Android Security Creation of a Virtual Learning Environment
Total Page：16
File Type：pdf, Size：1020Kb
Bachelor’s Thesis Android Security Creation Of A Virtual Learning Environment Author: Michael Heinl Student Number: 174597 Offenburg University of Applied Sciences Department of Media and Information Technology Corporate and IT-Security Supervisors: Prof. Dr. rer. nat. Erik Zenner Avikarsha Mandal, M. Sc. Date of submittal: Friday June 26th 2015 Declaration of Authorship I hereby declare that the thesis submitted is my own unaided work. All direct or indirect sources used are acknowledged as references. This paper was not previously presented to another examination board and has not been published. ...................... Offenburg, June 26th 2015 Michael Heinl Acknowledgement Many thanks go to Avikarsha Mandal for the great supervision of this Bachelor’s thesis. He gave me the freedom to realise my interests and his good advice always pushed me into the right direction. I am very grateful to Erik Zenner who has not only supervised my thesis, but also opened up several new perspectives during my studies. Sincere thanks for the continuous support. My thanks also goes to Mark Addison for his help as well as for the inspiring and in- structive time in England. Hurray! Last but not least, I would like to thank my friends and family for always being there for each other. v Abstract Android is the most popular mobile operating system. Its omnipresence leads to the fact that it is also the most popular target amongst malware developers and other computer criminals. Hence, this thesis shows the security-relevant structures of Android’s system and application architecture. Furthermore, it provides laboratory exercises on various security-related issues to understand them not only theoretically but also deal with them in a practical way. In order to provide infrastructure-independent education, the exer- cises are based on Android Virtual Devices (AVDs). Keywords: Android, Security, Laboratory Exercises, Education, AVD vii Contents Acknowledgementv Abstract vii List of Tables xi List of Figures xiv Nomenclature xv 1. Introduction1 2. Architecture of Android3 2.1. Android Versions................................4 2.2. Android Stack..................................4 2.3. Dalvik Virtual Machine............................5 2.4. Android RunTime...............................6 2.5. Zygote......................................7 2.6. Permission System...............................7 2.6.1. Processes................................7 2.6.2. Filesystem................................7 2.6.3. Application Manifest Permissions...................9 3. App Structure 13 3.1. Android Application Package......................... 14 3.2. Dalvik Executable............................... 15 3.3. Android Manifest File............................. 16 3.4. Application Signing............................... 16 3.5. Inter-Component Communication....................... 17 4. Development Environment 19 4.1. Android Emulator............................... 20 4.2. Building Android................................ 22 ix 4.3. Tools Used................................... 24 4.3.1. Android Debug Bridge......................... 24 4.3.2. Android Studio............................. 25 4.3.3. Metasploit................................ 25 4.3.4. Wireshark................................ 26 5. Lab: Bypass Lockscreen 27 5.1. Goal....................................... 28 5.2. Background................................... 28 5.3. Setup...................................... 28 5.3.1. Stage One................................ 29 5.3.2. Stage Two................................ 29 5.4. Proof of Concept................................ 30 5.4.1. Stage One: Bypass by Deleting.................... 30 5.4.2. Stage Two: Bypass by Cracking.................... 31 5.5. Learning Outcomes............................... 33 6. Lab: WebView 35 6.1. Goal....................................... 37 6.2. Background................................... 37 6.3. Setup...................................... 37 6.4. Proof of Concept................................ 39 6.5. Learning Outcomes............................... 41 7. Lab: Vertical Privilege Escalation 43 7.1. Goal....................................... 44 7.2. Background................................... 44 7.3. Setup...................................... 45 7.4. Proof of Concept................................ 47 7.4.1. Stage One: Exploiting......................... 47 7.4.2. Stage Two: Rooting Manually..................... 48 7.5. Learning Outcomes............................... 49 8. Evaluation 51 9. Conclusion and Future Work 53 References 55 A. Assignments 61 B. Code Extracts 69 x List of Tables 2.1. Overview of Android versions [3]........................4 2.2. Exemplary Unix permissions in format binary/symbolic/decimal......8 2.3. Protection levels according to [13]....................... 