Monday, November 4, 2024
HomeAndroidAndroid Application Penetration Testing - Part 9

Android Application Penetration Testing – Part 9

Published on

Malware protection

In Last Part, Android Application Penetration Testing Part 8 We have seen about the Attacking through Content Provider when an app wants to share data with another app.

Attacking through Android Pasteboard:

Android provides the clipboard framework for copying and pasting different types of data. The data could be text, images, binary stream data or other complex data types.

Simple text data is stored directly in the clipboard, while complex data is stored as a reference that the pasting application resolves with a content provider.

- Advertisement - SIEM as a Service

Copying and pasting work both within an application and between applications that implement the framework.

In order to use a clipboard, you need to instantiate an object of ClipboardManager by calling the getSystemService() method.

“Service call clipboard” where service codes are 1, 2, and 3, for getClipboardText, setClipboardText, and hasClipboardText respectively.

Service call clipboard 2 s16 thisisinsertedtext

Consider a bank application and we are copying account number from an application

we can see all process and we can grep the process we want by using apk name

ps | grep ‘insecure’

we can get the account number which were copied by using following command

su (PID) u0_a80 service call clipboard 2 s16 (.apk name) com.android.insecurebank

We can see the input which was copied in an application. When it comes to a credit card, debit card, PIN , CVV and account number, It will be much critical.

Mitigation:

To avoid completely clipboard usage, KeePass proposes what it calls Auto-Type: it will directly fill targeted fields by simulating the appropriate key presses. The advantage is that no data ever passes through the clipboard.

When using the clipboard to copy/paste passwords, KeePass can be configured to automatically clear the clipboard after a short amount of time.

When copying a password, KeePass displays at the bottom of its main window a decreasing progress bar giving the user a visual feedback over the timeout progress, and once the timeout expires (15 or 30 seconds for instance) and if the clipboard still contains KeePass data then KeePass deletes the clipboard content (the user must not use one of those “clipboard history managers” for this to be really effective though).

Also Read :     Top 5 Best Android Hacking Apps 2017

Attacking through Android Keyboard Cache:

Android contains a user dictionary, where words entered by a user can be saved for future auto-correction. This user dictionary is available to any app without special permissions.

In the following example, we are adding username ti dictionary by selecting text

you can retrieve this information in user_dict database

you can find user_dict.db in /data/data/com.android.providers.userdictionary/databases 

by opening the database sqlite3 user_dict.db 

select * from words;  This SQL query provide you all information or words which added into ‘added to dictionary’

Mitigation:

Disable the auto-correct feature for any sensitive information, not just for password fields. Since the keyboard caches sensitive information, it may be recoverable.

For increased security, consider implementing a custom keyboard (and potentially PIN entry), which can disable caching and provide additional protection against malware.

Android Application Penetration Testing Other Parts :

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

ErrorFather Hackers Attacking & Control Android Device Remotely

The Cerberus Android banking trojan, which gained notoriety in 2019 for its ability to...

TrickMo Malware Targets Android Devices to Steal Unlock Patterns and PINs

The recent discovery of the TrickMo Banking Trojan variant by Cleafy has prompted further...

Hackers Exploiting Zero-day Flaw in Qualcomm Chips to Attack Android Users

Hackers exploit a zero-day vulnerability found in Qualcomm chipsets, potentially affecting millions worldwide.The flaw,...