Mobile Top 10 2014-M10 - Revision history

Barbarafox at 18:33, 8 October 2015

2015-10-08T18:33:13Z

Andipannell: added dex2jar reversing for Android

2015-03-19T18:07:38Z

added dex2jar reversing for Android

Andipannell at 17:51, 19 March 2015

2015-03-19T17:51:56Z

Daath at 14:09, 3 March 2015

2015-03-03T14:09:10Z

Jmanico: trying to make this more honest

2014-11-12T09:38:34Z

trying to make this more honest

Jmanico: trying to make this more honest

2014-11-12T09:32:07Z

trying to make this more honest

Jmanico: trying to make this much more honest

2014-11-12T09:17:23Z

trying to make this much more honest

Daath at 15:55, 21 October 2014

2014-10-21T15:55:23Z

Daath at 15:54, 21 October 2014

2014-10-21T15:54:55Z

Jonathan Carter: Update to reference hyperlinks

2014-02-06T17:50:41Z

Update to reference hyperlinks

@@ Line 12: / Line 12: @@
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>An adversary will use an automated tool to reverse engineer the code and modify it using malware to perform some hidden functionality.</td>
       <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>'''Prevalence'''
-A lack of binary protections within a mobile app exposes the application and it’s owner to a large variety of technical and business risks if the underlying application is insecure or exposes sensitive intellectual property.  A lack of binary protections results in a mobile app that can be analyzed, reverse-engineered, and modified by an adversary in rapid fashion. However, an application with binary protection can still be reversed by a dedicated adversary and therefor binary protection is not a perfect security solution. At the end of the day, binary protection only slows down a security review.
+A lack of binary protections within a mobile app exposes the application and it’s owner to a large variety of technical and business risks if the underlying application is insecure or exposes sensitive intellectual property.  A lack of binary protections results in a mobile app that can be analyzed, reverse-engineered, and modified by an adversary in rapid fashion. However, an application with binary protection can still be reversed by a dedicated adversary and therefore binary protection is not a perfect security solution. At the end of the day, binary protection only slows down a security review.
 It is extremely common for apps to be deployed without binary protection. The prevalence has been extensively studied by a large number of security vendors, analysts, and researchers <sup>&#91;[[#ReferenceItem1|1]]&#93;</sup> <sup>&#91;[[#ReferenceItem2|2]]&#93;</sup> <sup>&#91;[[#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[#ReferenceItem17|17]]&#93;</sup>.
@@ Line 30: / Line 30: @@
 '''Unauthorized Code Modification'''
-Binary protections slow an adversary from modifying the underlying code or behavior to disable or add additional functionality on behalf of the adversary.  This is likely to occur if the app stores, transmits, or processes personally identifiable information (PII) or other sensitive information assets like passwords or credit cards.  Code modification often takes the form of repackaging or insertion of malware into existing mobile apps <sup>&#91;[[#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[#ReferenceItem18|18]]&#93;</sup>.
+Binary protections slow an adversary from modifying the underlying code or behavior to disable or add additional functionality on behalf of the adversary.  This is likely to occur if the application stores, transmits, or processes personally identifiable information (PII) or other sensitive information assets like passwords or credit cards.  Code modification often takes the form of repackaging or insertion of malware into existing mobile apps <sup>&#91;[[#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[#ReferenceItem18|18]]&#93;</sup>.
 </td>

@@ Line 55: / Line 55: @@
 If you answer yes to any of these questions, you are vulnerable to a binary attack:
 :* Can someone code-decrypt this app (iPhone specific) using an automated tool like ClutchMod or manually using GDB?
 :* Can someone use an automated tool like Hopper or IDA Pro to easily visualize the control-flow and pseudo-code of this app?

