1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
| Introduction xxv
Chapter 1 Looking at the Ecosystem 1
Understanding Android’s Roots 1
Company History 2
Version History 2
Examining the Device Pool 4
Open Source, Mostly 7
Understanding Android Stakeholders 7
Google 8
Hardware Vendors 10
Carriers 12
Developers 13
Users 14
Grasping Ecosystem Complexities 15
Fragmentation 16
Compatibility 17
Update Issues 18
Security versus Openness 21
Public Disclosures 22
Summary 23
Chapter 2 Android Security Design and Architecture 25
Understanding Android System Architecture 25
Understanding Security Boundaries and Enforcement 27
Android’s Sandbox 27
Android Permissions 30
Looking Closer at the Layers 34
Android Applications 34
The Android Framework 39
The Dalvik Virtual Machine 40
User-Space Native Code 41
The Kernel 49
Complex Security, Complex Exploits 55
Summary 56
Chapter 3 Rooting Your Device 57
Understanding the Partition Layout 58
Determining the Partition Layout 59
Understanding the Boot Process 60
Accessing Download Mode 61
Locked and Unlocked Boot Loaders 62
Stock and Custom Recovery Images 63
Rooting with an Unlocked Boot Loader 65
Rooting with a Locked Boot Loader 68
Gaining Root on a Booted System 69
NAND Locks, Temporary Root, and Permanent Root 70
Persisting a Soft Root 71
History of Known Attacks 73
Kernel: Wunderbar/asroot 73
Recovery: Volez 74
Udev: Exploid 74
Adbd: RageAgainstTheCage 75
Zygote: Zimperlich and Zysploit 75
Ashmem: KillingInTheNameOf and psneuter 76
Vold: GingerBreak 76
PowerVR: levitator 77
Libsysutils: zergRush 78
Kernel: mempodroid 78
File Permission and Symbolic Link–Related Attacks 79
Adb Restore Race Condition 79
Exynos4: exynos-abuse 80
Diag: lit / diaggetroot 81
Summary 81
Chapter 4 Reviewing Application Security 83
Common Issues 83
App Permission Issues 84
Insecure Transmission of Sensitive Data 86
Insecure Data Storage 87
Information Leakage Through Logs 88
Unsecured IPC Endpoints 89
Case Study: Mobile Security App 91
Profi ling 91
Static Analysis 93
Dynamic Analysis 109
Attack 117
Case Study: SIP Client 120
Enter Drozer 121
Discovery 121
Snarfing 122
Injection 124
Summary 126
Chapter 5 Understanding Android’s Attack Surface 129
An Attack Terminology Primer 130
Attack Vectors 130
Attack Surfaces 131
Classifying Attack Surfaces 133
Surface Properties 133
Classification Decisions 134
Remote Attack Surfaces 134
Networking Concepts 134
Networking Stacks 139
Exposed Network Services 140
Mobile Technologies 142
Client-side Attack Surface 143
Google Infrastructure 148
Physical Adjacency 154
Wireless Communications 154
Other Technologies 161
Local Attack Surfaces 161
Exploring the File System 162
Finding Other Local Attack Surfaces 163
Physical Attack Surfaces 168
Dismantling Devices 169
USB 169
Other Physical Attack Surfaces 173
Third-Party Modifi cations 174
Summary 174
Chapter 6 Finding Vulnerabilities with Fuzz Testing 177
Fuzzing Background 177
Identifying a Target 179
Crafting Malformed Inputs 179
Processing Inputs 180
Monitoring Results 181
Fuzzing on Android 181
Fuzzing Broadcast Receivers 183
Identifying a Target 183
Generating Inputs 184
Delivering Inputs 185
Monitoring Testing 185
Fuzzing Chrome for Android 188
Selecting a Technology to Target 188
Generating Inputs 190
Processing Inputs 192
Monitoring Testing 194
Fuzzing the USB Attack Surface 197
USB Fuzzing Challenges 198
Selecting a Target Mode 198
Generating Inputs 199
Processing Inputs 201
Monitoring Testing 202
Summary 204
Chapter 7 Debugging and Analyzing Vulnerabilities 205
Getting All Available Information 205
Choosing a Toolchain 207
Debugging with Crash Dumps 208
System Logs 208
Tombstones 209
Remote Debugging 211
Debugging Dalvik Code 212
Debugging an Example App 213
Showing Framework Source Code 215
Debugging Existing Code 217
Debugging Native Code 221
Debugging with the NDK 222
Debugging with Eclipse 226
Debugging with AOSP 227
Increasing Automation 233
Debugging with Symbols 235
Debugging with a Non-AOSP Device 241
Debugging Mixed Code 243
Alternative Debugging Techniques 243
Debug Statements 243
On-Device Debugging 244
Dynamic Binary Instrumentation 245
Vulnerability Analysis 246
Determining Root Cause 246
Judging Exploitability 260
Summary 261
Chapter 8 Exploiting User Space Software 263
Memory Corruption Basics 263
Stack Buffer Overfl ows 264
Heap Exploitation 268
A History of Public Exploits 275
GingerBreak 275
zergRush 279
mempodroid 283
Exploiting the Android Browser 284
Understanding the Bug 284
Controlling the Heap 287
Summary 290
Chapter 9 Return Oriented Programming 291
History and Motivation 291
