Nexus: Android

Google Play Conducts 200 Million Security scans per Day

Read

Google has enacted a system through Google play for Android devices called Verify Apps. The latest Android Security State of the Union includes clarification about what the company scans is your phone through Google Play-downloaded apps as well as apps you have downloaded elsewhere.

Google has gathered and compiled a wide range of Android data: third party can only offer a sight at the overall picture for Android. Keeping that in mind Google has extracted some high-level points from the data.

Google Play conducts 200 million security scans of devices per day and protects over billion devices.
Fewer than 1% of Android devices had a Potentially Harmful App (PHA) installed in 2014. Fewer than 0.15% of devices that only install from Google Play had a PHA installed.
The overall worldwide rate of Potentially Harmful Application (PHA) installs decreased by nearly 50% between Q1 and Q4 2014.
Over 400 million connections per day are checked by SafetyNet for potential SSL issues.
Android and Android partners responded to 79 externally reported security issues, and over 25,000 applications in Google Play were updated following security notifications from Google Play.

Google breaks down the various security threats which appear to be potential harmful to Android users. Google has improved Android security in nearly every area.

Google’s scanning software is searching for Potentially Harmful Applications, also known as PHAs.

According to Google PHA is "any application that can potentially harm the user, their device, or their data."

The company has taken important steps to improve security. It has improved system-level protection for apps installed outside of the Google Play Store, where the security risks are visibly higher.

Google's Verify Apps technology scans apps for potential issues at the time of installation and it also pursues scanning them afterwards. According to company's whitepaper, during the month of October last year, the Verify Apps tool was scanning 200 million devices per day solely for security details; not for personal data. As stated by Google, the Verify Apps scanning volume jumped more than 300 percent last year.

Read More Add comment

Android's 'PackageInstaller' Vulnerability a Gateway to hack Devices

Read

A security flaw was found in the Android's 'PackageInstaller' system service that provides path to the hacker to hijack the installation process of a third-party Android app, which seems pretty safe to user and replaces it with a Malware (infected app of his choosing).

The security flaw was reported to Android by the teamof security researchers (Ryan Olson, Huagang Xie, Claud Xiao, Colt Blackmore, and Taylor Ettema) from the Palo Alto network. Palo Alto previously worked with Google, Amazon and Samsung to report vulnerabilities and then issue their patches. The company discovered this vulnerability in January last year and reported it to Android security team, Amazon and Samsung.

This vulnerability is so severe that the users passwords and sensitive information are not safe. They can be hijacked through the infected app which was installed through the third-party. Around 49.5 percent Android users were infected by this app before it was patched by the Android (on its latest versions only).

The Google also released a statement today that " The Android Security Team has not detected any attempts to exploit this vulnerability on user devices." Google also added that the Android 4.3 and later versions are not vulnerable to this flaw. But the researchers from Palo Alto said the older version users are not safe from this Vulnerability.

So, the Android users who have older version android devices should avoid installing apps from the third party. This vulnerability affects Android device users as well as Android app developers. For Android device users, the users may end up with installing apps that are not the ones they agree to install.

Android app developers are also affected, because app-store apps and mobile ads libraries that do not rely on Google Play store would be likely to save the promoted apps in unprotected storage, example 'sdcard'. Like the example we show with Amazon appstore app, the unprotected storage in sdcard may allow attackers to replace the promoted apps with malware apps.

Read More Add comment

Android 5.1 Memory Leak bug has already been Fixed

Read

Read More Add comment

Vulnerabilities has been disclosed in the Samsung SNS Provider application

Read

The Dr. Manuel Sadosky Foundation, based in Argentina revealed the existence of vulnerabilities in the Samsung SNS Provider application for Android which sets social media accounts at risk, potentially allowing vicious third-party apps to access photos, status updates, feeds, location and other information as well as post content on behalf of the users without their assent.

The Samsung SNS Provider application is used by Samsung devices to control social media accounts including those on Facebook, Twitter, Google+, LinkedIn and Foursquare. It also acts as a link to allow other applications, such as Gallery, to seizure data and content stored on these websites.

The users are requested to provide full access to the account when they log into the social media account on a Samsung device where SNS Provider is installed.