← Older revision		Revision as of 17:51, 19 March 2015
Line 79:		Line 79:

	The remediation strategies for these types of risks are outlined in more technical detail within the [https://www.owasp.org/index.php/Technical_Risks_of_Reverse_Engineering_and_Unauthorized_Code_Modification OWASP Reverse Engineering and Code Modification Prevention Project].		The remediation strategies for these types of risks are outlined in more technical detail within the [https://www.owasp.org/index.php/Technical_Risks_of_Reverse_Engineering_and_Unauthorized_Code_Modification OWASP Reverse Engineering and Code Modification Prevention Project].
		+
		+	'''Android Specific Best Practices:'''
		+
		+	'''Android Root Detection'''
		+
		+	There are a few common ways to detect a rooted Android device:<br>
		+	Check for test-keys
		+	:* Check to see if <tt>build.prop</tt> includes the line ''ro.build.tags=test-keys'' indicating a developer build or unofficial ROM
		+	Check for OTA certificates
		+	:* Check to see if the file ''/etc/security/otacerts.zip'' exists
		+	Check for several known rooted apk's
		+	:* com.noshufou.android.su
		+	:* com.thirdparty.superuser
		+	:* eu.chainfire.supersu
		+	:* com.koushikdutta.superuser
		+	Check for SU binaries
		+	:* <tt>/system/bin/su</tt>
		+	:* <tt>/system/xbin/su</tt>
		+	:* <tt>/sbin/su</tt>
		+	:* <tt>/system/su</tt>
		+	:* <tt>/system/bin/.ext/.su</tt>
		+	Attempt SU command directly
		+	:* Attempt the to run the command <tt>su</tt> and check the id of the current user, if it returns 0 then the su command has been successful

	{{Mobile_Top_10_2012:SubsectionAdvancedTemplate\|type={{Mobile_Top_10_2012:StyleTemplate}}\|number=3\|risk=7}}		{{Mobile_Top_10_2012:SubsectionAdvancedTemplate\|type={{Mobile_Top_10_2012:StyleTemplate}}\|number=3\|risk=7}}

@@ Line 92: / Line 92: @@
 :* Runtime Monitoring (''Snoop-It'');
 :* Runtime Analysis (''GDB''); and
-:* Reverse Engineering (''IDA Pro; Hopper'').
+:* Reverse Engineering (''[https://www.hex-rays.com/products/ida/ IDA Pro]; Hopper'').
 == Android Apps==
@@ Line 98: / Line 98: @@
 :* Bytecode Conversion (''apktool; dex2jar'');
 :* Runtime Analysis (''ADB'');
-:* Reverse Engineering (''IDA Pro; Hopper'');
+:* Reverse Engineering (''[https://www.hex-rays.com/products/ida/ IDA Pro]; Hopper'');
 :* Disassembly (''baksmali'') and
 :* Code Injection (''Mobile Substrate'').
 There are many well-established security experts within the mobile space that have written books on the topic of binary protection testing <sup>&#91;[[#ReferenceItem13|13]]&#93;</sup> <sup>&#91;[[#ReferenceItem14|14]]&#93;</sup> <sup>&#91;[[#ReferenceItem15|15]]&#93;</sup>.

@@ Line 26: / Line 26: @@
 '''Analysis and Reverse Engineering'''
-Binary protections slow down an adversary from analyzing exposed interfaces and reverse engineering code within the mobile app.  All too often, the adversary will steal code and recycle it within another app for resell <sup>&#91;[[#ReferenceItem16|16]]&#93;</sup>.  The app owner is unaware that the app has been repurposed and sold elsewhere.  If there is a likely chance that this may occur, the owner should apply binary protections to the app; But be warned, this protection only slows an attacker from reverse engineering. It does not prevent an attacker from doing so.
+Binary protections slow down an adversary from analyzing exposed interfaces and reverse engineering code within the mobile app.  All too often, the adversary will steal code and recycle it within another app for resell <sup>&#91;[[#ReferenceItem16|16]]&#93;</sup>.  The app owner is often unaware that the app has been repurposed and sold elsewhere unless they utilize some form of appstore monitoring service or similar.  If there is a likely chance that this may occur, the owner should consider binary protections to the app. But be warned, this protection only slows an attacker from reverse engineering. It does not prevent an attacker from doing so.
 '''Unauthorized Code Modification'''

@@ Line 39: / Line 39: @@
 * Brand and Trust Damage;
 * Revenue Loss and Piracy;
-* Intellectual Property Theft; and
+* Intellectual Property Theft;
 * User Experience Compromise.
@@ Line 70: / Line 70: @@
 :* Jailbreak Detection Controls;
 :* Checksum Controls;
-:* Certificate Pinning Controls; and
+:* Certificate Pinning Controls;
 :* Debugger Detection Controls.

