1
00:00:00,000 --> 00:00:03,580
So thank you for coming to my talk on mobile devices.

2
00:00:03,800 --> 00:00:05,400
Hopefully it will be very interesting for you.

3
00:00:06,200 --> 00:00:08,080
My name is Michael Sosonkin.

4
00:00:08,220 --> 00:00:11,180
I am the Director of Research and Data at SYNAC.

5
00:00:11,300 --> 00:00:14,340
And SYNAC is a crowdsourced vulnerability discovery program.

6
00:00:14,480 --> 00:00:20,480
So we generally have a team of people that discovers vulnerability for our customers.

7
00:00:20,720 --> 00:00:25,400
And so if you're interested in that, we can basically pay you for bounties for that.

8
00:00:25,400 --> 00:00:34,600
Occasionally we have customers that also want us to find out if there's a way to find sensitive information in their websites.

9
00:00:34,880 --> 00:00:37,860
So that would be more relevant for the recon crowd.

10
00:00:40,060 --> 00:00:50,760
So once a very sort of respectful person that I have lots of respect for has said that recon starts much earlier for many people.

11
00:00:50,840 --> 00:00:54,080
Even though for most defenders this is where they consider a beginning point.

12
00:00:54,260 --> 00:00:55,380
And so I'd like to...

13
00:00:55,400 --> 00:01:04,060
I'd like to share some of my tools and techniques that I've developed for building work ahead of the recon process in order to assist for the next step.

14
00:01:06,500 --> 00:01:09,500
Fundamentally, why is it that we are actually trying to do this?

15
00:01:09,780 --> 00:01:13,380
I mean, mobile applications are incredibly important in our lives.

16
00:01:13,500 --> 00:01:16,040
They provide things like privacy and freedoms.

17
00:01:16,400 --> 00:01:19,960
And of course they give us access to our money.

18
00:01:20,180 --> 00:01:24,060
And so even though 20 years ago this was really unimaginable,

19
00:01:24,160 --> 00:01:24,620
today...

20
00:01:24,620 --> 00:01:31,480
I would not even imagine losing any of those things or having them compromised is kind of scary to me.

21
00:01:32,380 --> 00:01:41,740
And so I'd like to sort of go through some of the ways of how we can work to protect those fundamental things that mobile devices provide for us.

22
00:01:42,360 --> 00:01:45,760
And so the first thing, we kind of hope that there is a way to break in.

23
00:01:45,880 --> 00:01:50,680
Because if your platform is too secure, then you can't really analyze the device.

24
00:01:50,840 --> 00:01:53,960
And so jailbreaks are very important for this situation.

25
00:01:54,860 --> 00:02:02,000
Pangu and Taig were very famous, I guess, a couple of years ago, and still sort of famous in this situation.

26
00:02:02,380 --> 00:02:06,700
However, their jailbreaks are for earlier versions of iOS.

27
00:02:07,060 --> 00:02:12,720
Today it would be more a jailbreak from this guy Luca Tedesco from Italy.

28
00:02:14,040 --> 00:02:17,960
And so once you sort of get into your device, you jailbreak it,

29
00:02:18,500 --> 00:02:21,900
the first step is usually to analyze it statically.

30
00:02:22,560 --> 00:02:24,240
I like to use IdaPro,

31
00:02:24,240 --> 00:02:28,920
Pro because it is a very good static analysis tool. It decompiles and gives you lots of

32
00:02:28,920 --> 00:02:33,740
inside information. Now, when I started working on this, I actually did not know what ARM

33
00:02:33,740 --> 00:02:38,440
was and how to reverse engineer with ARM. As I was learning, I eventually built a tool

34
00:02:38,440 --> 00:02:44,660
called IDRF, which provides documentation for each instruction. It's particularly useful

35
00:02:44,660 --> 00:02:51,580
for any sort of weird instructions that you might come across. Unlike other tools that

36
00:02:51,580 --> 00:02:56,160
give you hints, this one gives you the actual documentation that comes from the manufacturer.

