how i forced an android vulnerability into …...how i forced an android vulnerability into...

DIGITAL FORENSIC RESEARCH CONFERENCE

How I Forced An Android Vulnerability Into

Bypassing MDM Restrictions + DIY Android Malware Analysis

By

Zubair Ashraf

Presented At

The Digital Forensic Research Conference

DFRWS 2015 EU Dublin, Ireland (Mar 23rd- 26th)

DFRWS is dedicated to the sharing of knowledge and ideas about digital forensics research. Ever since it organized

the first open workshop devoted to digital forensics in 2001, DFRWS continues to bring academics and practitioners

together in an informal environment. As a non-profit, volunteer organization, DFRWS sponsors technical working

groups, annual conferences and challenges to help drive the direction of research and development.

http:/dfrws.org

© 2014 IBM Corporation

IBM Security

0 © 2014 IBM Corporation

HOW I FORCED AN ANDROID VULNERABILITY INTO BYPASSING MDM RESTRICTIONS + DIY MALWARE ANALYSIS Zubair Ashraf Team Lead & Security Researcher IBM X-Force Advanced Research


IBM Security

1

@b0ut.m3

▪ Team Lead & Security Researcher @ IBM X-Force Research

@zashraf1337 securityintelligence.com/author/zubair-ashraf ca.linkedin.com/in/zubairashraf


IBM Security

2

Agenda

● DIY Malware Analysis (available on slides only -) ● Vulnerability Hunt ● Exploitation


IBM Security

3


IBM Security

4

Android Malware Analysis (please refer to slides from download

section)


IBM Security

5

Let’s get the emulator running

mobisec@Mobisec:/opt/mobisec/devtools/android-sdk/tools$ emulator-arm -avd Android_4.0.3 -scale 0.75 -debug all -logcat all -no-boot-anim mobisec@Mobisec-VM:~$ adb install Malware/OBad/E1064BFD836E4C895B569B2DE4700284.apk

Let’s get OBAD in the emulator


IBM Security

6

The persistent begging starts


IBM Security

7


IBM Security

8

Won’t take No for an answer

Sales / Marketing


IBM Security

9


IBM Security

10

No Device Admin?


IBM Security

11

We would expect something like this


IBM Security

12

Can we see OBAD in app list and uninstall it?


IBM Security

13

May be from command line - ‘adb’

mobisec@Mobisec-VM:~/Malware/OBAD$ adb uninstall com.android.system.admin Failure mobisec@Mobisec-VM:~/Malware/OBAD$ adb logcat -d -b main -b events | grep admin | tail -1 W/PackageManager( 277): Not removing package com.android.system.admin: has active device admin

Let’s try the command line

�


IBM Security

14

Let’s hunt the code that hides it from Device Admin List


IBM Security

15

Checkout the patch history … or ...


IBM Security

16

Launch Settings -> Security -> Device Administrators Check out the logs: adb logcat -d -b events

I/am_new_intent( 276): [0,1106566944,17,com.android.settings/.Settings,android.intent.action.MAIN,NULL,NULL,274726912] I/am_resume_activity( 276): [0,1106900904,17,com.android.settings/.Settings] I/am_on_resume_called( 1118): [0,com.android.settings.Settings]

Find Relevant Code Find Relevant Code


IBM Security

17

▪search for these strings at androidxref.com

▪following along you will arrive at

packages/apps/Settings/src/com/android/settings/ DeviceAdminSettings.java

Find Relevant Code (contd…)


IBM Security

18

▪check out the function void updateList() ▪and the conditions for something to appear in device admin list

Find Relevant Code (contd…)


IBM Security

19

getActivity().getPackageManager().queryBroadcastReceive

rs(Intent(DeviceAdminReceiver.ACTION_DEVICE_ADMIN_ENABLED), ...

Device Admin Vulnerability Device Admin Vulnerability


IBM Security

20

getActivity().getPackageManager().queryBroadcastReceive

rs(Intent(DeviceAdminReceiver.ACTION_DEVICE_ADMIN_ENABLED), ...



IBM Security

21

Hackers won’t follow the specs unless they have to


IBM Security

22

To use the Device Administration API, the application's

manifest must include the following:

●A subclass of DeviceAdminReceiver that includes the

following: oThe BIND_DEVICE_ADMIN permission. oThe ability to respond to the ACTION_DEVICE_ADMIN_ENABLED intent, expressed in the manifest as an intent filter.

