Slides for the CSPC 2018 march chapter https://udnisap.js.org/talks.html

1. Smartphone app security
Pasindu Perera

2. How to hack phones?

3. apps
How to hack phones?

4. Applications are compiled

5. Android Application
Java Source
code
Smali
Java Byte
code
(dalvik)

7. Motivation
● Translate apps
● Security Research (Malware)
● Unlock Perks / Unlock
features
● Piracy
● Steal Intellectual Property
● Backdoors

8. Tools
1. Apk Tool
2. Jarsigner -- comes standard with Java
3. Metasploit
4. Simplify

9. Exploit 1
Level hack / Feature hack

10. ● Open source
● Lots of known exploits
● Keep Access
● Use as a hub
● Use features in the victim

11. Exploit 2
Inject a backdoor into an
application

12. Tool
● Decompile both the exploit and the original apks
● Random renaming of exploit file names
● Inject the meterpreter into the original apk
● Pack the original
● Sign

13. Meterpreter
features
Anything an app can do
● Record Audio
● Record Video
● Take screenshots
● Steal passwords
● Impersonate SMS
● Read call / sms logs

14. How to be aware
● Only use app store to download apps
● Use only the apps that are well known
● Look at their permissions before installing
● Use sandboxing techniques to try out applications

15. Q&A