Mobile Hacking -
Fundamentals
Mobile Hacking -
The Mobile threat landscape
Who are the top contenders in the global mobile OS
market?
Android – 84.1%
IOS – 14.8%
Microsoft – 0.7%
RIM – 0.2%
http://www.statista.com/statistics/266136/global-market-
share-held-by-smartphone-operating-systems/
Mobile Hacking -
The Mobile threat landscape
Over 1.4 billion people across the world are using
Android devices, according to Google. Unlike Apple’s iOS,
Android is not tied to a specific manufacturer, making
it's OS the top dog of the global OS market (Statistica).
However, since Android dominates the smartphone market,
it presents an ideal opportunity for hackers to tap into
a large base of user information. It’s essential for
Android users, as well as iOS users, to learn how to
protect themselves.
https://www.blackhat.com/latestintel/05122016-mobile-hacking.html
Mobile Hacking -
Attack Vectors
Possible vectors for exploitation include:
Manual Installation
– Direct Access to the device
– Use of client-server programs – ex: ADB
Social Engineering
Text Messages – ex: stagefright
RCE vulnerabilities – ex: ADB
– exploit/android/adb/adb_server_exec
Etc.
Mobile Hacking -
Hacking Android – Example 1
Example 1
Manual Installation
Raw payload saved in apk format generated with
msfvenom
Standard reverse meterpreter
Mobile Hacking -
Hacking Android – Example 1
Mobile Hacking -
Hacking Android – Example 1
Mobile Hacking -
Hacking Android – Example 1
Mobile Hacking -
Hacking Android – Example 1
Mobile Hacking -
Hacking Android – Example 1
Mobile Hacking -
Hacking Android – Example 1
Mobile Hacking -
Hacking Android – Example 1
Mobile Hacking -
Hacking Android – Example 1
Mobile Hacking -
Hacking Android – Example 2
Android Debug Bridge - ADB
Android Debug Bridge (ADB) is a versatile command line
tool that lets you communicate with an emulator instance
or connected Android-powered device. It is a client-
server program.
In order to use ADB; developer options must be unlocked
and USB debugging enabled.
On Android 4.2 and higher, the Developer options screen
is hidden by default.
When running Android 4.2.2 or higher, there is a
security mechanism (refereed to as secure USB debugging)
where the android system shows a dialog asking the user
to accept an RSA key that allows debugging through the
computer.
Mobile Hacking -
Hacking Android – Example 2
Vulnerabilities have been found in Android that allow attackers
to bypass Android’s secure USB debugging which allows them to:
Install Applications
Bypass Android's lock screen - Pattern/PIN locks
Obtain Shells
Etc..
https://developer.android.com/studio/command-line/adb.html
Mobile Hacking -
Hacking Android – Example 2
Mobile Hacking -
Hacking Android – Example 3
Embed a payload into any android application
The Injection process high level:
Disassemble the apk files – apktool
Both payload and our original application
Copy our payload in smali format to the original
application
Modify the Android Manifest file – AndroidManifest.xml
from the original application to include any additional
permission required for the payload in addition to
services.
Modify the smali code in original application to inject
new smali code to invoke our payload when the original
application is launched.
Assemble the new apk file – apktool
Generate new keys & sign the apk file
Deploy
Mobile Hacking -
Hacking Android – Example 3
Embed payload Preamble:
Apktool - https://ibotpeaches.github.io/Apktool/
A tool for reverse engineering Android apk files
Manifest
Every application must have an AndroidManifest.xml file (with
precisely that name) in its root directory. The manifest file
provides essential information about your app to the Android
system, which the system must have before it can run any of the
app's code.
https://developer.android.com/guide/topics/manifest/manifest-intro.html
Smali
Smali/Baksmali is an assembler/disassembler for the dex format
used by dalvik, Android's Java VM implementation. The names
"Smali" and "Baksmali" are the Icelandic equivalents of
"assembler" and "disassembler" respectively.
https://www.youtube.com/watch?v=h98KtUgUOsg
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
Hacking Android – Example 3
Mobile Hacking -
HELP
What can we do to protect ourselves?
Start with the basics...
Keep your OS up to date
Keep your applications up to date
Never install anything untrusted
Don't leave your phone laying around
Don't root your phone
Turn off external communication when not in
use/needed; ex: Bluetooth
Be mindful of the wireless network that you are
connecting to
Use Anti-virus software