37
00:02:56,620 --> 00:03:00,880
And so even though it might not look nice, it actually provides very useful information

38
00:03:00,880 --> 00:03:06,460
directly from the source. Then there is dynamic analysis. That's usually

39
00:03:06,460 --> 00:03:11,820
the next step. So there's in-process analysis using things like debuggers like Frida or

40
00:03:11,820 --> 00:03:18,300
LLDB. And there's external analysis, such as file monitor to see what sort of files

41
00:03:18,300 --> 00:03:21,560
the application is accessing, or MITM.

42
00:03:21,560 --> 00:03:25,540
proxy, which is man-in-the-mill proxy, that allows you to see the network activity of

43
00:03:25,540 --> 00:03:30,420
this device. I also built a tool called Objective-C Trace,

44
00:03:30,800 --> 00:03:35,840
which actually allows me to do sort of packet sniffing internal to the device itself. So

45
00:03:35,840 --> 00:03:41,500
which services does this application interface with, and what messages is it passing internally.

46
00:03:42,400 --> 00:03:48,740
Now, the reason it works is because Objective-C is incredibly nice. It uses a messaging interface

47
00:03:48,740 --> 00:03:53,880
to execute functions. And so if you can kind of hook in there and observe which messages

48
00:03:53,880 --> 00:03:59,900
are being passed around, you can observe what the application is doing in some abstraction

49
00:03:59,900 --> 00:04:04,580
layer. Next one is the Mac port messages. Those are

50
00:04:04,580 --> 00:04:10,000
useful for any sort of inter-process communication. And so to discover what services the application

51
00:04:10,000 --> 00:04:17,440
is trying to interface with. In order to build this tool, I had to hook

52
00:04:17,440 --> 00:04:18,660
a function called.

53
00:04:18,720 --> 00:04:28,260
It is a central function that dispatches messages between different parts of the application

54
00:04:28,260 --> 00:04:35,780
and actually executes the codes internally. So it's very much a bottleneck for logic.

55
00:04:36,680 --> 00:04:42,420
And so I had to patch that, and I was able to actually determine what all the things

56
00:04:42,420 --> 00:04:47,100
it was doing. Now, in order to make it work, I had to make

57
00:04:47,100 --> 00:04:48,700
an optimization. Because otherwise it's not going to work.

58
00:04:48,700 --> 00:04:51,300
It slows down too much. It's a very, like I said essential function.

59
00:04:51,840 --> 00:04:58,780
So what I would do is, if a function appears in a cache, which means that it got executed

60
00:04:58,780 --> 00:05:04,500
before, I don't record it and therefore I only record functions that got executed at

61
00:05:04,500 --> 00:05:04,940
least once.

62
00:05:05,400 --> 00:05:11,720
So that provides me coverage information to see if my testing has actually given me good

63
00:05:11,720 --> 00:05:14,260
coverage space of the entire application.

64
00:05:16,660 --> 00:05:17,220
Ah...

65
00:05:17,680 --> 00:05:17,960
Yes?

66
00:05:18,700 --> 00:05:24,780
with the mock messages. However, it produces a lot of messages, and so I needed a way to

67
00:05:24,780 --> 00:05:29,000
parse it. I called it Mockshark. As you can see, it gives me lots of interesting information

68
00:05:29,000 --> 00:05:35,040
and allows me to filter things down. At that point, yeah, so I wanted to mention

69
00:05:35,040 --> 00:05:39,020
at that point you can start sending these messages to the cloud and start doing correlations

70
00:05:39,020 --> 00:05:46,580
and all kinds of services like that. So that seems very manual. I wanted to find

71
00:05:46,580 --> 00:05:52,340
a way to sort of automate things. You know, one of the difficult parts with iOS applications

72
00:05:52,340 --> 00:05:57,940
is that all of them are pretty much user-driven, right? There's no ‑‑ there are not really

73
00:05:57,940 --> 00:06:02,380
many applications, at least I can't really think of any, that are fully automated or

74
00:06:02,380 --> 00:06:05,420
at least partially automated. Everything pretty much starts with the user. And so I needed

75
00:06:05,420 --> 00:06:11,240
to find a way to trigger everything and to make the application do work so that then

76
00:06:11,240 --> 00:06:15,960
I can observe what it is doing. So I built a tool called Chaotic March, and this tool

77
00:06:15,960 --> 00:06:16,560
essentially ‑‑

78
00:06:16,560 --> 00:06:21,440
It's basically injects inside of the application and will trigger various events. Why would

79
00:06:21,440 --> 00:06:25,780
I want to do that? Well, I mean, it's time saving. It's repeatable, which is very important

80
00:06:25,780 --> 00:06:30,820
to me. It's a good way to discover web APIs or things that the application is trying

81
00:06:30,820 --> 00:06:36,860
to interface with or internally which services it's trying to interface on the device itself.

