Technical Analysis on 360 Communication record Encryption

Technical Analysis on 360 Communication record Encryption

 

Inspired by David Auerbach [1], we analyzed the 360 address book and found some very interesting security issues. Here we will talk about its transmission encryption problems. 360 the address book can be downloaded from Qihoo's official website [2]. This application provides spam SMS recognition, incoming call number recognition, and other functions. Below are some basic information about this application.

App: 360 contactVersion: 2.1.2Package: com.qihoo360.contactsMD5: 024d2b182fcadf19dc31457e7612c297SHA-1: de0c0d41dfae8d9803d898ba8955691dc7dffdf7

Find backup key

This application also has a backup feature in the setting options. With this feature, you can back up the address book to the cloud. Let's take a look at the data transmitted during Backup:

 

From the transmitted data, we can see that 1. This app uses the http protocol to transmit data; 2. the transmitted data is encrypted. To find out how the app encrypts data, we turn to the app code. Through code, we found that this app uses the des encryption algorithm to encrypt the data to be transmitted (Figure 2 ). The encryption key comes from the native code (Figure 3 ).

 

 

Next, we turn to the native code. Figure 4 corresponds to the interface function that provides the decryption key. The sub_758164B4 () function generates the key. Note that when this function is called, the second parameter is a constant.

 

Then we enter the sub_758164B4 function. The analysis shows that the decryption key comes from the second parameter of the function. The algorithm for generating the decryption key is very simple. That is, if each character in the string pointed to by the second parameter is reduced by 13, the decryption key is obtained. As mentioned above, the second parameter of this function is a fixed string.

Therefore, we can conclude that the decryption key for data transmitted over http is also fixed. The value is: * #13o-69!

 

 

Decrypt data

To decrypt the data, we return to the java code (Figure 8). Through analysis, we have figured out the specific meaning of the transmitted data (Figure 1:

 

 

The following work should be simple. We then wrote a simple code to verify our conclusion.