1 of 64

APPLICATION SECURITY

(Threats and Malpractices)

Speaker: Dimitrios Valsamaras | @Ch0pin

https://www.linkedin.com/in/valsamaras/

2 of 64

Common Malpractices

Webviews
Floating Windows
Accessibility Service
Administration API
Reflection
Dynamic Code Loading

3 of 64

Webviews

Usage: WebView objects allow the developers to deliver web-based content to the user as a part of an activity’s layout.

Customization
Increased control over the UI

4 of 64

Webviews - Basic Usage

5 of 64

Webviews - Enabling Javascript

6 of 64

Webviews - Enabling File Access

? ?

7 of 64

Webviews - Bridging Java with Javascript

function showAndroidToast(toast) {

AndroidBridge.showToast(“Hello from Java Script”);

}

Javascript:

8 of 64

Webviews - Malpractices

Intentional

9 of 64

Webviews - Malpractices

When misused WebViews impose a great risk for the user !!

Common Malpractices:

Javascript Injection

Web Scraping

Backdoor-ing

Silent Loading

10 of 64

WebViews - Javascript Injection

Using the onPageStarted, onPageFinished callbacks or the onProgessChanged (less common) we may track the loading process of a web page and append arbitrary code.

myWebView.setWebViewClient(new WebViewClient() {

@Override

public void onPageFinished(WebView view, String url) {

super.onPageFinished(view, url);

INJECTION POINT

}

});

11 of 64

WebView - Javascript Injection - Cookies

12 of 64

WebViews - Javascript Injection - Auto Clicks

13 of 64

WebView - Javascript Injection - Scrapping

14 of 64

WebView - Javascript Scraping

15 of 64

WebView - Backdooring

16 of 64

WebView - Silent Loading

By changing the visibility or the size of the webview all the operations can take place without being perceived by the user:

myWebView.setVisibility(myWebView.GONE)

17 of 64

Webviews - Malpractices

UnIntentional

18 of 64

WebView - Hijacking

am start -n com.training.webviews/.MainActivity --es url https://www.example.com

am start -n com.training.webviews/.MainActivity --es url "javascript:AndroidBridge.execCmd('ls -al')"

Get the code https://github.com/Ch0pin/WebViews

19 of 64

Common Malpractices

Webviews
Floating Windows
Accessibility Service
Administration API
Reflection
Dynamic Code Loading

20 of 64

Free Floating Windows

Definition: A free floating window is a category of windows that can appear freely above any other applications while its existence doesn’t depend on its parent. Additionally, its behaviour and appearance is fully customisable and controllable by the developer.

Not to be confused with Picture in Picture (e.g. Google Maps, youtube e.t.c.)

21 of 64

Free Floating Windows

Some Features

https://www.floatingapps.net/

22 of 64

FFW Implementation

By the time that SYSTEM_ALERT_WINDOW permission is approved, an application is authorised to create a TYPE_APPLICATION_OVERLAY window type which will be displayed on top of other activities, but below critical system ones (e.g. status bar or IME).

Besides a fully customizable appearance, a flag attribute will affect the event processing behaviour of a window, so a flag FLAG_NOT_TOUCHABLE will dispatch the events to the window behind, while a FLAG_WATCH_OUTSIDE_TOUCH will inform the app about the event but will omit details like the touch coordinates.

23 of 64

FFW Implementation (creating a floating button)

<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>

Create a view (e.g. a button)

Button floatingButton = new Button(getApplicationContext());

Create a Window Manager instance

WindowManager windowManager = (WindowManager) getSystemService(WINDOW_SERVICE);

Customize via the Layout Parameters

WindowManager.LayoutParams params = new WindowManager.LayoutParams(width, height,

WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY,

WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE,

PixelFormat.TRANSPARENT);

24 of 64

FFW Implementation (creating a floating button - continued )

Add the view to the FFW

windowManager.addView(floatingButton, params);

FFW

25 of 64

FFW Implementation (creating a floating button - continued )

Remove the Parent

26 of 64

FFW What is wrong with that ?

Background Restrictions (Android 8.0):

Apps that are running in the background now have limits on how freely they can access background services.
Apps cannot use their manifests to register for most implicit broadcasts (that is, broadcasts that are not targeted specifically at the app).

More restrictions ...

Android 10 (API level 29) and higher place restrictions on when apps can start activities when the app is running in the background. These restrictions help minimize interruptions for the user and keep the user more in control of what's shown on their screen.

27 of 64

FFW What is wrong with that ?

