Categories: Android

Android Application Penetration Testing – Part 9

In Last Part, Android Application Penetration Testing Part 8 We have seen about the Attacking through Content Provider when an app wants to share data with another app.

Attacking through Android Pasteboard:

Android provides the clipboard framework for copying and pasting different types of data. The data could be text, images, binary stream data or other complex data types.

Simple text data is stored directly in the clipboard, while complex data is stored as a reference that the pasting application resolves with a content provider.

Copying and pasting work both within an application and between applications that implement the framework.

In order to use a clipboard, you need to instantiate an object of ClipboardManager by calling the getSystemService() method.

“Service call clipboard” where service codes are 1, 2, and 3, for getClipboardText, setClipboardText, and hasClipboardText respectively.

Service call clipboard 2 s16 thisisinsertedtext

Consider a bank application and we are copying account number from an application

we can see all process and we can grep the process we want by using apk name

ps | grep ‘insecure’

we can get the account number which were copied by using following command

su (PID) u0_a80 service call clipboard 2 s16 (.apk name) com.android.insecurebank

We can see the input which was copied in an application. When it comes to a credit card, debit card, PIN , CVV and account number, It will be much critical.

Mitigation:

To avoid completely clipboard usage, KeePass proposes what it calls Auto-Type: it will directly fill targeted fields by simulating the appropriate key presses. The advantage is that no data ever passes through the clipboard.

When using the clipboard to copy/paste passwords, KeePass can be configured to automatically clear the clipboard after a short amount of time.

When copying a password, KeePass displays at the bottom of its main window a decreasing progress bar giving the user a visual feedback over the timeout progress, and once the timeout expires (15 or 30 seconds for instance) and if the clipboard still contains KeePass data then KeePass deletes the clipboard content (the user must not use one of those “clipboard history managers” for this to be really effective though).

Also Read :     Top 5 Best Android Hacking Apps 2017

Attacking through Android Keyboard Cache:

Android contains a user dictionary, where words entered by a user can be saved for future auto-correction. This user dictionary is available to any app without special permissions.

In the following example, we are adding username ti dictionary by selecting text

you can retrieve this information in user_dict database

you can find user_dict.db in /data/data/com.android.providers.userdictionary/databases 

by opening the database sqlite3 user_dict.db 

select * from words;  This SQL query provide you all information or words which added into ‘added to dictionary’

Mitigation:

Disable the auto-correct feature for any sensitive information, not just for password fields. Since the keyboard caches sensitive information, it may be recoverable.

For increased security, consider implementing a custom keyboard (and potentially PIN entry), which can disable caching and provide additional protection against malware.

Android Application Penetration Testing Other Parts :

POOJA GAONKAR

Recent Posts

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…

5 hours ago

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…

5 hours ago

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…

5 hours ago

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…

5 hours ago

New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine

A security researcher discovered a vulnerability in Windows theme files in the previous year, which…

5 hours ago

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…

6 hours ago