modifications, specific apps can be used. System configuration files (ro.debuggable, service.adb.root) Check if the back button is functioning correctly, or verify if the Android operating system is running and if the root command "su" is being executed. Files installed during rooting (e.g., /sbin/su, /system/su, /system/bin/su, /system/xbin/su, /system/app/Superuser.apk)You can check to see if there are any.

getprop | grep debug

If you try entering this command,

You can see this result: if the "ro.debuggable" value is 0, it means the device is not rooted; if it's 1, it means the device is rooted.

Program integrity verificationThis is a particularly important area for regular users to be aware of, as it may not be immediately obvious. Even if an application appears normal, it could still contain malicious code internally. Caution is advised. Apps downloaded from unofficial sources like the APK market are particularly risky, as they are not available through the official Google Play Store. iOS is relatively safer because apps can only be downloaded from the App Store. Windows also requires caution, as it allows easy downloading and use of programs from the web, which can lead to irreversible consequences once the program is executed.

Exposure of sensitive information stored in memoryThis is a significant security concern because it involves exploiting the memory of all devices. In reality, every application consumes memory, and data is constantly being stored and deleted. If someone could access this memory in real-time, Dump memory informationIf you do this, your account and password, card number, and bank account details could all be exposed. That's why it's important not to save sensitive information like that in your device's memory. If it exists only as a plain text, it represents a vulnerability.and, EncryptionIt is crucial to ensure that memory information cannot be accessed, even if it is leaked. This is particularly important in web environments. Since JavaScript has security vulnerabilities, exposing it directly can be risky. Encrypt personal information when storing it in the database.It needs to be complex and difficult to decipher.

Storing important information within the device.However, this is not a common occurrence. Sensitive personal information is stored in a standard directory or an external storage location.If a device is ever hacked, all personal information could be stolen. In the case of games, if user data remains, there might be ways to manipulate it to play the game (???) but this is unlikely to happen. This applies not only to games, but also to banks. Because we manage important information on the server and pay very close attention to server security, Generally, it can be considered safe. However, it is relatively less risky, especially if the user does not store important information on the device itself.

Bypassing the authentication step due to forced screen execution....such as logging in or entering a key. Files related to the certification processBy manipulating the system, it is possible to gain access to the user's application and extract personal information. Androidmanifext.xmlThe application's permissions and components are defined, and if the exported value is true, other applications or systems can directly access the service. If it's false, access is limited to within the application itself. If these settings allow external applications to... Login activitiesAccessing and interacting with the login activity. Call other activities It is possible to bypass the authentication steps. This means that malware could execute other malicious code, rather than relying on the normal login-related functions.

Ⅳ. MultiDex

MultiDexIn simpler terms, it's helpful to think of the Dex structure as having two layers.

You should be able to understand this by looking at the image. The reason for this structure is: Limitations of the method That's because, while this doesn't apply to simple applications, if an application offers a wide range of features or relies on numerous libraries during development, using many methods can create limitations when packaging it into a single DEX (Android App Bundle). 64KB reference limitThis is referred to as a 64K reference limit, because it can only contain a maximum of 65,536 methods, and the value of the number is the same as 64 x 1,024. As shown in the image above, Main DatabaseWow Sub-categoryThe application is designed with a specific structure that allows for dynamic loading of components. However, this structure isn't always necessary; it can be beneficial in certain situations. In the case of Sub Dex, the codes can be hidden, It's possible to hide important code within a Sub Dex and run standard code from the Main Dex. By decompiling the APK file, you can see that the Main and Sub Dexs are located in separate areas.

ELF (Executable and Linkable Format)Let's briefly explore how to call and use functions in Android.

This involves running C/C++ code using native libraries within an Android structure, specifically when a CLASS method within a DEX structure needs to access an ELF method. PLT (Procedure Linkage Table)This allows for easy loading. The PLT (Procedure Link Table) is a table that connects external procedures and stores their addresses. GOT (Global Offset Table)These can be retrieved by referencing the GOT. GOT (Global Offset Table) is a table within the ELF file (as shown in the diagram) that contains the addresses of procedures referenced by the PLT (Procedure Linkage Table). In other words, within the Android DEX structure, the CLASS's METHOD has the ELF methods it needs to execute, and the PLT uses the GOT to load these methods.

When you open the APK file, you'll find various components, but one of them is a "lib" directory. Inside this directory, you'll find ELF files.

These are included in the form of lib[name].so (Shared Object). The '.so' extension signifies an executable file in Linux, and ELF represents the executable file structure in Linux, similar to PE in Windows.

Review

Actually, I wrote this post before writing the actual content today. This week, I've noticed a significant decrease in the number of posts I'm able to write, likely because I've been learning about hacking techniques. So, I'm going to personally summarize everything and conclude this post with the vulnerability assessment section. It feels good to have fewer posts to write.😆