82
00:06:37,260 --> 00:06:41,880
And like I said before, it's good for coverage information. Have I observed the entire attack

83
00:06:41,880 --> 00:06:43,080
space of this application?

84
00:06:43,480 --> 00:06:44,460
So what's the name of the app?

85
00:06:45,240 --> 00:06:46,420
It's Chaotic March.

86
00:06:49,500 --> 00:06:53,140
I wrote it in March, and it was kind of chaotic for me, so.

87
00:06:57,520 --> 00:07:02,360
And when I started sort of thinking about this problem, I had sort of two major ways

88
00:07:02,360 --> 00:07:08,480
I could have gone. One of them was to simulate the user, essentially get a camera or some

89
00:07:08,480 --> 00:07:13,720
sort of artificial intelligence pointing at the device and then clicking around, typing

90
00:07:13,720 --> 00:07:15,800
things in, clicking buttons, et cetera.

91
00:07:16,520 --> 00:07:21,540
However, that's kind of over my head, and so I decided to go the easy route by injecting

92
00:07:21,540 --> 00:07:26,200
inside of the application and then observing what it is doing, what it is doing there,

93
00:07:26,840 --> 00:07:33,280
how the structures are connected together, and then triggering on internal states. This

94
00:07:33,280 --> 00:07:38,300
is what the UI looks like in memory when you actually go inside of the application. It's

95
00:07:38,300 --> 00:07:43,280
a nice tree with well-defined objects. There are fields that have lots of interesting information,

96
00:07:43,520 --> 00:07:46,140
and there are functions that you can execute on top of those.

97
00:07:49,240 --> 00:07:56,020
So Chaotic March, it is a LUA scriptable application, so you can pretty much create

98
00:07:56,020 --> 00:08:02,460
any type of logic that you like. It is good at finding UI components, and it's very lightweight,

99
00:08:02,620 --> 00:08:05,000
so it's very good for pretty much any type of application.

100
00:08:06,620 --> 00:08:10,860
This is what a basic script might look like. So if I want to run through the entire thing

101
00:08:10,860 --> 00:08:14,640
and I want to click all the buttons, fill in all the form fields, and generally make

102
00:08:14,640 --> 00:08:16,120
the application do different things. So, this is what a basic script might look like. So,

103
00:08:17,100 --> 00:08:17,640
you can pretty much create any type of logic that you like. So, if I want to run through

104
00:08:17,640 --> 00:08:18,560
the entire thing and I want to find all the things that are missing, I can pretty much

105
00:08:18,560 --> 00:08:23,720
This is kind of what it looks like when it all comes together, you know. I have a little

106
00:08:23,720 --> 00:08:27,600
monkey, even though it's actually Chaotic March, clicking around, doing things, and

107
00:08:27,600 --> 00:08:30,940
it's triggering the application. And then there is a man in the middle proxy that actually

108
00:08:30,940 --> 00:08:37,600
manipulates any network information that goes through, and it sends it back to the application

109
00:08:37,600 --> 00:08:42,920
upon the return from the server. Now, I do this because I want to trigger things on the

110
00:08:42,920 --> 00:08:46,100
application as much as possible. So, if I mutate server, I want to trigger the application

111
00:08:46,100 --> 00:08:49,180
certain responses, then I can make it give up more things for me.