SNS Provider is used monthly by 41 million users as of February 17, 2015, according to the bulletin, "A malicious application that is granted these permissions could then connect to these services and obtain the credentials required to access a user's social network account content permanently," the security bulletin states. "For example, such an application could access the user's private messages on Facebook using the access token provided by the corresponding SNS Provider service."

The detail of the vulnerable packages is mentioned below:

•    SNS Provider version older than 1.1.1 on Samsung devices on Android 4.1
•    SNS Provider version older than 1.1.6 on Samsung devices on Android 4.2
•    SNS Provider version older than 1.2.1 on Samsung devices on Android 4.3
•    SNS Provider version older than 1.3.5 on Samsung devices on Android 4.4
•    SNS Provider version older than 1.3.5 on Samsung devices on Android 5.0

The South Korean firm disabled the App ID assigned to SNS Provider on Facebook and Twitter in February, and issued fixed versions of the app with a new ID after making a declaration to Samsung. Users are now secure from malware which uses the access tokens obtained via prior versions. If users are still using vulnerable versions, they are likely to see expiry or 'try again' notices when they log in.

Read More Add comment

Android Browser Kitkat Content Spoofing Vulnerability

Read

Read More Add comment

Exploiting Android Device with Metasploit in Kali Linux

Read

Read More Add comment

La suite bureautique LibreOffice s'invite sur les terminaux Android Une version bêta téléchargeable sur le Play Store

Read

Read More Add comment

Appie - Android Pentesting Portable Integrated Environment

Read

Read More Add comment

Kali Linux NetHunter - Android penetration testing platform

Read

Read More Add comment

Nipper - Toolkit Web Scan for Android

Read

Read More Add comment

Android : deux applications sur trois récupèrent des données personnelles à l'insu des utilisateurs, selon une enquête de la CNIL

Read

La Commission Nationale de l’Informatique et des Libertés (CNIL) a publié les résultats d’une enquête menée conjointement avec l’Institut de recherche Inria qui s’intitule « Mobilitics saison 2 : nouvelle plongée dans l’univers des smartphones et de leurs applications ». L’objectif de cette étude est de comprendre l’écosystème des smartphones, notamment comment les applications se comportent avec les données des utilisateurs.

Les deux acteurs ont, d’entrée de jeu, définis leurs tâches : « pour la CNIL, il s’agit de mieux comprendre ce qui se passe réellement lors de l’usage de ces appareils, pour définir des priorités d’action et émettre des recommandations. Pour Inria, il s’agit aussi de pousser plus loin les investigations et analyses techniques et de développer des solutions permettant de mieux protéger les utilisateurs ».

« Mobilitics saison 2 » apporte donc un complément d’informations sur une saison 1 qui a été réalisée l’année dernière et dont les résultats qui ont été publiés en avril 2013 concernaient l’écosystème iOS, le système d’exploitation des iPhone et iPad. Cette fois-ci c’est au tour de l’écosystème Android de passé au crible de la Commission. Au total, 121 applications tournant sur Jelly Bean (qui regroupe les moutures 4.1.x, 4.2.x et 4.3) ont été analysé contre 189 sur iOS 5.

Selon cette étude, deux applications sur trois récupèrent des données personnelles à l’insu des utilisateurs. A ce propos, l’étude souligne « qu’entre un quart et un tiers des applications présentes sur les différents appareils des vagues 1 (iOS) et 2 (Android) ont eu accès à la localisation de l’appareil ». Geoffrey Delcroix, chargé d’étude pour la Cnil, explique que « ce chiffre n’est en soi ni choquant ni surprenant : de nombreuses applications ont des raisons légitimes d’accéder à la position géographique de l’appareil, que ce soit par le GPS ou grâce à la détection des antennes du réseau cellulaire ou des bornes wifi entourant l’appareil. Sur l’ensemble des applications testées, la très grande majorité avait au moins une fonction accessoire utilisant la géolocalisation ».