What they should do What they should do

http://developer.android.com/reference/android/app/admin/DeviceAdminReceiver.html

http://developer.android.com/reference/android/Manifest.permission.html

http://developer.android.com/reference/android/app/admin/DeviceAdminReceiver.html


IBM Security

23

<receiver "System" =".OCllCoO"> <meta-data "android.app.device_admin" ="@2130968576"> </meta-data> <intent-filter> <action name="com.strain.admin.DEVICE_ADMIN_ENABLED"> </action> </intent-filter> </receiver>

What they actually did What they actually did


IBM Security

24

name="com.strain.admin.DEVICE_ADMIN_ENABLED">

What they actually did

instead of

android.app.action.DEVICE_ADMIN_ENABLED

What they actually did


IBM Security

25

What’s next


IBM Security

26

services/java/com/android/server/

DevicePolicyManagerService.java



IBM Security

27

When adding an Admin policy.mAdminMap.put(adminReceiver, newAdmin); and policy.mAdminList.add(newAdmin);



IBM Security

28

Please make sure you take ALL your stuff with you

Device Admin Vulnerability


IBM Security

29

removeActiveAdminLocked

1.policy.mAdminList.remove(admin); 2.policy.mAdminMap.remove(adminReceiver);



IBM Security

30

Please make sure you take ALL your stuff with you

ALL THE TIME! even when in RUSH



IBM Security

31

private void handlePackagesChanged(int userHandle) { removed = true; policy.mAdminList.remove(i);



IBM Security

32

private void handlePackagesChanged(int userHandle) {

removed = true; policy.mAdminList.remove(i);


and who will clean up the mAdminMap for you



IBM Security

33

This code path gets executed when you DISABLE the device admin component



IBM Security

34

All we have so far is a leak / bad coding practice



IBM Security

35

Is this a vulnerability?



IBM Security

36

Is there a code path that consults mAdminMap but not mAdminList ?



IBM Security

37

▪getActiveAdminUncheckedLocked ▪ getActiveAdminForCallerLocked (ComponentName who, int reqPolicy) with “who” parameter being non null



IBM Security

38

getActiveAdminUncheckedLocked is used by isAdminActive


http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html



IBM Security

39

So can we exploit it?



IBM Security

40


IBM Security

41

DID YOU KNOW? By 2016, 20% of enterprise BYOD programs will fail due to deployment of mobile device management (MDM) measures that are too restrictive.

Gartner: Gartner


IBM Security

42

How about typing a 14 character password while driving?


IBM Security

43

▪enable device admin ▪disable the device admin component ▪At this point, from the data structure and code

perspective, device admin’s isAdminEnabled will still return true

Exploiting the Device Admin Vulnerability Exploiting the Device Admin Vulnerability


IBM Security

44

pm.setComponentEnabledSetting( this.getWho(context), PackageManager.COMPONENT_ENABLED_STATE_DISABLED, PackageManager.DONT_KILL_APP);



IBM Security

45

Uninstall the app (it will still be in the mAdminMap)



IBM Security

46

Now, install the original app



IBM Security

47


IBM Security

48

BUT


IBM Security

49


IBM Security

50

BUT it may not necessarily work with MDM


IBM Security

51


IBM Security

52

isActivePasswordSufficient




IBM Security

53

public boolean isActivePasswordSufficient(int userHandle) { enforceCrossUserPermission(userHandle); synchronized (this) { // This API can only be called by an active device admin, DevicePolicyData policy = getUserData(userHandle); // so try to retrieve it to check that the caller is one. getActiveAdminForCallerLocked(null, DeviceAdminInfo.USES_POLICY_LIMIT_PASSWORD);

isActivePasswordSufficient


IBM Security

54

ActiveAdmin getActiveAdminForCallerLocked (ComponentName who, int reqPolicy) throws SecurityException { if (who != null) { ... } else { final int N = policy.mAdminList.size();

getActiveAdminForCallerLocked


IBM Security

55

else { final int N = policy.mAdminList.size(); for (int i=0; i<N; i++) { ActiveAdmin admin = policy.mAdminList.get(i); if (admin.getUid() == callingUid && admin.info.usesPolicy(reqPolicy)) { return admin; } } throw new SecurityException



IBM Security

56

else { final int N = policy.mAdminList.size(); for (int i=0; i<N; i++) { ActiveAdmin admin = policy.mAdminList.get(i); if (admin.getUid() == callingUid && admin.info.usesPolicy(reqPolicy)) { return admin; } } throw new SecurityException



IBM Security

57

There is a way


IBM Security

58

▪active device admin with same policies ▪and same UID - sharedUID

if (admin.getUid() == callingUid && admin.info.usesPolicy(reqPolicy)) {

sharedUID


IBM Security

59

▪Modify AndroidManifest.xml of the MDM −add android:sharedUserId attribute ▪repackage and self sign

Extended Hack Extended Hack


IBM Security

60

▪Create a different device admin −same sharedUid −same policies −install and activate it



IBM Security

61

▪Do everything else as before −but using the self signed MDM apk with sharedUID



IBM Security

62


IBM Security

63

COMPLIANT != SECURE


IBM Security

64


IBM Security

65

▪Don’t make it really painful to use the device ▪code protection ▪verifying app signatures

Lessons Lessons


IBM Security

66

Further Learning

● https://github.com/strazzere/android-unpacker ● https://github.com/strazzere/android-

unpacker/blob/master/AHPL0.pdf

https://github.com/strazzere/android-unpacker





IBM Security

67

Loved ones, X-Force, DFRW EU and YOU


IBM Security

68

@zashraf1337

securityintelligence.com/author/zubair-ashraf

ca.linkedin.com/in/zubairashraf

how i forced an android vulnerability into …...how i forced an android vulnerability into...

Documents