11 4.1. Files used by the Android emulator [28].................... 21 4.2. IP addresses of the emulator’s network address space [28].......... 22 4.3. AOSP Buildtypes based on [31]......................... 23 4.4. Overview of important adb parameters.................... 25 4.5. Overview of important msfconsole commands................. 26 A.1. Overview of important adb parameters..................... 63 A.2. Overview of important msfconsole commands................. 66 A.3. IP addresses of the emulator’s network address space............. 66 A.4. Files used by the Android emulator...................... 68 xi List of Figures 1.1. Data collected during a 7-day period ending on June 1, 2015. Versions with < 0.1% are not shown [2].........................2 2.1. Checking kernel version of Android 5.1.1 via ADB..............3 2.2. Android software stack [5]............................5 2.3. Select runtime in Android 4.4..........................6 2.4. Checking whether Dalvik or ART is enabled.................7 2.5. Comparison of camera app’s permission settings...............9 2.6. Snippet of /system/etc/permissions/platform.xml............... 10 3.1. An .apk file’s internal structure [14]...................... 14 3.2. Comparison of Java .class and Android .dex files [16]............ 15 3.3. Fragment of AndroidManifest.xml showing the camera’s permissions.... 16 4.1. Creating an Android Virtual Device with AVD Manager........... 20 4.2. Downloading and compiling Android sources................. 23 4.3. Architecture of the Android Debug Bridge (ADB) [6]............ 24 5.1. Configuring the lockscreen pattern....................... 30 5.2. Deleting the file password.key in order to unlock AVD............ 31 5.3. Downloading the file gesture.key and analyzing it using xxd......... 32 5.4. Pattern coordinates............................... 32 5.5. Creating required database and table in MySQL............... 33 6.1. Diagram of the complete WebView lab’s procedure.............. 36 6.2. AndroidManifest.xml code snippet defining broadcast receiver........ 38 6.3. Method sendRequest().............................. 38 6.4. Method startRunnable()............................. 39 6.5. Standard HTTP Request of the vulnerable Android............. 40 6.6. Configuration of Metasploit module webview_addjavascriptinterface.... 40 6.7. msfconsole signaling incoming connection................... 41 7.1. Unpacking ramdisk.img............................. 46 7.2. Properties in default.prop of stage one..................... 46 xiii 7.3. Properties in default.prop of stage two..................... 46 7.4. Rebuilding ramdisk.img............................. 47 7.5. Check status of ADB daemon.......................... 47 7.6. Executing RageAgainstTheCage........................ 48 7.7. Enabling USB Debugging............................ 49 A.1. Install Android SDK Platform Tools...................... 61 A.2. ANDROID_HOME and PATH variables................... 62 A.3. Bypass the lockscreens.............................. 64 xiv Nomenclature ADB . Android Debug Bridge ADBD . Android Debug Bridge Daemon AOSP . Android Open Source Project AOT . Ahead-Of-Time API . Application Programming Interface APK . Android Application Package App . Android Mobile Application ARP . Address Resolution Protocol ART . Android Runtime ASCII . American Standard Code for Information Interchange AUR . Arch User Repository AVD . Android Virtual Device CA . Certificate Authority CPU . Central Processing Unit CTF . Capture The Flag CVE . Common Vulnerabilities and Exposures DEX . Dalvik Executable DNS . Domain Name System EXT . Extended File System FAT ............ File Allocation Table FDE . Full Disk Encryption xv FHS . Filesystem Hierarchy Standard FROST . Forensic Recovery Of Scrambled Telephones GCC . GNU C Compiler GID . Group Identifier GNU . GNU’s Not Unix GPS . Global Positioning System GUI . Graphical User Interface HTML . Hypertext Markup Language HTTP . Hypertext Transfer Protocol IDE . Integrated Development Environment IP . Internet Protocol JIT . Just-In-Time JVM . Java Virtual Machine KVM . Kernel-based Virtual Machine Lab . Laboratory Exercise MD5 . Message Digest Algorithm 5 MITM . Man-In-The-Middle MySQL . My Structured Query Language OS . Operating System PHP . PHP: Hypertext Preprocessor PID . Process Identifier PIN . Personal Identification Number RAM . Random Access Memory ROM . Read Only Memory SD Card . Secure Digital Memory Card SDK . Software Development Kit SHA-1 . Secure Hash Algorithm 1 xvi SMS . Short Message Service SSL . Secure Sockets Layer SYN . Synchronize Message TAN . Transaction Authentication Number TLS . Transport Layer Security TOFU . Trust-On-First-Use UID . User Identifier URI .