Cependant, il note que « le plus surprenant est surtout l’intensité et la fréquence d’accès à cette information par certaines applications. Par exemple, sur une période de 3 mois, une application a accédé plus de 1 million de fois à la géolocalisation et une deuxième application plus de 700 000 fois. Cela représente en moyenne près d’un accès par minute sur une période de 3 mois… Et pourtant il ne s’agissait pas d’applications de navigation ou d’itinéraire ». Notons que, selon les statistiques, la géolocalisation représente en volume la donnée la plus collectée ; à elle seule, elle a représenté plus de 30% des évènements détectés par les outils des chercheurs « sans être toujours liée à des fonctionnalités offertes par l'application ou à une action de l'utilisateur ». Il est bien là le hic.

La Commission a quand même précisé que « rien ne permet d’affirmer que les éditeurs récupèrent en permanence ou périodiquement (« par paquets ») cette information : elle peut n’être collectée que pour être utilisée dans l’appareil par l’application », même si rien ne permet non plus d’affirmer le contraire.

Après la géolocalisation, c’est au tour de « la course aux identifiants » d’être pointé du doigt. Dans la première édition, l’étude avait établi que près d’une application sur deux avait accédé à un identifiant unique alphanumérique de l’appareil appelé UDID (Unique Device Identifier) mais également que 40 % de celles qui y ont eu accès l’avaient envoyé « en clair » (c’est-à-dire sans le chiffrer) sur le réseau. L’étude rappelle qu’à l’époque, toutes les applications pouvaient accéder à l’identifiant, mais Apple a entrepris de limiter l’accès à cette donnée tout en créant les identifiants Advertising identifier, identifiant dédié à la publicité, et l’Identifier for vendor, qui est unique pour chaque éditeur d’application. Même son de cloche chez Google puisqu’Android a opté pour une logique similaire. Sur les deux écosystèmes, les utilisateurs disposent de réglages pouvant limiter le suivi publicitaire. Sur les iPhones, il faut se rendre dans les réglages de confidentialité, accéder à l’option « publicité » et activer le suivi publicitaire limité. Sur Android, l’opération ne figure pas dans les réglages du téléphone mais dans l’application « Paramètres Google » où il faudra activer une option « désactiver annonces par centres d’intérêt ».

«Si les traductions techniques de ces réglages sont différentes, nos tests montrent toutefois que la coexistence de nombreux identifiants facilite grandement les possibilités de contournement de ce type de cloisonnement », affirme Geoffrey Delcroix qui poursuit en disant que « les applications testées utilisent une grande diversité d’identifiants qui pourraient servir à enrichir leurs moyens de suivi de l’utilisateur». Sur un téléphone utilisateur où étaient installées 58 applications, 23 d’entre elles ont accédé à l’Android_id (identifiant persistant comparable à l’UDID d’Apple), 18 ont accédé à l’IMEI (identifiant permettant notamment de bloquer un terminal en cas de perte ou de vol), 10 ont accédé à l’IMSI (identifiant unique stocké dans la carte SIM pour permettre à un opérateur d’identifier un abonné), 5 ont eu accès au numéro de téléphone.

En définitive, « ce travail a confirmé la nécessité pour la CNIL de rester vigilante vis-à-vis de l’information des utilisateurs et des outils de maîtrise des données personnelles mis à disposition par les systèmes d’exploitation et les éditeurs d’applications ». D’ailleurs, concernant les utilisateurs, elle indique qu'ils « devraient disposer de meilleurs outils de contrôles et de paramétrage des données personnelles, et les utiliser ». Aussi, la CNIL souhaite que « l'ensemble des acteurs de l'écosystème (éditeurs d'application, éditeurs des systèmes d'exploitation et responsables des magasins d'applications, tiers fournisseurs de services et d'outils) prenne la juste mesure de leurs responsabilités respectives pour améliorer l'information et les outils de maitrise des données personnelles ».

Source : CNIL

Read More Add comment

Android Studio - The official Android IDE

Read

Read More Add comment

zANTI 2.0 - Android Network Toolkit

Read

Read More Add comment

Not Compatible Malware a threat to Mobile users of Enterprises

Read

NotCompatible.A, which researchers discovered in 2012, acted as a proxy on infected devices, but it didn't cause any direct damage. The mobile malware's authors did not use a complex command and control (C&C) architecture and communications were not encrypted, making it easy for security solutions to detect its activities.