112
00:08:50,860 --> 00:08:56,360
All right. So the applications for discovery are huge. You know, Web API is one of the

113
00:08:56,360 --> 00:09:00,420
big ones. You know, every time an application kind of reaches out somewhere, even if I don't

114
00:09:00,420 --> 00:09:04,640
authenticate, it sort of tells me what it is that it's looking for. You know, oh, I'm

115
00:09:04,640 --> 00:09:09,180
looking for this image, I'm looking for this entry in the database, et cetera. And so that

116
00:09:09,520 --> 00:09:14,860
opens up attack surfaces for me. Local behavior is pretty big for this one. So any sort of

117
00:09:14,860 --> 00:09:21,020
files, IPC, any sort of infrastructure that it tries to access. And it's a good way for

118
00:09:21,020 --> 00:09:25,240
me to determine which things the app considers important, which things the vendor considers

119
00:09:25,240 --> 00:09:31,200
important, and sort of give me sort of samples that I can work with further on in my analysis.

120
00:09:33,060 --> 00:09:37,780
So this is something ‑‑ this is what it looks like. So when I sort of run this

121
00:09:37,780 --> 00:09:44,840
loop, I have an application. It's a Russian ‑‑ it's called an AdWords application.

122
00:09:44,860 --> 00:09:53,020
AdWords is the social networking site for famous in Russia. And when I try to essentially

123
00:09:53,020 --> 00:09:59,720
get it to log in several times, it eventually gives up a whole bunch of infrastructure endpoints

124
00:09:59,720 --> 00:10:05,360
that I can later analyze afterwards. So, like, you can see I highlighted four of them

125
00:10:05,360 --> 00:10:12,600
down there. So when I made this ride, I was very hungry. So there's chocolate in there.

126
00:10:14,860 --> 00:10:20,540
And the other mechanisms that I can use for assisting with automation of this stuff is

127
00:10:20,540 --> 00:10:26,500
essentially trying to rewire the application. So if we look at this example, I had the private

128
00:10:26,500 --> 00:10:31,320
wealth management application from Goldman Sachs, because I have about $10 in my account,

129
00:10:31,400 --> 00:10:35,740
so I felt like I really needed it. But I really wanted to get more, so I wanted to find out

130
00:10:35,740 --> 00:10:39,320
what my attack surface would look like if I was going to do more things.

131
00:10:39,800 --> 00:10:44,680
So when I just tried to log in, I really get only about two, three, or maybe four

132
00:10:44,860 --> 00:10:50,740
things that I can then attack. However, what I tried to do is rewire the application internally.

133
00:10:51,340 --> 00:10:55,580
And you can see on the bottom, maybe some people on the back can't really see it. But

134
00:10:55,580 --> 00:11:02,580
what I did is I essentially changed the function for accepting an authentication response to

135
00:11:02,580 --> 00:11:07,600
always return true. And so what this means is that when I enter a user name and password

136
00:11:07,600 --> 00:11:12,620
and I say log in, the application sends the information out, but then the service says,

137
00:11:12,740 --> 00:11:14,840
oh, I'm sorry, that's the wrong password. I can't really do anything about it.

138
00:11:14,860 --> 00:11:19,820
However, the application thinks that the log in was successful, and so it will go on

139
00:11:19,820 --> 00:11:22,760
to the next stage and reveal more things that it's trying to access.

140
00:11:23,260 --> 00:11:29,320
And so here, I didn't highlight all of them, but there's, you know, tens or so interfaces

141
00:11:29,320 --> 00:11:33,960
that it's trying to access. It gets an error for pretty much each and every one of them,

142
00:11:34,060 --> 00:11:39,140
but it gives me samples that I can then use for fuzzing. It gives me more information

143
00:11:39,140 --> 00:11:44,840
about the vendor infrastructure. And essentially, I can now have a better

144
00:11:44,840 --> 00:11:52,260
idea of what it is that I'm facing in case I want to actually learn more about, you know,

145
00:11:53,020 --> 00:11:55,680
whoever wrote this application. I don't know who this might be.

146
00:11:57,360 --> 00:12:02,180
So I thought that was pretty interesting. Putting it together, this is the picture we

147
00:12:02,180 --> 00:12:06,920
get. You know, we can start manipulating the sort of the interface from the application

148
00:12:06,920 --> 00:12:11,500
to the vendor, and then I can start manipulating the interface inside the application itself

149
00:12:11,500 --> 00:12:14,260
and basically just get it to give up as much information as possible.

150
00:12:14,840 --> 00:12:19,820
And then put it in my notebook and, you know, gather it up for my next steps.