@@ Line 14: / Line 14: @@
 A lack of binary protections within a mobile app exposes the application and it’s owner to a large variety of technical and business risks.  A lack of binary protections results in a mobile app that can be analyzed, reverse-engineered, and modified by an adversary.  A much more detailed breakdown of the technical and business threats that result is available in the '''[https://www.owasp.org/index.php/Technical_Risks_of_Reverse_Engineering_and_Unauthorized_Code_Modification OWASP Reverse Engineering and Code Modification Prevention Project]'''.
-Unfortunately, it is extremely common for apps to be deployed without binary protection.  The prevalence has been extensively studied by a large number of security vendors, analysts, and researchers <sup>&#91;[[#ReferenceItem1|1]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem2|2]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem17|17]]&#93;</sup>.
+Unfortunately, it is extremely common for apps to be deployed without binary protection.  The prevalence has been extensively studied by a large number of security vendors, analysts, and researchers <sup>&#91;[[#ReferenceItem1|1]]&#93;</sup> <sup>&#91;[[#ReferenceItem2|2]]&#93;</sup> <sup>&#91;[[#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[#ReferenceItem17|17]]&#93;</sup>.
 '''Detectability'''
-It is difficult to detect that an adversary has reverse engineered an app’s code.  Typically, the app owner will realize reverse engineering was successful when the code shows up in another app in iTunes <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem4|4]]&#93;</sup>, Google Play <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem5|5]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem16|16]]&#93;</sup>, or a third-party app store <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem6|6]]&#93;</sup>.  Usually, the owner discovers this by accident and not through active policing by an app store.
+It is difficult to detect that an adversary has reverse engineered an app’s code.  Typically, the app owner will realize reverse engineering was successful when the code shows up in another app in iTunes <sup>&#91;[[#ReferenceItem4|4]]&#93;</sup>, Google Play <sup>&#91;[[#ReferenceItem5|5]]&#93;</sup> <sup>&#91;[[#ReferenceItem16|16]]&#93;</sup>, or a third-party app store <sup>&#91;[[#ReferenceItem6|6]]&#93;</sup>.  Usually, the owner discovers this by accident and not through active policing by an app store.
-There are many different viable solutions to detect code modification at runtime and respond accordingly.  At runtime, mobile apps should be enabled to detect if a runtime modification / injection has occurred and react in a number of different ways.  Pre-determined reactions of the apps will vary from either attempting to thwart the attack or fail in a subtle way <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem7|7]]&#93;</sup>.
+There are many different viable solutions to detect code modification at runtime and respond accordingly.  At runtime, mobile apps should be enabled to detect if a runtime modification / injection has occurred and react in a number of different ways.  Pre-determined reactions of the apps will vary from either attempting to thwart the attack or fail in a subtle way <sup>&#91;[[#ReferenceItem7|7]]&#93;</sup>.
 </td>
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>The majority of mobile apps do not prevent an adversary from successfully analyzing, reverse engineering or modifying the app’s binary code <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem1|1]]&#93;</sup>.  Organizations should apply binary protections to a mobile app under a few different circumstances:
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate}}>The majority of mobile apps do not prevent an adversary from successfully analyzing, reverse engineering or modifying the app’s binary code <sup>&#91;[[#ReferenceItem1|1]]&#93;</sup>.  Organizations should apply binary protections to a mobile app under a few different circumstances:
 '''Analysis and Reverse Engineering'''
-Binary protections prevent an adversary from analyzing exposed interfaces and reverse engineering code within the mobile app.  All too often, the adversary will steal code and recycle it within another app for resell <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem16|16]]&#93;</sup>.  The app owner is unaware that the app has been repurposed and sold elsewhere.  If there is a likely chance that this may occur, the owner should apply binary protections to the app; and