Separate Code and Instruction Cache 292
Basics of ROP on ARM 294
ARM Subroutine Calls 295
Combining Gadgets into a Chain 297
Identifying Potential Gadgets 299
Case Study: Android 4.0.1 Linker 300
Pivoting the Stack Pointer 301
Executing Arbitrary Code from a New Mapping 303
Summary 308
Chapter 10 Hacking and Attacking the Kernel 309
Android’s Linux Kernel 309
Extracting Kernels 310
Extracting from Stock Firmware 311
Extracting from Devices 314
Getting the Kernel from a Boot Image 315
Decompressing the Kernel 316
Running Custom Kernel Code 316
Obtaining Source Code 316
Setting Up a Build Environment 320
Confi guring the Kernel 321
Using Custom Kernel Modules 322
Building a Custom Kernel 325
Creating a Boot Image 329
Booting a Custom Kernel 331
Debugging the Kernel 336
Obtaining Kernel Crash Reports 337
Understanding an Oops 338
Live Debugging with KGDB 343
Exploiting the Kernel 348
Typical Android Kernels 348
Extracting Addresses 350
Case Studies 352
Summary 364
Chapter 11 Attacking the Radio Interface Layer 367
Introduction to the RIL 368
RIL Architecture 368
Smartphone Architecture 369
The Android Telephony Stack 370
Telephony Stack Customization 371
The RIL Daemon (rild) 372
The Vendor-RIL API 374
Short Message Service (SMS) 375
Sending and Receiving SMS Messages 376
SMS Message Format 376
Interacting with the Modem 379
Emulating the Modem for Fuzzing 379
Fuzzing SMS on Android 382
Summary 390
Chapter 12 Exploit Mitigations 391
Classifying Mitigations 392
Code Signing 392
Hardening the Heap 394
Protecting Against Integer Overfl ows 394
Preventing Data Execution 396
Address Space Layout Randomization 398
Protecting the Stack 400
Format String Protections 401
Read-Only Relocations 403
Sandboxing 404
Fortifying Source Code 405
Access Control Mechanisms 407
Protecting the Kernel 408
Pointer and Log Restrictions 409
Protecting the Zero Page 410
Read-Only Memory Regions 410
Other Hardening Measures 411
Summary of Exploit Mitigations 414
Disabling Mitigation Features 415
Changing Your Personality 416
Altering Binaries 416
Tweaking the Kernel 417
Overcoming Exploit Mitigations 418
Overcoming Stack Protections 418
Overcoming ASLR 418
Overcoming Data Execution Protections 419
Overcoming Kernel Protections 419
Looking to the Future 420
Official Projects Underway 420
Community Kernel Hardening Efforts 420
A Bit of Speculation 422
Summary 422
Chapter 13 Hardware Attacks 423
Interfacing with Hardware Devices 424
UART Serial Interfaces 424
I2C, SPI, and One-Wire Interfaces 428
JTAG 431
Finding Debug Interfaces 443
Identifying Components 456
Getting Specifi cations 456
Difficulty Identifying Components 457
Intercepting, Monitoring, and Injecting Data 459
USB 459
I2C, SPI, and UART Serial Interfaces 463
Stealing Secrets and Firmware 469
Accessing Firmware Unobtrusively 469
Destructively Accessing the Firmware 471
What Do You Do with a Dump? 474
Pitfalls 479
Custom Interfaces 479
Binary/Proprietary Data 479
Blown Debug Interfaces 480
Chip Passwords 480
Boot Loader Passwords, Hotkeys, and Silent Terminals 480
Customized Boot Sequences 481
Unexposed Address Lines 481
Anti-Reversing Epoxy 482
Image Encryption, Obfuscation, and Anti-Debugging 482
Summary 482
Appendix A Tool Catalog 485
Development Tools 485
Android SDK 485
Android NDK 486
Eclipse 486
ADT Plug-In 486
ADT Bundle 486
Android Studio 487
Firmware Extraction and Flashing Tools 487
Binwalk 487
fastboot 487
Samsung 488
NVIDIA 489
LG 489
HTC 489
Motorola 490
Native Android Tools 491
BusyBox 491
setpropex 491
SQLite 491
strace 492
Hooking and Instrumentation Tools 492
ADBI Framework 492
ldpreloadhook 492
XPosed Framework 492
Cydia Substrate 493
Static Analysis Tools 493
Smali and Baksmali 493
Androguard 493
apktool 494
dex2jar 494
jad 494
JD-GUI 495
JEB 495
Radare2 495
IDA Pro and Hex-Rays Decompiler 496
Application Testing Tools 496
Drozer (Mercury) Framework 496
iSEC Intent Sniffer and Intent Fuzzer 496
Hardware Hacking Tools 496
Segger J-Link 497
JTAGulator 497
OpenOCD 497
Saleae 497
Bus Pirate 497
GoodFET 497
Total Phase Beagle USB 498
Facedancer21 498
Total Phase Beagle I2C 498
Chip Quik 498
Hot air gun 498
Xeltek SuperPro 498
IDA 499
Appendix B Open Source Repositories 501
Google 501
AOSP 501
Gerrit Code Review 502
SoC Manufacturers 502
AllWinner 503
Intel 503
Marvell 503
MediaTek 504
Nvidia 504
Texas Instruments 504
Qualcomm 505
Samsung 505
OEMs 506
ASUS 506
HTC 507
LG 507
Motorola 507
Samsung 508
Sony Mobile 508
Upstream Sources 508
Others 509
Custom Firmware 509
Linaro 510
Replicant 510
Code Indexes 510
Individuals 510
Appendix C References 511
Index 523
|
