Android Application Assessment – Part I

Recently, I was engaged in testing an android application. The customer generously provided me his new Samsung 750 Tablet with the application installed on it. The application does not interact with any remote server which meant all application data, database schema and files had to be stored locally. From the tutorials and my learning I was expected to find an android installation file (.apk file), install it on a google android emulator and start testing. Unfortunately, the first step itself didn’t meet my expectations.

I shall be releasing the series of android application testing; so this post is focused on setting up an environment, common challenges and confirming all is well before we proceed

Challenge 1:

Extract android application installable file (.apk file) from tablet. The application is running in tablet but not sure whether installation files are removed or hidden by the developer.

Solution:

After searching and testing few apps/tricks found by Google results, I finally decided to go with Astro File Manager application. The application is less complicated and fulfils my expectation. Below are the steps to get the .apk file:

1. Download and install Astro File Manager on your android tablet or phone
2. Locate and open Astro File Manager
3. Browse to Application Backup menu
4. Locate your application from Installed Apps list and select the app (extreme right)
5. Hit “Backup” button
6. Check and confirm your application backup in Backup Apps list

Now, we have the backup of our application. Next steps:

1. Exit Astro File Manager application
2. Browse to Home Screen and go to My Files folder
3. Look for backups folder and you will find your .apk file there

Once you have your application .apk file, there are multiple ways to get it onto your PC. I installed a Dropbox application on tablet and then downloaded it onto my PC. Other alternatives are as below:

• Attach file to your inbox (< 5MB)
• Install Samsung windows driver from here and transfer it via USB.

Next step is to install the application on Android emulator. You can download it from here and installation steps are listed here. Once setup is done, you will have similar running emulator as below:

Installing Assessment Application on Emulator 

Post successful SDK toolkit installation; add below strings to your PATH environmental variables (Right click My Computer-->Properties-->Advanced-->Environment Variables):

C:\Program Files\Android\android-sdk\tools;C:\Program Files\Android\android-sdk\platform-tools
 

We are now ready to install application on android emulator from any location (of course a valid one). The utility to interact with emulator is adb.exe and it can be found under C:\Program Files\Android\android-sdk\platform-tools. Steps are as below:

Open AVD Manager from All Programs and click on Start to run Emulator
Open command prompt and browse till path where you have saved your application apk file
Issue command: adb devices to ensure your emulator is working properly
To install app: adb install app_name.apk
Here's a screenshot of above steps:

Happy Reading!!!

Pentesting Thick Client Apps

Pentesting thick client applications is not a new concept instead the techniques adopted are new and interesting. I’m a bit lazy on explaining what thick client apps are, please refer here for more info. GTalk, Pidgin, Skype, MSN are few examples of thick client applications. These days many financial institutions are adapting the technology for internal transaction purposes.

The Challenges:

• Typical thick client apps do not communicate over HTTP/HTTPS (some of them do); so you cannot intercept traffic with regular web proxy tools
• Unknown modification to registry/system files
• Unknown technical details of architecture
• Manipulating client-server communication over the wire
• Encryption techniques adopted by client software
• Will used by only trusted users

 Above list just mentions a few challenges that we regularly face while pentesting thick clients.

Way To Go:

Understanding Architecture

  

Thick client applications are generally 2-tier applications, meaning, the request is constructed at user’s end (client) and sent to the server for processing. There is no web server or middle ware technology sitting in middle; it directly communicates to the database. This can be identified by observing the time lapse between request and response or analyzing the communication traffic on wireshark.

Architecture can also be hybrid i.e. listening on both HTTP/S and any unknown port. In this case we may have to use the combination of tools to intercept and modify the communication. 

Intercepting/Manipulating Client-Server Communication

The two most popular open source tools are EchoMirage and ITR. The tool I prefer the most is Echomirage; because of its simplicity. It directly hooks with your client executable and starts intercepting traffic on the go. There is also an option to hook your client exe with its associated process. Here’s how you can do the above steps:

After you do this successfully, all our traditional application security checks are applicable. If you are lucky, you may see SQL queries passing through our Echomirage Interceptor.

Local Storage of Sensitive Information

Sensitive information can be clear-text passwords, server configuration, user personal detail, user financial detail, etc. Look for .ini, ,cfg, dat, .log files in application folder for application related sensitive information. Generally, you will find server configuration in .ini files.

File and Registry Modification Analysis/Reverse Engineering

Another two most popular tools are Filemon and Regmon from sysinternals. These both tools are now packaged into one as Process Monitor. These tools identify files accessed or registry modified when you double click your client executables. Here, you need to look for interesting files and investigate further; filename can hint which file you should investigate. It will help in application reverse engineering.

Regmon list all registry entries which are accessed when you double click your client executables. Use the registry search feature to find keywords, passwords, and sensitive information.

Happy Reading!!!