+Binary protections prevent an adversary from analyzing exposed interfaces and reverse engineering code within the mobile app.  All too often, the adversary will steal code and recycle it within another app for resell <sup>&#91;[[#ReferenceItem16|16]]&#93;</sup>.  The app owner is unaware that the app has been repurposed and sold elsewhere.  If there is a likely chance that this may occur, the owner should apply binary protections to the app; and
 '''Unauthorized Code Modification'''
-Binary protections prevent an adversary from modifying the underlying code or behavior to disable or add additional functionality on behalf of the adversary.  This is likely to occur if the app stores, transmits, or processes personally identifiable information (PII) or other sensitive information assets like passwords or credit cards.  Code modification often takes the form of repackaging or insertion of malware into existing mobile apps <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem18|18]]&#93;</sup>.
+Binary protections prevent an adversary from modifying the underlying code or behavior to disable or add additional functionality on behalf of the adversary.  This is likely to occur if the app stores, transmits, or processes personally identifiable information (PII) or other sensitive information assets like passwords or credit cards.  Code modification often takes the form of repackaging or insertion of malware into existing mobile apps <sup>&#91;[[#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[#ReferenceItem18|18]]&#93;</sup>.
 </td>
@@ Line 42: / Line 42: @@
 * User Experience Compromise.
-Many different analysts have provided policy guidance around minimizing this risk <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem8|8]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem9|9]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem10|10]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem11|11]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem12|12]]&#93;</sup>.
+Many different analysts have provided policy guidance around minimizing this risk <sup>&#91;[[#ReferenceItem8|8]]&#93;</sup> <sup>&#91;[[#ReferenceItem9|9]]&#93;</sup> <sup>&#91;[[#ReferenceItem10|10]]&#93;</sup> <sup>&#91;[[#ReferenceItem11|11]]&#93;</sup> <sup>&#91;[[#ReferenceItem12|12]]&#93;</sup>.
 </td>
@@ Line 51: / Line 51: @@
 {{Top_10_2010:SubsectionColoredTemplate|Am I Vulnerable to Lack of Binary Protections?||year=2014}}
-If you are hosting code in an untrustworthy environment, you are susceptible to this risk <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem1|1]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem2|2]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem17|17]]&#93;</sup>.  An untrustworthy environment is defined as an environment in which the organization does not have physical control.  This includes mobile clients, firmware in appliances, cloud spaces, or datacenters within particular countries.
+If you are hosting code in an untrustworthy environment, you are susceptible to this risk <sup>&#91;[[#ReferenceItem1|1]]&#93;</sup> <sup>&#91;[[#ReferenceItem2|2]]&#93;</sup> <sup>&#91;[[#ReferenceItem3|3]]&#93;</sup> <sup>&#91;[[#ReferenceItem17|17]]&#93;</sup>.  An untrustworthy environment is defined as an environment in which the organization does not have physical control.  This includes mobile clients, firmware in appliances, cloud spaces, or datacenters within particular countries.
 If you answer yes to any of these questions, you are vulnerable to a binary attack:
@@ Line 102: / Line 102: @@
 :* Code Injection (''Mobile Substrate'').
-There are many well-established security experts within the mobile space that have written books on the topic of binary protection testing <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem13|13]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem14|14]]&#93;</sup> <sup>&#91;[[Mobile_Top_10_2014-M10#ReferenceItem15|15]]&#93;</sup>.
+There are many well-established security experts within the mobile space that have written books on the topic of binary protection testing <sup>&#91;[[#ReferenceItem13|13]]&#93;</sup> <sup>&#91;[[#ReferenceItem14|14]]&#93;</sup> <sup>&#91;[[#ReferenceItem15|15]]&#93;</sup>.
 {{Mobile_Top_10_2012:SubsectionAdvancedTemplate|type={{Mobile_Top_10_2012:StyleTemplate}}|number=4|risk=7}}