Introduction to mobile APP attacks

Introduction to mobile APP attacks

Attacks on mobile apps are nothing new, and there are many tutorials on the Internet. However, many penetration testers still cannot classify their attack technologies, or even do poorly. Mobile app attacks are similar to other attacks. However, it is useless if you do not practice these techniques frequently.

So how can we improve ourselves? In fact, the google App Store has more than 1.5 million apps, including vulnerable apps and even dedicated test apps. You can download them to play.

We will summarize the analysis methods of mobile apps, including:

File System Analysis

Network Analysis

Source code analysis

Dynamic Analysis

In this article, we will describe the file system analysis. If necessary, some extensions will be made in the future.

To access the content of a file system, we need to obtain certain permissions. In Android, the Root permission is usually used. Many people say, "It is easy to have the root permission. If you don't have the root permission, you won't be able to do anything, and most users' devices won't have the root permission ". This is a good question. When I demonstrate what is a real security threat to an enterprise, I think that I can write a tool to access the file system without the root permission, so BackHack was born.

BackHack was created in about two years, but it was always put aside due to busy work. Until a few weeks ago, I found a new game: Alto's Adventure. This game is suitable for killing time and making extremely beautiful games. It took me a long time to get through and collect gold coins. In this case, I decided to repeat backHAck to see what I did for this APP.

First, we must ensure that Android Studio is installed or at least Android Debug Bridge is installed. Of course, we also need to enable the debugging mode for our devices. At this time, send the "adb devices" command and confirm that your device is connected.

 

Now, run backHack. (Python backHack. py)

 

BackHack uses a very simple directory system interface, which is very easy to use. First, we need to select the app that we want to ". Go to option 1, and select option 1 to list the apps on the device. Option 2 provides the app search function, or option 3 to enter the app name. Our purpose is to analyze Alto's adventure, so we chose option 2 to search for 'alto '. For example, we can see that the name is "com. noodlecake. then copy and paste the name to option 3 and return the home directory:

 

Next, I used option 2 Backup and Extract App to back up the app. In this step, the program will remind you to unlock your device and confirm the backup operation:

 

Once the backup is successful, backHack extracts the backup and stores the file system content in the apps/directory. In this case, the path is apps/com. noodlecake. altosadventure.

 

Then we can take a look at what is in the file system. Generally, the sp (shared_prefs) folder and the db folder (database) are good places. In Alto's Adventure, there is an xml folder named "com. noodlecake. altosadventure. XML.

 

We checked this file and found the app configuration information, including gold coins and grades. I found that this value can be easily changed. After checking what will happen, we set the gold coin to 999999999 and the grade to 60. (60 is the highest level, and I don't set the gold coin to $1,000,000,000, so I don't want to, don't rush to death with obsessive-compulsive disorder -. -)

 

After saving the file, we will return backHack and select option 3 to repackage your app and restart your device. Then, the software prompts to restore the app, such:

 

Now that the app has been restored, open the app to see what will happen.

 

999,999,999 of gold coins, grade 61! (Note that the parameter set to 60 in the XML file is currentGoalLevel. This parameter actually indicates the "completion target level ". Of course, the amount of gold coins reaches 1,000,000,000. Guess if they have reached the upper limit ?)

 

 

 

 

Well, this is an interesting method. You can get some extra gold coins and grades during the game. This method can also be used on any app.

In many cases, this is not only about modifying app data, but you may also find some passwords and other sensitive information. backHack is a good example of potential risks for devices without a root user. Therefore, in fact, all devices without locks can be obtained.