Exceptions to the restriction

Apps running on Android 10 or higher can start activities only when one or more of the following conditions are met:

The app has a visible window, such as an activity in the foreground.
The app has an activity in the back stack of the foreground task.
The app has an activity in the back stack of an existing task on the Recents screen.

Can it be invisible ?

btn.setAlpha(0);

28 of 64

FFW Abuse

From Free Floating Windows to Free Popping Windows

SPAM

Ransomware

29 of 64

FFW Abuse, TapJacking

Creating more than a simple View...

A LayoutInflater instantiates a layout XML file into its corresponding View objects

LayoutInflater layoutInflater = getLayoutInflater();

View mLayout = layoutInflater.inflate(R.layout.tapjacking_dialog,null);

windowManager.addView(mLayout,params);

30 of 64

FFW Abuse, TapJacking

WindowManager windowManager = (WindowManager) getSystemService(WINDOW_SERVICE);

WindowManager.LayoutParams params = new WindowManager.LayoutParams(1200,1200,

WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY,

WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE,

PixelFormat.TRANSPARENT);

Click through:

Send touches to the window behind

31 of 64

Picture In Picture

Definition: PiP is a special type of multi-window mode mostly used for video playback. It lets the user watch a video in a small window pinned to a corner of the screen while navigating between apps or browsing content on the main screen.

Popular Applications that use PiP:

32 of 64

Picture In Picture - Implementation

No special permissions !!

<activity android:name="VideoActivity"

android:supportsPictureInPicture="true"

android:configChanges=

"screenSize|smallestScreenSize|screenLayout|orientation"

public void onActionClicked(Action action) {

if (action.getId() == R.id.lb_control_picture_in_picture) {

getActivity().enterPictureInPictureMode();

return;

}

...

}

Add the specific entry in the AndroidManifest

Call the enterPictureInPictureMode

33 of 64

Picture In Picture

Applications in PiP mode maintain their foreground state

A PiP window is enclosed in a shadowed frame, which is a fact that renders it visible to the user even if the activity has been set up to be transparent.

No size restrictions though as it can be arbitrary small or large

<activity android:name=".MainActivity"

android:supportsPictureInPicture="true"

android:theme="@style/Theme.AppCompat">

<layout android:defaultHeight="1dp"

android:defaultWidth="1dp"

android:gravity="top|end"

android:minHeight="1dp"

android:minWidth="1dp" />

34 of 64

Common Malpractices

Webviews
Floating Windows
Accessibility Service
Administration API
Reflection
Dynamic Code Loading

35 of 64

Accessibility Service

The accessibility service provides user interface enhancements to assist users with disabilities, or who may temporarily be unable to fully interact with a device. For example, users who are driving, taking care of a young child might need additional or alternative interface feedback.

? ?

A powerful set of API calls, used by many popular apps including Google Assistant, Google maps, password managers, app lockers

but also from ….

Trojans, backdoors, bots, phishing apps e.t.c.

36 of 64

Accessibility Service from a security perspective

An application for which the accessibility service has been granted can run in the background and…

Read the UI of any other application
Parse the entire Android UI to check which layouts are in the screen
Check whether the screen has changed or the screen content has changed
Read notifications coming from/for any application
Perform Clicks / Swipes
Set text to textviews

… Pretty much, it can act in behalf of the user

37 of 64

Accessibility Service - How to enable (Android 10)

Settings → Accessibility →

Click on the app →

Use Service→ Allow

38 of 64

Accessibility Service - Implementation

Implementation Class

Intent filter

Permission

Configuration

AccessibilityService_accessibilityEventTypes: The event types this service would like to receive as specified in AccessibilityEvent. This setting can be changed at runtime by calling

39 of 64

Accessibility Service - Java Code Implementation

Override Required

Class name declared in the Manifest

40 of 64

Accessibility Service - Accessibility Event

An accessibility event is fired by an individual view which populates the event with data for its state and requests from its parent to send the event to interested parties. The parent can optionally modify or even block the event based on its broader understanding of the user interface's context.

The main purpose of an accessibility event is to communicate changes in the UI to an AccessibilityService.

The service may inspect, if needed the user interface by examining the View hierarchy, as represented by a tree of AccessibilityNodeInfo (snapshot of a View state) which can be used for exploring the window content.

41 of 64

Accessibility Service - View Hierarchy Example

Figure by: https://stackoverflow.com/questions/18004148/android-what-is-view-hierarchy

42 of 64

Accessibility Service - Event Lifecycle

UI changed

Accessibility Event

Match ?