New features in NotCompatible.C

The latest version of the threat, NotCompatible.C, is far more complex. According to Lookout, the authors have made it more difficult to detect and resilient to takedowns by implementing features usually found in mature PC-based malware.

Not Compatable C. uses peer-to-peer (P2P) communications between infected devices, which makes it resilient to IP and DNS blocking, and it relies on multiple C&C servers that are geographically distributed, which enables the malware to function properly even if law enforcement authorities manage to shut down individual servers.

The malware's authors have also started encrypting all C&C and proxied traffic, making it difficult for network security solutions to identify the malicious traffic. Furthermore, public key cryptography is used for mutual authentication between C&C servers and clients.

In an effort to protect their infrastructure, the cybercriminals use a gateway C&C to analyze incoming connections, and block those that come from IP addresses that are not trusted.

NotCompatible.C distribution and use

NotCompatible.C is distributed through spam campaigns and compromised websites. The attackers are not leveraging any exploits, but instead rely on social engineering to trick potential victims into installing the threat on their mobile devicese. One of the distribution campaigns observed by Lookout used the classic "security update" ruse.

According to the security firm, the cybercriminals have acquired compromised websites and accounts in bulk. In one of the spam runs seen by researchers, only Yahoo accounts had been used. In a different campaign, the attackers used only compromised AOL accounts.

These techniques have been successful. Lookout says its solutions have blocked hundreds of thousands of infection attempts in the United States and other countries around the world. In the U.S. for instance, NotCompatible reached encounter rates of more than 1% at its peak, researchers noted.

Read full Article at securityweek

Read More Add comment

Radare - The Reverse Engineering Framework

Read

r2 is a rewrite from scratch of radare in order to provide a set of libraries and tools to work with binary files

This is the rewrite of radare (1.x branch) to provide a framework with a set of libraries and programs to work with binary data.

Radare project started as a forensics tool, an scriptable commandline hexadecimal editor able to open disk files, but later support for analyzing binaries, disassembling code, debugging programs, attaching to remote gdb servers, ..

radare2 is portable.

Architectures:

6502, 8051, arm, arc, avr, bf, tms320 (c54x, c55x, c55+), gameboy csr, dcpu16, dalvik, i8080, mips, m68k, mips, msil, snes, nios II, sh, sparc, rar, powerpc, i386, x86-64, H8/300, malbolge, T8200

File Formats:

bios, dex, elf, elf64, filesystem, java, fatmach0, mach0, mach0-64, MZ, PE, PE+, TE, COFF, plan9, bios, dyldcache, Gameboy and Nintendo DS ROMs

Operating Systems:

Android, GNU/Linux, [Net|Free|Open]BSD, iOS, OSX, QNX, w32, w64, Solaris, Haiku, FirefoxOS

Bindings:

Vala/Genie, Python (2, 3), NodeJS, LUA, Go, Perl, Guile, php5, newlisp, Ruby, Java, OCAM

Features:

Multi-architecture and multi-platform
- GNU/Linux, Android, *BSD, OSX, iPhoneOS, Windows{32,64} and Solaris
- i8080, 8051, x86{16,32,64}, avr, arc{4,compact}, arm{thumb,neon,aarch64}, c55x+, dalvik, ebc, gb, java, sparc, mips, nios2, powerpc, whitespace, brainfuck, malbolge, z80, psosvm, m68k, msil, sh, snes, gb, dcpu16, csr, arc
- pe{32,64}, te, [fat]mach0{32,64}, elf{32,64}, bios/uefi, dex and java classes
Highly scriptable
- Vala, Go, Python, Guile, Ruby, Perl, Lua, Java, JavaScript, sh, ..
- batch mode and native plugins with full internal API access
- native scripting based in mnemonic commands and macros
Hexadecimal editor
- 64bit offset support with virtual addressing and section maps
- Assemble and disassemble from/to many architectures
- colorizes opcodes, bytes and debug register changes
- print data in various formats (int, float, disasm, timestamp, ..)
- search multiple patterns or keywords with binary mask support
- checksumming and data analysis of byte blocks
IO is wrapped
- support Files, disks, processes and streams
- virtual addressing with sections and multiple file mapping
- handles gdb:// and rap:// remote protocols
Filesystems support
- allows to mount ext2, vfat, ntfs, and many others
- support partition types (gpt, msdos, ..)
Debugger support
- gdb remote and brainfuck debugger support
- software and hardware breakpoints
- tracing and logging facilities
Diffing between two functions or binaries
- graphviz friendly code analysis graphs
- colorize nodes and edges
Code analysis at opcode, basicblock, function levels

