Android Application Penetration Testing – Part 9

In Last Part, Android Application Penetration Testing Part 8 We have seen about the Attacking through Content Provider when an app wants to share data with another app.

Attacking through Android Pasteboard:

Android provides the clipboard framework for copying and pasting different types of data. The data could be text, images, binary stream data or other complex data types.

Simple text data is stored directly in the clipboard, while complex data is stored as a reference that the pasting application resolves with a content provider.

Copying and pasting work both within an application and between applications that implement the framework.

In order to use a clipboard, you need to instantiate an object of ClipboardManager by calling the getSystemService() method.

“Service call clipboard” where service codes are 1, 2, and 3, for getClipboardText, setClipboardText, and hasClipboardText respectively.

Service call clipboard 2 s16 thisisinsertedtext

Consider a bank application and we are copying account number from an application

we can see all process and we can grep the process we want by using apk name

ps | grep ‘insecure’

we can get the account number which were copied by using following command

su (PID) u0_a80 service call clipboard 2 s16 (.apk name) com.android.insecurebank

We can see the input which was copied in an application. When it comes to a credit card, debit card, PIN , CVV and account number, It will be much critical.

Mitigation:

To avoid completely clipboard usage, KeePass proposes what it calls Auto-Type: it will directly fill targeted fields by simulating the appropriate key presses. The advantage is that no data ever passes through the clipboard.

When using the clipboard to copy/paste passwords, KeePass can be configured to automatically clear the clipboard after a short amount of time.

When copying a password, KeePass displays at the bottom of its main window a decreasing progress bar giving the user a visual feedback over the timeout progress, and once the timeout expires (15 or 30 seconds for instance) and if the clipboard still contains KeePass data then KeePass deletes the clipboard content (the user must not use one of those “clipboard history managers” for this to be really effective though).

Also Read : Top 5 Best Android Hacking Apps 2017

Attacking through Android Keyboard Cache:

Android contains a user dictionary, where words entered by a user can be saved for future auto-correction. This user dictionary is available to any app without special permissions.

In the following example, we are adding username ti dictionary by selecting text

you can retrieve this information in user_dict database

you can find user_dict.db in /data/data/com.android.providers.userdictionary/databases

by opening the database sqlite3 user_dict.db

select * from words; This SQL query provide you all information or words which added into ‘added to dictionary’

Mitigation:

Disable the auto-correct feature for any sensitive information, not just for password fields. Since the keyboard caches sensitive information, it may be recoverable.

For increased security, consider implementing a custom keyboard (and potentially PIN entry), which can disable caching and provide additional protection against malware.