Ignore

No

Yes

Trigger Callback

43 of 64

Accessibility Service - Abuse

Flutbot Abuses the accessibility service to get the foreground app.

If the application is in its target list, it will trigger an overlay which will cover the legitimate application with a fake one

After getting the credentials inserted to the fake view, it sends them to a Command and Control server

Video by: https://www.threatmark.com/flubot-banking-malware/

44 of 64

Accessibility Service - Abuse

Overlays targeting legitimate applications

Figure by: https://www.threatmark.com/flubot-banking-malware/

45 of 64

Accessibility Service - Abuse, Overlays

Monitoring the API calls performed by the accessibility service implementation.

46 of 64

Accessibility Service - Abuse

Click

Home

47 of 64

Accessibility Service - Abuse

log typed keys (keyloggers)

auto-enable permissions

auto-enable access to services

When correctly coordinated it can perform chain of actions to automate more complex tasks (e.g. screen recording)

48 of 64

Common Malpractices

Webviews
Floating Windows
Accessibility Service
Administration API
Reflection
Dynamic Code Loading

49 of 64

Device Admin

Definition: The Device Administration API provides device administration features at the system level. These APIs allow you to create security-aware apps that are useful in enterprise settings, in which IT professionals require rich control over employee devices.

50 of 64

Device Admin

Set password quality.
Specify requirements for the user's password, such as minimum length, the minimum number of numeric characters it must contain, and so on.
Set the password. If the password does not conform to the specified policies, the system returns an error.
Set how many failed password attempts can occur before the device is wiped (that is, restored to factory settings).
Set how long from now the password will expire.
Set the password history length (length refers to number of old passwords stored in the history). This prevents users from reusing one of the last n passwords they previously used.
Specify that the storage area should be encrypted, if the device supports it.
Set the maximum amount of inactive time that can elapse before the device locks.
Make the device lock immediately.
Wipe the device's data (that is, restore factory settings).
Disable the camera.

51 of 64

Device Admin - Implementation

DeviceAdminReceiver subclass

Permission

Filter

52 of 64

Device Admin - Callbacks

Permission

53 of 64

Common Malpractices

Webviews
Floating Windows
Accessibility Service
Administration API
Reflection
Dynamic Code Loading

54 of 64

Java Reflection

Reflection is commonly used by programs which require the ability to examine or modify the runtime behavior of applications running in the Java virtual machine. This is a relatively advanced feature and should be used only by developers who have a strong grasp of the fundamentals of the language. With that caveat in mind, reflection is a powerful technique and can enable applications to perform operations which would otherwise be impossible.

Figure from: https://techvidvan.com/tutorials/reflection-in-java/

55 of 64

Java Reflection

url: https://techvidvan.com/tutorials/reflection-in-java/

56 of 64

Java Reflection

The Test class users reflection to get the ReflectionDemo class characteristics and invoke its defined methods.

https://techvidvan.com/tutorials/reflection-in-java/

57 of 64

Java Reflection - Misuse

Example: “java.lang.Runtime” , “1”

Can be used to “hide” suspicious API calls

[PGP.]P_V.cD_EX\T

Return

Class cls = Class.forName(decrypt(“[PGP.]P_V.cD_EX\T”));

58 of 64

Common Malpractices

Webviews
Floating Windows
Accessibility Service
Administration API
Reflection
Dynamic Code Loading

59 of 64

Dynamic Code Loading - DCL

DCL(Dynamic code loading) allows an application to load code that is not part of its static, initial codebase. The additional code can be retrieved from a remote location and executed at runtime.

Code Reuse

Extensibility

Self-upgrade

60 of 64

Dynamic Code Loading - Implementation

DexClassLoader(String dexPath, String optimizedDirectory, String librarySearchPath, ClassLoader parent)

dexPath	String: the list of jar/apk files containing classes and resources, delimited by File.pathSeparator, which defaults to ":" on Android
optimizedDirectory	String: this parameter is deprecated and has no effect since API level 26.
librarySearchPath	String: the list of directories containing native libraries, delimited by File.pathSeparator; may be null
parent	ClassLoader: the parent class loader

61 of 64

Dynamic Code Loading - Implementation

Fetch the dex, jar, apk e.t.c

String dexPath = context.getFilesDir().getAbsolutePath() + “/” +"dexPath.dex";

Final DexClassLoader nClazz = new DexClassLoader(dexPath,mContext.getCodeCacheDir().getAbsolutePath(), null,getClass().getClassLoader()).loadClass(clazz);

DexClassLoader(String dexPath, String optimizedDirectory, String librarySearchPath, ClassLoader parent)