embedded simple virtual machine to emulate code
keep track of code and data references
function calls and syscall decompilation
function description, comments and library signatures

Download Radare

Read More Add comment

[PDF] liste non exhaustive des livres de programmation

Read

Read More Add comment

A Tale Of Another SOP Bypass In Android Browser < 4.4

Read

Since, my recent android SOP bypass [CVE-2014-6041] triggered a lot of eruption among the infosec community, I was motivated to research a bit more upon the android browser, it turns out that things are much worse than I thought, I managed to trigger quite a few interesting vulnerabilities inside of Android browser, one of them being another Same Origin Policy Bypass vulnerability. The thing that makes it worse was the same SOP bypass was already fixed inside of chrome years ago, however the patches were not applied to Android browser < 4.4.

Proof Of Concept

The following is the proof of concept:

The POC is very easy to understand for individuals having some javaScript background. However, for others let me break it down for you. The above code creates an object with data attribute, which loads up a URL from another origin in this case "http://www.bing.com", however once it's loaded, we replace bing.com with "javascript:alert(document.domain)". The interesting thing here is that the last line is essential for the POC to work object.innerHTML = "foobar"; so that the navigation request is performed

Let's take a look at the vulnerable code that is responsible for the causing the issue:

Vulnerable Code

bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url)
{
ASSERT(document());
ASSERT(document()->frame());
if (document()->frame()->page()->frameCount() >= Page::maxNumberOfFrames)
return false;
KURL completeURL = document()->completeURL(url);

The above function is responsible for loading up the frame URL, if you take a close look at the code, you would find out that there is no validation for javascript scheme, which allows us to execute javaScript in context of the frame that was loaded.

The fix

The issue was fixed by applying the following checks from securityorigin.h library.

if (contentFrame() && protocolIsJavaScript(completeURL)
&& !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin()))
return false;

Proof Of Concept Using Postmessage Call

To help understand the vulnerability better and get to the root cause, i contacted Joe Vennix from metasploit team, who modified my original POC to the following to help demonstrate the vulnerability in an effective manner. The following POC uses postMessage call from HTML 5 world to send the document.cookie and innerHTML to the main window.

Proof Of Concept To Steal Data Across Domains

A great friend of mine @filedescriptor helped me with the following POC, which steals data from bing.com by accessing the document.body.innerHTML property as submits that data cross origin by using a POST request, since you can send limited amount of data with GET due to browser restrictions.

Read More Add comment

Drozer - The Leading Security Assessment Framework for Android

Read

Read More Add comment

drozer - Security Testing Framework for Android

Read

Unquestionably we can say that Android is one the leading mobile operating system, but nobody is secure; so Android also has vulnerabilities and there are methods to exploit them. Since there are vulnerabilities, so we have a reason to study and fix them. Drozer can make your life easy because it is a framework to test the security of Android OS.

drozer (formerly Mercury) is the leading security testing framework for Android.

drozer allows you to search for security vulnerabilities in apps and devices by assuming the role of an app and interacting with the Dalvik VM, other apps' IPC endpoints and the underlying OS.

drozer provides tools to help you use, share and understand public Android exploits. It helps you to deploy a drozer Agent to a device through exploitation or social engineering. Using weasel (MWR's advanced exploitation payload) drozer is able to maximise the permissions available to it by installing a full agent, injecting a limited agent into a running process, or connecting a reverse shell to act as a Remote Access Tool (RAT).
drozer is open source software, maintained by MWR InfoSecurity, and can be downloaded from:

mwr.to/drozer

Faster Android Security Assessments

drozer helps to reduce the time taken for Android security assessments by automating the tedious and time-consuming.

