Saturday, July 13, 2024
EHA

Android Application Penetration Testing – Part 9

In Last Part, Android Application Penetration Testing Part 8 We have seen about the Attacking through Content Provider when an app wants to share data with another app.

Attacking through Android Pasteboard:

Android provides the clipboard framework for copying and pasting different types of data. The data could be text, images, binary stream data or other complex data types.

Simple text data is stored directly in the clipboard, while complex data is stored as a reference that the pasting application resolves with a content provider.

Copying and pasting work both within an application and between applications that implement the framework.

In order to use a clipboard, you need to instantiate an object of ClipboardManager by calling the getSystemService() method.

“Service call clipboard” where service codes are 1, 2, and 3, for getClipboardText, setClipboardText, and hasClipboardText respectively.

Service call clipboard 2 s16 thisisinsertedtext

Consider a bank application and we are copying account number from an application

we can see all process and we can grep the process we want by using apk name

ps | grep ‘insecure’

we can get the account number which were copied by using following command

su (PID) u0_a80 service call clipboard 2 s16 (.apk name) com.android.insecurebank

We can see the input which was copied in an application. When it comes to a credit card, debit card, PIN , CVV and account number, It will be much critical.

Mitigation:

To avoid completely clipboard usage, KeePass proposes what it calls Auto-Type: it will directly fill targeted fields by simulating the appropriate key presses. The advantage is that no data ever passes through the clipboard.

When using the clipboard to copy/paste passwords, KeePass can be configured to automatically clear the clipboard after a short amount of time.

When copying a password, KeePass displays at the bottom of its main window a decreasing progress bar giving the user a visual feedback over the timeout progress, and once the timeout expires (15 or 30 seconds for instance) and if the clipboard still contains KeePass data then KeePass deletes the clipboard content (the user must not use one of those “clipboard history managers” for this to be really effective though).

Also Read :     Top 5 Best Android Hacking Apps 2017

Attacking through Android Keyboard Cache:

Android contains a user dictionary, where words entered by a user can be saved for future auto-correction. This user dictionary is available to any app without special permissions.

In the following example, we are adding username ti dictionary by selecting text

you can retrieve this information in user_dict database

you can find user_dict.db in /data/data/com.android.providers.userdictionary/databases 

by opening the database sqlite3 user_dict.db 

select * from words;  This SQL query provide you all information or words which added into ‘added to dictionary’

Mitigation:

Disable the auto-correct feature for any sensitive information, not just for password fields. Since the keyboard caches sensitive information, it may be recoverable.

For increased security, consider implementing a custom keyboard (and potentially PIN entry), which can disable caching and provide additional protection against malware.

Android Application Penetration Testing Other Parts :

Website

Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles