00:00:00.292-->00:00:06.792 >>Ok, hello and welcome to our talk. Thank you all for coming. Um, I’m Siegfried and this is my 00:00:06.792-->00:00:11.792 colleague, Stephan, and today we will talk about Android password manager apps. Um we are both 00:00:14.208-->00:00:21.042 from Germany, from an institute called Fraunhofer SIT. A short announcement: um as last year, 00:00:21.042-->00:00:26.042 we did it again. Um, so we imported a couple of beers from Germany, actually from Munich, 00:00:28.250-->00:00:33.000 and we brought it to Vegas and well, unfortunately we weren’t allowed to bring it on stage, 00:00:33.000-->00:00:38.458 but it’s safe somewhere in the in the crowd. So feel free to come after our talk outside the 00:00:38.458-->00:00:43.458 hall and grab a beer. So there are 20 cool Bavarian beers outside. [applause] Thank you. 00:00:50.708-->00:00:54.958 Good, so let’s start with the um introductions. Stephan, will you say, would you like to say a few 00:00:54.958-->00:01:00.167 words? >>Yeah, hello, my name is Stephan. I’m also employee of the Fraunhofer Institute and I’m 00:01:00.167-->00:01:06.292 working there as a security researcher with the focus on Android security. >>Thank you, 00:01:06.292-->00:01:12.292 Stephan. Um, I’m Siegfried. I’m head of the department of secure software engineering. Um my main 00:01:12.292-->00:01:17.042 research focusses on static and dynamic code analysis in order to find vulnerabilities or 00:01:17.042-->00:01:22.667 malicious activities in aps or in software in general. But this talk is not about us, um it is 00:01:22.667-->00:01:28.917 about our group, our hacking group, um called teamsik. We are a group um of students from the 00:01:28.917-->00:01:35.292 university and a couple of guys from our research institute and we meet up regularly once a week 00:01:35.292-->00:01:40.958 and um we sit together and we look into interesting um security problems or issues and 00:01:40.958-->00:01:45.250 this time we looked into password managers and um yeah, this is why we are here and we 00:01:45.250-->00:01:51.125 are presenting our results. So the credits also go to those brilliant students and not to 00:01:51.125-->00:01:56.125 us, so they helped us a lot. Good, so let’s start with the motivation. Um I guess all of 00:01:58.625-->00:02:02.167 you have seen such kind of screens want to create once you want to create an account for 00:02:02.167-->00:02:07.167 instance on google or something. Um the the thing you are at a point at the slide is that we 00:02:07.167-->00:02:12.583 have a policy, a password policy, which is very great. So a password has to have a certain 00:02:12.583-->00:02:18.167 length to be secure, it has to have, has to contain a certain characters, upper and lower 00:02:18.167-->00:02:22.917 letters and special characters and so on and so forth, which is very great even if you um 00:02:22.917-->00:02:28.875 services tell you hey, this is a well-used password, choose another one. This is very cool 00:02:28.875-->00:02:33.542 um it is very great for security reasons, um but so the wish is basically that it remembers such 00:02:33.542-->00:02:39.625 kind of passwords, even longer ones. I mean, personally I’m not able to remember such kind of 00:02:39.625-->00:02:44.083 passwords, even when you think about that an average user has 30 to whatever, 50 different 00:02:44.083-->00:02:51.417 services and it, so it’s very hard. So password managers came up with, or or no, password 00:02:51.417-->00:02:57.167 generator tools came up with the cool idea to link, basically the generated password to a 00:02:57.167-->00:03:03.167 sentence. So in this case for instance the password is, the generated password is X3-R and 00:03:03.167-->00:03:10.875 so on and obviously the sentence you have to, you can connect to this password is XBOX3-ROPE 00:03:10.875-->00:03:16.625 skype TOKYO and so on. Well, it’s a nice try, um but even though I’m not able to to 00:03:16.625-->00:03:22.708 connect this sentence to the password, so still this this is a very big problem. So the point 00:03:22.708-->00:03:28.917 here is we should come up with some complex passwords but it is very hard to remember them or to 00:03:28.917-->00:03:33.875 so. So what does the reality look like? At least what we figured out in my personal 00:03:33.875-->00:03:38.750 environment I have a lot of friends that make use of old-school notebooks. So they 00:03:38.750-->00:03:45.708 store or they write down the passwords on page whatever 120 between a very secret text or 00:03:45.708-->00:03:55.333 something this which only they know. Um it’s interesting, and but what we all know that it 00:03:55.333-->00:03:59.458 doesn’t work and it doesn’t really protect your passwords. Um on the other side password 00:03:59.458-->00:04:03.458 recycling um from our current project, not this one, a new one, one we are currently 00:04:03.458-->00:04:08.042 working on, we see that one that is also known, is that a lot of users make use of the same 00:04:08.042-->00:04:13.417 password for all the different accounts. Um this is also not a good idea, and then well, 00:04:13.417-->00:04:18.417 there’s also like single sign-ons. This kind of things where you have one account and 00:04:18.417-->00:04:23.208 when you login you can also login to another account. Um well there are also security 00:04:23.208-->00:04:27.833 issues with that and if you lose the first, basically password, it’s a problem. And this 00:04:27.833-->00:04:33.667 basically brings me to our topic today, to password managers. So for a password manager you have 00:04:33.667-->00:04:39.792 a very long list of passwords which protect or which protects the um accounts, your 00:04:39.792-->00:04:44.208 credentials for Google or whatever, all your different accounts. You only have to 00:04:44.208-->00:04:52.792 remember the long one and then it decrypts all your other credentials. Well, and we ask 00:04:52.792-->00:04:54.917 ourselves the question, um at least in the mobile world and did these guys implement in a 00:04:54.917-->00:04:59.250 secure cure way or were there some security issues? Doing though what we did as a first 00:04:59.250-->00:05:05.625 step we went on Google Play and we downloaded a couple of um password managers um listed by 00:05:05.625-->00:05:12.583 the top download rates there. Um first question which probably comes into your mind: why is it 00:05:12.583-->00:05:17.583 only nine and why only those and why isn’t there xyz? Um a very easy answer. So our group 00:05:17.583-->00:05:23.458 usually sits together and then we split it up into sub-groups and each sub-group takes 1 or 2 00:05:23.458-->00:05:31.583 apps and looks into it. So every group had an app and looked into it and in all of the groups and 00:05:31.583-->00:05:35.792 every group found vulnerabilities, so in the end wa it was not fun anymore and 00:05:35.792-->00:05:39.583 after a while we stopped it and we summed everything up. So this is the reason we didn’t look 00:05:39.583-->00:05:47.208 into other password managers as well. So, spoiler: um we found 26 vulnerabilities in total, as 00:05:47.208-->00:05:51.583 already mentioned, at least one in all of them, um in each of them. And while a couple of them 00:05:51.583-->00:05:56.875 were already presented at a different conference “Hack in a box” this year, er but for Def 00:05:56.875-->00:06:03.333 Con we will show the remaining ones and we will also explain um our findings from a different 00:06:03.333-->00:06:10.667 angle, we will explain, give you more details. Ok, so what will be the topics today? Um apart 00:06:10.667-->00:06:16.875 from the goal of extracting the master password or distort credentials is always a fun game 00:06:16.875-->00:06:21.750 in our group to check out the premium features if we can get the premium features for free. 00:06:21.750-->00:06:27.167 So we’ll talk about this in a second and then we will talk about reinserting the password 00:06:27.167-->00:06:33.208 as is. So can someone reset the master password in order to then have access to the stored 00:06:33.208-->00:06:39.750 credentials, and then in the second part we will talk about breaking C.I.A without ROOT, 00:06:39.750-->00:06:45.917 meaning having access or extracting the master password without ROOT or extracting the 00:06:45.917-->00:06:51.708 um the stored credentials without ROOT. For confidentiality reasons 00:06:51.708-->00:06:58.667 integrity like um, modifying them and the availability er um like, blocking it that the user 00:06:58.667-->00:07:03.958 cannot um log in to this again. Um everything is important without ROOT so because if it 00:07:03.958-->00:07:09.458 would be rooted to the device it would be kind of much easier to access this kind of thing. So 00:07:09.458-->00:07:14.792 we, basically our goal was to do it without ROOT. Er we tackled it from 3 different angles. Um 00:07:14.792-->00:07:21.250 the first one: lost device scenario: a tackle on basically if I find a smart phone and I 00:07:21.250-->00:07:26.125 can enter it and I can then click on the password manager, for instance, is it possible for 00:07:26.125-->00:07:31.375 us to have, get access to the credentials without even entering the master password? Er 00:07:31.375-->00:07:36.792 second scenario: man-in-the-middle attack: so if I’m sitting in the same network 00:07:36.792-->00:07:40.542 and they are synchronizing their um credentials, for instance, is it possible to to extract it? 00:07:40.542-->00:07:46.708 And via third party app: this means that if I install my application on the device, is it 00:07:46.708-->00:07:52.167 possible that this third party application kind of be malicious, um can have access to 00:07:52.167-->00:07:58.958 the master password or the stored credentials. Ok, so let’s get started: premium upgrade for 00:07:58.958-->00:08:05.792 free! Good, so we looked into different apps and a couple of them had the premium features. 00:08:05.792-->00:08:12.667 So you have to pay in order to get super cool new features and in this particular case you had 00:08:12.667-->00:08:17.875 to pay $3 in order to get like um export import cvs files, theme selection where you could 00:08:17.875-->00:08:26.167 choose between black and white, very cool. Well, even $3 is not a lot we wanted to try if we can 00:08:26.167-->00:08:32.750 still er still have access to these super features without paying. Um on the right-hand 00:08:32.750-->00:08:38.333 side you see that um, well, once you interact with the app there is a screen like a settings in a 00:08:38.333-->00:08:43.750 database, which already promotes that there are more features but you have to pay for them, so 00:08:43.750-->00:08:48.125 they are greyed out, in this case, AUTO BACKUP, for instance if you would like to do a Google 00:08:48.125-->00:08:53.500 Drive backup, you cannot do it without paying. So if you pay the $3, so then you you can 00:08:53.500-->00:08:59.250 enjoy with it. And this this slide is important, be we will later see why. Before coming to 00:08:59.250-->00:09:04.208 this very very brief overview about Android IPC communication especially intent communication, 00:09:04.208-->00:09:10.875 for those of you who are not so familiar with Android. Um, well if one application App 1 wants 00:09:10.875-->00:09:17.000 to talk to App 2, for instance, in Android it is usually in the most of the cases it is not done 00:09:17.000-->00:09:22.000 directly. So it’s done by a so-called intent. So an intent is sent basically to the 00:09:22.000-->00:09:26.583 operating system to Android and then Android decides which application should receive this 00:09:26.583-->00:09:32.417 message or the data which should be shared. Um how is how does it work? Well, application 2 has 00:09:32.417-->00:09:38.583 so-called filters, so application 2 can define a filter so the operating system 00:09:38.583-->00:09:45.042 knows hey this application is allowed to or this application wants to know later if some or a 00:09:45.042-->00:09:49.250 specific intent is sent. Um of course application 2 can also use some security mechanism to 00:09:49.250-->00:09:58.208 pro to prohibit that it receives intent er which shouldn’t be um received by this application. Um 00:09:58.208-->00:10:04.042 and the same works um of course if in one application there are usually more components in 00:10:04.042-->00:10:07.917 Android, while for instance activities. If one UI wants to share data with another UI the 00:10:07.917-->00:10:13.208 same principle works, so it’s sent first to the Android operating system and then it’s 00:10:13.208-->00:10:18.667 sent back the intent to the second UI, for instance. Good. The same works if you apply er 00:10:18.667-->00:10:26.125 if you plug in a smart phone um to to your er er sorry a PC through your smartphone you can 00:10:26.125-->00:10:31.542 also send so-called intents um to the Android operating system and then it sends the intent to 00:10:31.542-->00:10:36.625 the application 2 for instance. A very brief overview we were done um, but I guess this is 00:10:36.625-->00:10:40.292 enough information. Um well I can give more info, but it is not necessary for this talk or 00:10:40.292-->00:10:47.292 for the following slides. Good, so let’s coming back to our backup feature. Um so we were 00:10:47.292-->00:10:52.333 curious, how did they implement um the backup handling? Or sorry sorry the the pro the upgrade 00:10:52.333-->00:10:57.417 the pro feature? And well I simplified the code here because it was a little bit more 00:10:57.417-->00:11:01.208 sophisticated, but um the important points are here. What they did is they stored if a 00:11:01.208-->00:11:07.708 PAID or not into a field, so basically into RAM and once they receive an intent um with the 00:11:07.708-->00:11:17.208 key like PAID-STATUS and the values in digit 2, they set the PAID value to true. And once 00:11:17.208-->00:11:23.958 they render basically the UI then they enable this backup, Google backup, for instance. So 00:11:23.958-->00:11:28.750 what does this mean? This means well if I connect a PC or any application to it which sends 00:11:28.750-->00:11:33.125 intent for instance with the adb shell command to the Android operating system, well I can 00:11:33.125-->00:11:42.958 enable the features without any pain. Ya, this is so simple. Um the only problem here is that it 00:11:42.958-->00:11:46.417 is not persistent because it’s stored in RAM, so if I close the application and I open it again 00:11:46.417-->00:11:51.917 it is disable again. But what you can do is once you sent the intent and you see the features 00:11:51.917-->00:11:56.042 like Google drive backup, you can then click on YES I would like to use Google drive backup 00:11:56.042-->00:12:02.000 and this setting is stored persistently, so this means I once send er an intent and then 00:12:02.000-->00:12:06.708 Google drive back-up, I click on it and I close the application and I open it again it is greyed 00:12:06.708-->00:12:14.083 out, but it’s enabled the setup. So you basically own it and you can do with whatever you want. 00:12:14.083-->00:12:24.542 [applause] Ok, so let’s talk about resetting a master password. Good, um so this is a 00:12:24.542-->00:12:30.167 a common way or common process that we found in the apps. It’s not in channel what we found 00:12:30.167-->00:12:37.417 those apps we looked into how they handled forgetting or resetting the master password. 00:12:37.417-->00:12:42.458 So once the user forgets the master password he clicks on Forgot Password and then he gets 00:12:42.458-->00:12:50.417 a screen showing please enter usually 4 digits and these 4 digits are sent um to your email 00:12:50.417-->00:12:55.167 a client email account, which is connected to the password manager. So you open the email 00:12:55.167-->00:13:00.167 client, you extract a 4 digits and you paste it into your app and then the verification is 00:13:00.167-->00:13:05.250 done. If this is correct then we come to the second stage, the security question. Well this is 00:13:05.250-->00:13:09.125 predefined by the user. Well, whatever, the name of your mother or something, you type 00:13:09.125-->00:13:12.542 this and well if it is correct then you can reset the master password and once you reset the 00:13:12.542-->00:13:19.167 master password, you have access to all the stored um er credentials, basically, well 00:13:19.167-->00:13:23.125 this is obvious. Good, so we will focus on the following um on this particular part on the 00:13:23.125-->00:13:28.333 security question. And the whole thing is from a lost device scenario, so this means we find 00:13:28.333-->00:13:33.667 a smart phone, we have access to it and, yeah, we will s, basically, this is the scenario. 00:13:33.667-->00:13:38.333 So we started again looking into the Android manifest, which is the configuration via an 00:13:38.333-->00:13:43.208 Android, which contains all these intent filters as well and we found an interesting intent 00:13:43.208-->00:13:48.417 filter that there is which can be received which, so this activity which is triggered then 00:13:48.417-->00:13:52.792 can receive external intents, and once you send an intent you get a basic er an activity 00:13:52.792-->00:13:58.417 called DeepLinkActivity. It doesn’t sound so fancy, we will see. So start while you can do 00:13:58.417-->00:14:04.583 this. Start with like for instance with a PC again or you can do this as well with an with 00:14:04.583-->00:14:09.500 an application. So once they send this command to the device or the application’s install I 00:14:09.500-->00:14:15.083 will get a screen like this. Well, it doesn’t sound er doesn’t look very cool, so in 00:14:15.083-->00:14:19.417 this middle part there is supposed to the app list all the stored credentials. They use an 00:14:19.417-->00:14:25.750 app for things like Google, Facebook, and so on and so forth. So luckily or fortunate 00:14:25.750-->00:14:31.250 they didn’t list the username and password immediately when we sent this intent, because this 00:14:31.250-->00:14:34.917 would mean that you basically circumvent the authorization with the master password and you 00:14:34.917-->00:14:39.792 will immediately see the credentials. So at least they didn’t do that wrong, which is 00:14:39.792-->00:14:45.625 very good. Um but then we saw an interesting um settings um at the bot at the top of the er 00:14:45.625-->00:14:50.542 activity and once you click on the setting you will see that there are different settings. 00:14:50.542-->00:14:55.708 And er one of them is the Reset Security Question. Well, this is all done without any entering 00:14:55.708-->00:15:01.208 password and then, well yeah it can choose a new security question, whatever the name of 00:15:01.208-->00:15:06.500 my mother or something like this and enter it and it basically connects you to the you email 00:15:06.500-->00:15:11.500 acclount, email account which, well, which is connected to the er password manager application 00:15:11.500-->00:15:16.917 and the old security question is basically overwritten. So what this means, this means we we own 00:15:16.917-->00:15:23.292 this part in in the process. However the verification code via email, um this is the 00:15:23.292-->00:15:28.208 problem, but well we’re saying if you find a device and you have an email account, an email 00:15:28.208-->00:15:33.875 client, for instance, gmail, you also can open the gmail account to have access to the 00:15:33.875-->00:15:41.458 verification code, then paste this into your application, then do the um um security question 00:15:41.458-->00:15:46.792 process and then you can reset the master password when you have access to all the stored 00:15:46.792-->00:15:53.625 data. So this is er the the only drawback here that you er well have to have access to the to 00:15:53.625-->00:15:59.458 the email client as well. Good, so this was it from my part. I will now hand over to Stephan 00:15:59.458-->00:16:07.833 who will continue with the rest of our findings. >> Ok, thank you Siegfried. Um I will talk 00:16:07.833-->00:16:12.250 now about getting access to the Holy Grail, so their their Master Secret, what is the 00:16:12.250-->00:16:17.208 master secret in the password manager? It can be the the main password which is used when 00:16:17.208-->00:16:24.125 entered at the beginning, which is used to encrypt your credentials. It can be just a 4 00:16:24.125-->00:16:31.125 digit pin which protects your stored credential or it can also be the the master key, which is 00:16:31.125-->00:16:39.125 used for encrypting all your data. If you can get access to this master secret, you have the 00:16:39.125-->00:16:50.000 jackpot. And accessing or extracting this Master Secret can be separated of course in 00:16:50.000-->00:16:53.667 two phases of stages. In the beginning we have some kind of extraction process. This can be 00:16:53.667-->00:17:00.708 done in severals ways by backup, man in the middle attacks. Um we will explain it in the next 00:17:00.708-->00:17:06.167 slides in more detail and the second phase then would be. In some cases the the master 00:17:06.167-->00:17:12.000 password or the keys are additionally protected, so we have also um to to break this 00:17:12.000-->00:17:18.958 protection. We will um explain this protection then in the second stage. So, okay, let’s 00:17:18.958-->00:17:24.542 begin with the man-in-the-middle attack. There was one password manager which has a user 00:17:24.542-->00:17:28.958 authentication and synchronization at the back-end. The synchronization was 00:17:28.958-->00:17:36.042 implemented by a HTTP request, but I think everybody is aware HTTP is not secure against 00:17:36.042-->00:17:42.000 man-in-the-middle, so the developer decided okay, we have to protect our information, 00:17:42.000-->00:17:49.208 let’s implement some custom encryption or protect them by encryption protocol. And of 00:17:49.208-->00:17:56.250 course we can er attack this custom encryption protocol and yeah, it’s broken by this sign. 00:17:56.250-->00:18:01.042 How the um protocol looks in em let’s say in abstract detail we’ll show here in the next 00:18:01.042-->00:18:08.500 slide. In reality it’s much more complicated and a lot of maths, attaching and bit shifting, but 00:18:08.500-->00:18:14.375 it can be reduced very easy. So, we have in the beginning our POST-request, in the header we 00:18:14.375-->00:18:24.542 have some timestamps and the body is transferring our encrypted payload. The encrypted 00:18:24.542-->00:18:29.208 payload is encrypted with AES, so AES is secure, that’s no problem, but you know symmetric 00:18:29.208-->00:18:34.000 cipher in communication? So what about the key? There we have different options. Everybody 00:18:34.000-->00:18:39.625 already knows the key, we have some key exchange or we derive the key from a common secret. In 00:18:39.625-->00:18:45.583 this case you’ll remember in the header there’s a timestamp. The client uses this timestamp as a 00:18:45.583-->00:18:53.042 seed. From the seed he generates the random key and this random key is used as a AES. The server 00:18:53.042-->00:18:58.958 also has the timestamp, used it as a seed, so he deterministically can calculate 00:18:58.958-->00:19:06.417 the key. So I think you can imagine what an attacker can do and what the fail is, so for 00:19:06.417-->00:19:12.292 whom who doesn’t see the problem, here is again our man-in-the-middle settings and 00:19:12.292-->00:19:17.583 when the our man-in-the-middle attacker also can get the time from the header, he just can 00:19:17.583-->00:19:23.792 also generate the seed, the random key and eavesdrop the whole traffic. Why they have 00:19:23.792-->00:19:31.333 done this I don’t know, this is your seed broken by the time, so how to do it in the right way. 00:19:31.333-->00:19:37.167 If you want to do encryption or secure communication in Android, use simply SSL or TLS. You can 00:19:37.167-->00:19:42.208 do this in one line. This this broken implementation had a lot of classes, methods, whatever, 00:19:42.208-->00:19:48.333 just look at the developer instruction you see. Make an https request and everything is 00:19:48.333-->00:19:55.417 secure. If you want to improve or let’s say, have stronger TLS, like, pinning, also use the API. 00:19:55.417-->00:20:01.375 The new Android API supports it. If if you have, or implement for older versions, use some 00:20:01.375-->00:20:07.083 reliable libraries, also, but in the case of er libraries, cross-check it because older 00:20:07.083-->00:20:13.417 versions can contain bugs. So another attack how to get access to the master secret without 00:20:13.417-->00:20:20.750 Root would be using the browser file access. So at first a short introduction. So if you look at 00:20:20.750-->00:20:26.042 the password manager, they they s um they offer different kinds of convenience functions. One 00:20:26.042-->00:20:30.542 function should be to automatically complete your forms. If the user goes onto a 00:20:30.542-->00:20:35.542 website, say Twitter or Facebook, the password manager recognizes Oh, there’s some 00:20:35.542-->00:20:41.417 stored credentials, I will automatically fill it in and you just have to click to log in. 00:20:41.417-->00:20:46.667 But this is not working in reality because there there come a browser like Firefox or 00:20:46.667-->00:20:52.125 Dolphin that don’t provide an API for this. So what the password manager developers do: 00:20:52.125-->00:20:59.083 Yeah of course it’s very easy in Android to implement our own browser. So you can use the view 00:20:59.083-->00:21:03.750 app view it’s based on the WebKit or on the new Chrome engine to easily implement a 00:21:03.750-->00:21:09.958 browser. The advantages are that the password manager apps now have full control over its own 00:21:09.958-->00:21:16.792 browser and they can um realize their automatic injection function. So the disadvantages: 00:21:16.792-->00:21:20.292 the er browser is part of the password manager, so it’s part of the process, so it’s running 00:21:20.292-->00:21:28.250 in the same let’s say sandbox. And now, what can be happen if, you for instance enter a file 00:21:28.250-->00:21:38.167 URL. So an XML file where the password manager can store the the master password. So, you get 00:21:38.167-->00:21:45.333 it. [laughter and applause] In the in this case you see okay, there’s an additional 00:21:45.333-->00:21:51.250 protection. The stored master password is basically 4 encrypted encoded and it’s also 00:21:51.250-->00:21:58.708 additionally encrypted. In a few minutes I will also show how we break this, but at first another 00:21:58.708-->00:22:06.417 way to get the master secret. This is a so-called residue attack. For whom is not aware 00:22:06.417-->00:22:11.292 about this kind of attack, I’ll give at first a short introduction about the 00:22:11.292-->00:22:17.625 AccountManager. So the Android AccountManager is provided by the ope operating system. It’s 00:22:17.625-->00:22:25.417 some kind of central service where application can store um information like security tokens 00:22:25.417-->00:22:36.042 or temporarily access tokens. It’s based on a SQLITE database and um this SQLITE database is 00:22:36.042-->00:22:41.792 only accessible with system privileges. This means other applications cannot directly 00:22:41.792-->00:22:49.375 access this account manager database. If they want to access it they have to use the API, and 00:22:49.375-->00:22:56.583 the API should ensure that there’s no application accessing data of another application. So 00:22:56.583-->00:23:02.583 that there’s a strict data isolation. So also if you look at the developer, um Android has 00:23:02.583-->00:23:07.792 um fewer Google wrote a few interesting information. It says that you should not pass 00:23:07.792-->00:23:14.667 passwords or sensitive information in this account. Just use it for for temporary 00:23:14.667-->00:23:23.250 tokens or data that will get invalidated. So also interesting that er um second state, if you 00:23:23.250-->00:23:28.875 use the credentials for protecting something valuable, if you look in the context of 00:23:28.875-->00:23:34.042 password managers, your master password protecting all your credentials I think this should 00:23:34.042-->00:23:41.083 be valuable data. Um so next I will show you a short demo of how to protect this 00:23:41.083-->00:23:47.417 AccountManager without Root privileges and then I will explain the attack the attack in 00:23:47.417-->00:24:04.458 a few slides in more details. So we have prepared a a sorry. We have prepared a demo video. This 00:24:04.458-->00:24:11.125 is our device. On this