Discover and interact with the attack surface exposed by Android apps.
Execute dynamic Java-code on a device, to avoid the need to compile and install small test scripts.

Test against Real Android Devices

drozer runs both in Android emulators and on real devices. It does not require USB debugging or other development features to be enabled; so you can perform assessments on devices in their production state to get better results.

Automate and Extend

drozer can be easily extended with additional modules to find, test and exploit other weaknesses; this, combined with scripting possibilities, helps you to automate regression testing for security issues.

Test your Exposure to Public Exploits

drozer provides point-and-go implementations of many public Android exploits. You can use these to identify vulnerable devices in your organisation, and to understand the risk that these pose.

Get drozer

drozer is available as both open source software, and a full-featured professional version.

Download
Source

Read More Add comment

Few Android Shortcuts !!

Read

Android key combinations for quick hacks !

1) Force reboot:

Many times android users face a problem of freezing of mobile phone, In case your android phone is frozen, you can reboot it using an android trick.

Just press Power Button+ Home Key + Volume up button simultaneously.

2) Quick Google Access:

Android phones built primarily for internet, many of android users don’t know that android phones provide a way by which we can access Google search in just a single click. To use this android trick,

Press menu key and hold it for couple of seconds, it will launch the Google search.

3) Reboot Android in safe mode:

As like computers, we can also reboot android phones in safe mode. The latest android jelly bean version provides an option to reboot in safe mode, if something goes wrong.
To reboot your android in safe mode, follow the below given instructions.

*Long press the power button
*Long press on the power off option.

Android phone will show a confirmation message about rebooting it in safe mode, if we reboot android phone in safe mode then all the 3rd party application will be disabled. These applications can again be enabled when we reboot our phone normally. This is a great android utility in case when, one of your 3rd party application is causing trouble for you and you want to hunt it.

4) Unlock android phones by face detection:

This is a cool android trick by which you can unlock your phone by using face detection, In the jelly bean version, android provides a way by which android phone can be unlock using face detection, to make this feature more secure, jelly bean version added another layer of protection in which android phone can be unlocked only when the face is matched as well as we have to blink eyes in order to unlock phone. Blinking eyes tells the android security system that person is live and it’s not an illegal attempt of unlocking using a still image.
To activate this,

Go to Settings > Security > Screen lock > Face unlock.

5) Get detailed information about phone status:

We can get the detailed statistics like phone information, battery information, usage statistics and WiFi information by just dialing *#*#4636#*#*

This is a handy USSD to get the details about battery usage, DNS check, Ping, Application time usage time and so on.

6) Move android apps to SD card:

Its good idea to install android apps in SD card, but what if you installed apps on your phone memory. Don’t worry android phones provide a way by which we can move our apps to SD card. To move apps to SD card, follow these steps:

Go to settings > Application settings > Manage application > Select the application, You will see the option “Move to SD card”.

7) Hard Reset and Factory reset your android phone:

This android trick comes handy at the time of selling an android phone. Android phone can be formatted in two ways

Factory reset
Hard reset

a) Factory reset: In factory reset, your phone is being formatted to factory level. Means all the settings will go by default and all the internal data will be deleted. To factory reset a phone dial *#*#7780#*#*.

b) Hard reset: To hard reset a phone dial *2767*3855#, this will delete all the data (including internal and External SD data) as well as settings of android phone. Don’t try this code for testing purpose, until you are not sure. It will not ask for a confirmation.

8) Context menu in android:

long press on the screen, will show you additional options for customizing android phones. This context menu is somewhat similar to the right click menu of most operating systems.

9) Taking screen shots on android phone:

Android phones offer a great feature by which we can take the screen shot without using any 3rd party application. However the screen shot android tricks vary from one android version to another version.

Press the Home button + power button (This trick work on most android phones.)
For Galaxy Nexus: Power button + volume down button.
For Galaxy Note 2 and S3: Swipe your palm on the screen to take screen shot.

10) Android Version Animation:

This is another cool android trick to play with your android phone.
To use this android trick, Go to settings > about phone > Tab repeatedly on ‘Android version’.

After sometime, the android version will be animated

Read More Add comment