151
00:12:21,860 --> 00:12:27,780
So that's pretty much it. You know, there's lots of possibilities here.

152
00:12:27,920 --> 00:12:31,180
You know, applications obviously are important, you know, freedoms and such.

153
00:12:31,360 --> 00:12:34,100
Those are great things. Automation is always useful.

154
00:12:34,240 --> 00:12:39,600
So if I can recreate my tests as much as possible, you know, if they released a new

155
00:12:39,600 --> 00:12:44,540
tool, a new application, then I can rerun through my tests and actually get to see what

156
00:12:44,540 --> 00:12:44,760
changed.

157
00:12:44,840 --> 00:12:49,340
Changes happen there. Now, of course, I really like the idea of

158
00:12:49,340 --> 00:12:54,020
being thorough. So here, if I'm running it through an automated

159
00:12:54,020 --> 00:12:57,560
mechanical tool, then it's more likely to be thorough than if I'm sitting there and

160
00:12:57,560 --> 00:13:00,400
clicking it on my own. So that's pretty much it.

161
00:13:00,880 --> 00:13:04,260
I hope you enjoyed it. If you have any questions, please catch me

162
00:13:04,260 --> 00:13:09,820
here in the hallways, online. Yeah, if you have any questions.

163
00:13:10,180 --> 00:13:10,740
Thank you.

164
00:13:20,340 --> 00:13:23,860
Pretty high level. There's a lot of stuff going on.

165
00:13:24,360 --> 00:13:29,660
If you want more low-level details, debugtrap.com. Pretty much everything is laid out.

166
00:13:30,020 --> 00:13:33,580
There's lots of information there. I tend to blog before I talk.

167
00:13:34,560 --> 00:13:38,540
In case of DEF CON, I really can't because they don't allow it.

168
00:13:38,640 --> 00:13:41,360
So I will write up the blogs and then post them online anyway.

169
00:13:42,240 --> 00:13:44,820
So do you need a physical device to do this, or is it part of the process?

170
00:13:44,820 --> 00:13:47,860
Are there any, like, virtualization or simulation techniques that you can do this with?

171
00:13:49,700 --> 00:13:54,360
Unfortunately, you do need a physical device, just because Apple is so stringent

172
00:13:54,360 --> 00:13:58,960
about allowing people to virtualize things. And so that's why jailbreak is necessary.

173
00:14:00,080 --> 00:14:04,920
Potentially, if you are the vendor of the application, you can try using the simulator,

174
00:14:05,120 --> 00:14:08,940
so you can build the application and then run through it and then see what stuff you

175
00:14:08,940 --> 00:14:14,800
can get it to give up. So that seems pretty good.

176
00:14:14,820 --> 00:14:16,940
That's a good question. But how does it apply to Android devices?

177
00:14:17,720 --> 00:14:22,660
Android is a lot easier, because jailbreaking is sort of nonexistent there.

178
00:14:22,740 --> 00:14:26,620
You just kind of enable debug mode, and then you can start plugging things in.

179
00:14:26,800 --> 00:14:36,800
In fact, Google actually builds a tool that you can inject and then you can script the

180
00:14:36,800 --> 00:14:42,580
same stuff that chaotic march allows you to do. It's probably more advanced as well.

181
00:14:42,820 --> 00:14:43,280
Thank you.

182
00:14:43,840 --> 00:14:44,320
Thank you.

183
00:14:48,280 --> 00:14:50,960
Any more questions? Yes?

184
00:14:51,380 --> 00:14:54,120
During your rewire, what tools ?

185
00:14:56,400 --> 00:14:57,180
This one?

186
00:14:57,280 --> 00:14:59,040
You need to force the logging to be true.

187
00:14:59,720 --> 00:15:06,440
This tool is called Script. Some people pronounce it as SciScript. Basically,

188
00:15:06,440 --> 00:15:11,760
it injects and gives you this interface where you can sort of live analyze the application.

189
00:15:13,120 --> 00:15:13,760
Okay.

190
00:15:14,180 --> 00:15:14,800
Thank you.

191
00:15:17,880 --> 00:15:22,420
Cool. Well, thank you for your attention. Check out synag.com.