device um I have installed one of our password manager that we will 00:24:11.125-->00:24:16.708 use against this attack. At first I start this password manager and here you see I enter 00:24:16.708-->00:24:26.000 the master password. This is a very complex password um and I will unlock it. And you will see 00:24:26.000-->00:24:31.250 that I have stored some credentials for my Twitter account. But because of the 00:24:31.250-->00:24:36.333 complex password I cannot keep it in mind, I use a convenient function and enable the pin 00:24:36.333-->00:24:44.417 locking. So I set a pin, a very secure pin. So, I just have to keep this pin in mind. Now 00:24:44.417-->00:24:51.250 there’s an information of last password saved for quick pin unlocking, so the password will 00:24:51.250-->00:25:00.583 be stored, but it’s stored in a protected way. So everything is ok, and I speed up the video a 00:25:00.583-->00:25:14.292 bit, so I quit the application, I restart it. And you see now I have my pin for unlocking it. So 00:25:14.292-->00:25:20.792 everything is fine. Now, on the other side on the left I will, I will there will be a small 00:25:20.792-->00:25:30.625 window in a few seconds. This is from a rooted device that just shows again the database entry 00:25:30.625-->00:25:43.292 from this AccountManager database. So you see now in this database is something stored, 00:25:43.292-->00:25:51.583 our email address, some some information, coded and encrypted information. And now the target 00:25:51.583-->00:25:59.083 will be to get access to this information via an app. Um and we will show you now how this 00:25:59.083-->00:26:13.208 tool work. So we install now our attacker app. And again, this device is completely unrooted. 00:26:13.208-->00:26:19.375 So for demo I put on the app a few buttons. If you want to use an attacker app you have to hide 00:26:19.375-->00:26:24.917 all this stuff. So at first you register an account. There you will see an exception. What this 00:26:24.917-->00:26:30.792 exception means is that you will explain in the slides. Then I will uninstall the target app, 00:26:30.792-->00:26:36.792 so I remove completely the application. So it’s go it will be uninstalled from the 00:26:36.792-->00:26:41.083 operating system and it’s gone. Now if I click on extract the password, I will get all the 00:26:41.083-->00:26:48.958 stored account information. And then the next step I will also when I click on decrypt you will 00:26:48.958-->00:27:04.042 see our master password again. So [applause] this is all working without Root and how is 00:27:04.042-->00:27:09.625 this attack working in detail? Ok here you see our smartphone again, you see the 00:27:09.625-->00:27:17.375 AccountManager, API and the um account database. So at first we install our target app and this 00:27:17.375-->00:27:21.667 target app defines for the AccountManager API so-called account type. Imagine this is a 00:27:21.667-->00:27:29.458 kind of database primary key. It’s a identifier for the um database row entry. We have our 00:27:29.458-->00:27:34.583 email address and in this case our secret password. So the application will be installed, 00:27:34.583-->00:27:38.833 the AccountManager API enters everything in the account database. There is also an 00:27:38.833-->00:27:45.625 association between the app and database and the UID so that the API can identify the 00:27:45.625-->00:27:53.500 corresponding application to the matching database entry. Now we install our attacker app. So the 00:27:53.500-->00:27:58.625 attacker app can also be defined as an account type. This is completely free, everybody can 00:27:58.625-->00:28:03.833 define it. We will install it and the AccountManager will now check OK there’s another app 00:28:03.833-->00:28:09.917 with this account type, but the UID is not matching, so we cannot enter or access this 00:28:09.917-->00:28:15.292 information. So we throw in an exception as a warning and so the attacker app will catch 00:28:15.292-->00:28:21.875 this. Now in the next step you saw we uninstalled our target app, so the application will be 00:28:21.875-->00:28:28.458 removed but the problem is now the operating system sees: Oh okay there is another 00:28:28.458-->00:28:34.208 application which is still reducing the account type. The operating system is not 00:28:34.208-->00:28:39.167 comparing anymore the new ID so it thinks okay, the account type is not matching to the data, so 00:28:39.167-->00:28:44.917 let’s keep the data. And after that the application can directly access this data 00:28:44.917-->00:28:49.667 without any problem. And the last thing you saw was the encryption. The encryption was 00:28:49.667-->00:28:54.958 very easy, um dash line has an application with a native library which has all the 00:28:54.958-->00:29:01.708 encryption and decryption process implemented statically. Let’s put this library into my 00:29:01.708-->00:29:07.000 application and we will be able to decrypt this. So, a hint: if you ever lost or forgot your 00:29:07.000-->00:29:13.167 master password, just take the library and you can decrypt it by yourself. [applause and 00:29:13.167-->00:29:23.875 laughter] So, this brings me to the last um um um step of our extraction process, let’s say um 00:29:23.875-->00:29:30.667 the decryption process they’re a bit of a crypto and crypto fails. So at first let’s begin 00:29:30.667-->00:29:36.958 with what is good crypto? There was a guy and he was called Kerckhoff. He were I think 00:29:36.958-->00:29:43.750 around 133 years ago he already defined how good crypto must be implemented. And he just says 00:29:43.750-->00:29:48.250 good crypto should not rely on the on the secrecy of the algorithm, it just should depend 