Mobile Application Penetration Testing
Total Page：16
File Type：pdf, Size：1020Kb
www.allitebooks.com Mobile Application Penetration Testing Explore real-world threat scenarios, attacks on mobile applications, and ways to counter them Vijay Kumar Velu BIRMINGHAM - MUMBAI www.allitebooks.com Mobile Application Penetration Testing Copyright © 2016 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. First published: March 2016 Production reference: 1070316 Published by Packt Publishing Ltd. Livery Place 35 Livery Street Birmingham B3 2PB, UK. ISBN 978-1-78588-337-8 www.packtpub.com www.allitebooks.com Credits Author Project Coordinator Vijay Kumar Velu Nikhil Nair Reviewers Proofreader Akash Mahajan Safis Editing Swaroop Yermalkar Indexer Commissioning Editor Tejal Daruwale Soni Veena Pagare Graphics Acquisition Editor Jason Monteiro Aaron Lazar Production Coordinator Content Development Editor Melwyn Dsa Sachin Karnani Cover Work Technical Editor Melwyn Dsa Nirant Carvalho Copy Editors Stuti Srivastava Madhusudan Uchil www.allitebooks.com About the Author Vijay Kumar Velu is a passionate information security practitioner, speaker, and blogger, currently working as a cyber security technical manager at one of the Big4 consultancies based in India. He has more than 10 years of IT industry experience, is a licensed penetration tester, and has specialized in providing technical solutions to a variety of cyber problems, ranging from simple security configuration reviews to cyber threat intelligence. Vijay holds multiple security qualifications including Certified Ethical Hacker, EC-council Certified Security Analyst, and Computer Hacking Forensics Investigator. He loves hands-on technological challenges. Vijay was invited to speak at the National Cyber Security Summit (NCSS), Indian Cyber Conference (InCyCon), Open Cloud Conference, and Ethical Hacking Conference held in India, and he has also delivered multiple guest lectures and training on the importance of information security at various business schools in India. He also recently reviewed Learning Android Forensics, Packt Publishing. For the information security community, Vijay serves as the director of the Bangalore chapter of the Cloud Security Alliance (CSA) and chair member of the National Cyber Defence and Research Center (NCDRC). I would like to dedicate this book to my mother and sister for believing in me and always encouraging me to do what I like with all my crazy ideas. Special thanks to my family, friends (Hackerz), core team (Rachel H Martis, Anil Dikshit, Karthik Belur Sridhar, Vikram Sridharan and Vishal Patel), and Lokesh Gowda for allowing me ample amount of time in shaping this book. A huge thanks to Darren Fuller, my mentor and friend, for providing his support and insights. Also to the excellent team at Packt Publishing for all the support that they provided throughout the journey of this book, specially Sachin and Nirant for their indubitable coordination. www.allitebooks.com About the Reviewers Akash Mahajan is an accomplished security professional with over a decade's experience in providing specialist application and infrastructure consulting services at the highest levels to companies, governments, and organizations around the world. He is the author of Burp Suite Essentials, Packt Publishing. Akash is an extremely active participant in the international security community and a frequent conference speaker. He gives talks as himself, as the head of the Bangalore chapter of OWASP, the global organization responsible for defining the standards for web application security, and as a co-founder of NULL, India's largest open security community. I want to thank you, Nikhil, for making sure that reviewing this book was a pleasurable experience. www.allitebooks.com Swaroop Yermalkar works as a healthcare security researcher at Philips Health Systems, India, where he is responsible for thread modeling; security research; and the assessment of IoT devices, healthcare products, web applications, networks, and Android and iOS applications. He is the author of the popular iOS security book Learning iOS Penetration Testing, Packt Publishing and also one of the top mobile security researchers worldwide, working with Synack, Inc. He also gives talks and training on wireless pentesting and mobile app pentesting at various security conferences, such as GroundZero, c0c0n, 0x90, DEFCONLucknow, and GNUnify. He has been acknowledged by Microsoft, Amazon, eBay, Etsy, Dropbox, Evernote, Simple banking, iFixit, and many more for reporting high-severity security issues in their mobile apps. He is an active member of NULL, an open security community in India, and is a contributor to the regular meetups and Humla sessions at the Pune chapter. He holds various information security certifications, such as OSCP, SLAE, SMFE, SWSE, CEH, and CHFI. He has written articles for clubHACK magazine and also authored a book, An Ethical Guide to Wi-Fi Hacking and Security. He has organized many eminent programs and was the event head of Hackathon—a national-level hacking competition. He has also worked with Pune Cyber Cell, Maharashtra Police, in programs such as Cyber Safe Pune. He can be contacted at @swaroopsy on Twitter. www.allitebooks.com www.PacktPub.com eBooks, discount offers, and more Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub. com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at [email protected] for more details. At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks. https://www2.packtpub.com/books/subscription/packtlib Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books. Why subscribe? • Fully searchable across every book published by Packt • Copy and paste, print, and bookmark content • On demand and accessible via a web browser www.allitebooks.com www.allitebooks.com Table of Contents Preface ix Chapter 1: The Mobile Application Security Landscape 1 The smartphone market share 2 The android operating system 3 The iPhone operating system (iOS) 3 Different types of mobile applications 3 Native apps 4 Mobile web apps 4 Hybrid apps 5 Public Android and iOS vulnerabilities 7 Android vulnerabilities 9 iOS vulnerabilities 10 The key challenges in mobile application security 11 The impact of mobile application security 12 The need for mobile application penetration testing 13 Current market reaction 13 The mobile application penetration testing methodology 14 Discovery 14 Analysis/assessment 15 Exploitation 16 Reporting 16 The OWASP mobile security project 16 OWASP mobile top 10 risks 17 Vulnerable applications to practice 20 Summary 20 [ i ] www.allitebooks.com Table of Contents Chapter 2: Snooping Around the Architecture 21 The importance of architecture 22 The Android architecture 23 The Linux kernel 24 Confusion between Linux and the Linux kernel 24 Android runtime 25 The java virtual machine 26 The Dalvik virtual machine 26 Zygote 27 Core Java libraries 27 ART 28 Native libraries 28 The application framework 29 The applications layer 31 Native Android or system apps 31 User-installed or custom apps 31 The Android software development kit 31 Android application packages (APK) 32 Android application components 36 Intent 36 Activity 36 Services 38 Broadcast receivers 40 Content providers 41 Android Debug Bridge 41 Application sandboxing 42 Application signing 43 Secure inter-process communication 43 The Binder process 44 The Android permission model 45 The Android application build process 46 Android rooting 50 iOS architecture 51 Cocoa Touch 53 Media 53 Core services 54 Core OS 55 iOS SDK and Xcode 55 iOS application programming languages 56 Objective-C 56 The Objective-C runtime 57 Swift 57 [ ii ] Table of Contents Understanding application states 57 Apple's iOS security model 58 Device-level security 59 System-level security 59 An introduction to the secure boot chain 59 System software authorization 60 Secure Enclave 60 Data-level security 60 Data-protection classes 61 Keychain data protection 62 Changes in iOS 8 and 9 62 Network-level security 63 Application-level security 63 Application code signing 63 The iOS app sandbox 64 iOS isolation 64 Process isolation 65 Filesystem isolation 65 ASLR 66 Stack protection (non-executable stack and heap) 66 Hardware-level security 66 iOS permissions 66 The iOS application structure 68 Jailbreaking 69 Why jailbreak a device? 70 Types of