00:29:48.250-->00:29:55.917 on your or on one secret. So here is a brief overview how correct crypto should work. We 00:29:55.917-->00:30:00.208 have the the master secret, and in most cases we have a password. This password should 00:30:00.208-->00:30:05.917 be cemented with some salt, depending the the salt lays the different standards, like the 00:30:05.917-->00:30:12.250 nest, who describes how long the salt should be. In this combination there should be done 00:30:12.250-->00:30:17.375 a key stretching or key derivation function. And the output of this function is this 00:30:17.375-->00:30:24.958 builds our encryption key. In combination with a reliable algorithm, like AES, we can do 00:30:24.958-->00:30:32.042 our encryption and decryption. So this is, let’s say, a scheme how correct or good crypto 00:30:32.042-->00:30:39.375 should be done. So what we find or found bad crypto. So again we have our master password. 00:30:39.375-->00:30:43.500 Everybody knows this of this password manager application, you have to enter it at the 00:30:43.500-->00:30:49.792 beginning. And the first step if the password is too short, they start to enlarge it by just 00:30:49.792-->00:30:56.542 adding zeros. There’s no key stretching, nothing. The second thing is um okay um keeping this 00:30:56.542-->00:31:00.333 password in mind is very complex, you saw it. So we have to store it. But um storing the 00:31:00.333-->00:31:07.833 master password in plain text is not a good idea. Despite of this we saw it also in all your 00:31:07.833-->00:31:11.833 applications and we don’t explain it in detail, because explaining a plain word password 00:31:11.833-->00:31:21.833 is done. So um to protect it they used static keys and if they want to encrypt now 00:31:21.833-->00:31:29.917 something they grab the store to let’s say master key and use AES to encrypt everything. So this 00:31:29.917-->00:31:35.750 means now that if our attacker get access to this stored password, it just somehow needs 00:31:35.750-->00:31:42.083 to get access to the static key. How do we get access to the static key? We found a few 00:31:42.083-->00:31:48.917 examples. The first one is just part of the app code. You just take it out of the app and you 00:31:48.917-->00:31:53.000 can decrypt the master password. And with this master password you can access your stored 00:31:53.000-->00:31:58.417 credentials. The second one was more complex, it was more sophisticated and split up in 00:31:58.417-->00:32:07.708 two parts. So they put it together dynamically [background laughter] um, yah, um another 00:32:07.708-->00:32:13.708 form we found that was very weird, this was a kind of obfuscation. So I don’t know 00:32:13.708-->00:32:19.583 where the developer thought about it, but he was um setting up a um random encryption key. 00:32:19.583-->00:32:24.042 The random encryption key had always the size of 9 and he implemented a own random 00:32:24.042-->00:32:30.292 function, so he had an array with 55 different characters and used the random function and 00:32:30.292-->00:32:37.042 grabbed 9 difference. So, let’s say the first fail, there’s no secure in them. So he uses this 00:32:37.042-->00:32:42.792 random key to protect his master password. So okay we have no static key, there is nothing in 00:32:42.792-->00:32:48.708 the code, but there is now the problem um yeah, that we have to somehow store this um key. So he 00:32:48.708-->00:32:55.167 implemented an obfuscation. And this obfuscated key is then stored on the device, so if our 00:32:55.167-->00:33:01.708 attacker gets now access to the encrypted key and to the obfuscated key and can the 00:33:01.708-->00:33:08.750 obfuscated um, he gets again the master password. So now to look a bit into detail of this um 00:33:08.750-->00:33:14.708 obfuscation. So as I’ve said, in the beginning we had our obfuscation key, we had always 00:33:14.708-->00:33:20.125 the fixed sides of the lengths, at 12. And of course, for deobfuscation, there’s some 00:33:20.125-->00:33:25.750 black box, algorithm. To be honest, we were too lazy to reverse and degenerate 00:33:25.750-->00:33:29.583 completely, because then we’d had to do a lot of shape-shifting and swapping and 00:33:29.583-->00:33:35.042 so on, so we just tried to break it dynamically by trial and error. If you could break this 00:33:35.042-->00:33:41.042 we would get the random key. And of course then with AES we could decrypt the master password. So 00:33:41.042-->00:33:48.417 we played a bit around with just a keys. And if you take a look at the table, um we modified 00:33:48.417-->00:33:55.917 several parts of this um random key and you see if you modify, for instance, the first and the 00:33:55.917-->00:34:01.000 second part of the key, the first to three parts of the obfuscated key is modified. If 00:34:01.000-->00:34:08.167 you change the third um part the fourth obfuscated part is changed, and so on. We also saw 00:34:08.167-->00:34:13.917 that these parts are independent, so if we, let’s say, change in the first part of 00:34:13.917-->00:34:19.167 something, there are no changes at the end. And so this this brings us to to the easy parts, 00:34:19.167-->00:34:26.125 cause if we have something of the lengths, three to break, it we very easily can can 00:34:26.125-->00:34:31.833 bruteforce this. So we just simply check the Reverse Lookup table by bruteforcing all random 00:34:31.833-->00:34:38.083 parts and obfuscated part combinations. And with the bruteforce with the Reverse 00:34:38.083-->00:34:45.292 Lookup table as you can see here we can simply calculate the random key and with this random 00:34:45.292-->00:34:53.375 key we again can um decrypt the master password. So what I want to show with this slide, I don’t 00:34:53.375-->00:34:58.500 want to blame this algorithm in detail because there are also a lot of other algorithms. What I 00:34:58.500-->00:35:04.958 want to say is just that if you do encryption, you do it rightly obfuscation is just security by 00:35:04.958-->00:35:11.167 obs obscurity. There is always someone who will break it, so don’t use such nonsense if you 00:35:11.167-->00:35:17.708 implement security applications. Now also some recommendations of how to do it right. So Android 00:35:17.708-->00:35:24.375 provides a secure store for credentials. Use the KeyStore and um of course, I know 00:35:24.375-->00:35:29.708 sometimes developers say that Android 2 or Android 3 does not support the KeyStore, but 00:35:29.708-->00:35:36.375 Android 2 or Android 3 is not secure by design, so don’t target this user, don’t support 00:35:36.375-->00:35:42.792 them. Use Key derivation function, there’s PBKDF2 (API), it’s a bit slow but there’s 00:35:42.792-->00:35:50.667 already a cool Open Source um a library from Facebook called Conceal, it has a bit fast or a 00:35:50.667-->00:35:58.500 more faster and secure key derivation function. Don’t use any static keys, um hard coded, 00:35:58.500-->00:36:04.042 splitted up, hidden in some images or something. It is just security upon security. If you 00:36:04.042-->00:36:09.125 use AES depending, use the secure um cipher modes. Also some point where I didn’t talk 00:36:09.125-->00:36:19.333 in detail about but were told the Android user developer aware are aware of it. Password 00:36:19.333-->00:36:24.042 managers don’t need a backup flag because they have the backend synchronization, their 00:36:24.042-->00:36:29.292 data are implicitly backed up. So this backup flag just opens a new attack target to get access 00:36:29.292-->00:36:36.750 to your confidential data. If you have a master password or you provide a master password 00:36:36.750-->00:36:45.000 for it’s storage function, don’t store it in plaintext. So we saw this also the same. Don’t store 00:36:45.000-->00:36:50.458 it in the local app folder. There’s always a way to get access to it. Use the KeyStore. 00:36:50.458-->00:36:58.625 Here is now a short overview of um all our um findings. At the top you saw, um you see again 00:36:58.625-->00:37:05.375 all the password managers. On the left row you saw the different kinds of 00:37:05.375-->00:37:10.042 vulnerabilities we found. The first row we showed is somehow to to get access to the master 00:37:10.042-->00:37:17.167 password or to the pin, hardcoded keys. The sandbox bypassing was just a browser 00:37:17.167-->00:37:23.625 attack. We did not talk um about on this talk about the side channel attacks. We presented 00:37:23.625-->00:37:29.875 that hack in a box, but the idea was a lot of password manager abuse, the channel for 00:37:29.875-->00:37:38.500 transferring credentials to other applications. We had also seen this sub domain problems, 00:37:38.500-->00:37:47.375 this was also very funny. Um the idea was um that if you store your credentials to um on four 00:37:47.375-->00:37:52.917 different sub domains, the browser did not distinguish between them. So this means that 00:37:52.917-->00:38:00.750 if you had a um domain like my secrets.example.com and you store your credentials em er and 00:38:00.750-->00:38:06.792 your password manager didn’t distinguish between security and for instance attacker for 00:38:06.792-->00:38:13.958 example.com. Um data leakage was a problem of the implemented browser, partial encryption. We 00:38:13.958-->00:38:20.250 also saw one password manager who did not completely encrypt all your stored information and 00:38:20.250-->00:38:27.125 the broken synchronization we showed also in the appli in the beginning of the talk. So let me 00:38:27.125-->00:38:34.667 give you a short summary. Siegfried also introduced um desk we will need, we need 00:38:34.667-->00:38:45.250 password managers because of the complexity of all the passwords. And um if they, you have to 00:38:45.250-->00:38:51.500 store them somehow. And um we also gave um different types how we attack them all without ROOT. 00:38:51.500-->00:38:57.625 If you get ROOT access it must be a this would be a much more worse scenario. And we also gave 00:38:57.625-->00:39:06.917 a few recommendation how to do it right and a summary of all our findings. The last thin I 00:39:06.917-->00:39:11.833 want to mention is all the findings we had you will find also on our website. We will 00:39:11.833-->00:39:17.125 also announce the in a responsible disclosure process to the vendors. All our findings 00:39:17.125-->00:39:23.167 are fixed but there are no guarantees that there are not any other additional 00:39:23.167-->00:39:30.750 vulnerabilities. So this is for all Android security, er reverse engineers, hackers and so on. 00:39:30.750-->00:39:36.208 Keep your eyes open if you find anything. >> What I want to mention is that this is not a 00:39:36.208-->00:39:43.833 complete presentation what we did. For sure there is more. >> Yah but um look into it a 00:39:43.833-->00:39:49.583 announce it to the vendors, because a lot of people store their sensitive information 00:39:49.583-->00:39:59.125 there, so let’s say, protect them. Um so this would be the the end of the presentation. 00:39:59.125-->00:40:04.292 Siegfried already mentioned that we brought some beer. We can er, if you have some questions come 00:40:04.292-->00:40:10.375 to us, we can drinks and talk about it in the hall. If you are just thirsty you can also grab a 00:40:10.375-->00:40:15.958 beer. Or if you are too shy to talk to us um, you can also write us an email. Um so thank 00:40:15.958-->00:00:00.000 you for your um attention. This is the end. [applause]