start	end	text
0	5000	Hi everyone, I'm Ajin Abraham, a security researcher and creator of MobSF Project.
5040	12260	This talk is about MobSF, a free and open source tool that helps you to perform security assessment of your mobile applications.
12280	19320	To get started with the project, follow the documentation links and also feel free to join our Slack channel for support.
19840	24380	Use these Docker commands to get a quick instance of MobSF up and running.
25980	34520	MobSF supports both static and dynamic analysis. Under static analysis, we support Android, iOS and Windows binaries.
34520	42480	We also support SIFT source code, so we support Java and Kotlin for Android and SIFT and Objective-C for iOS.
42640	46640	For dynamic analysis, currently we only support Android binaries.
46640	53160	You can perform dynamic analysis with a Genymotion Android VM or an Android Studio emulator.
54140	59960	MobSF also has REST APIs for your CICD or DevSecOps use cases.
60320	69040	Let's take a look into the tool. In this demo, I'll be talking about static and dynamic analysis of Android applications with MobSF.
70180	78060	So let's take MobSF and let's drag and drop an Android APK, so that's a binary.
78060	89040	Now you get a report that looks like this. The scan time is directly proportional to the size of the binary, so the bigger the binary, the more time it will take for the scan to finish.
90360	96000	And if you go to the recent section, it will actually show you the files that you have recently scanned.
96380	102780	So let's do one thing, let's take one of the files so that I can give you a walkthrough of static analysis.
102780	111740	So I'm taking this particular app. Let's take that and let's take a look into the report.
112480	117540	The static analyzer report have different sections, so we will go through each of them quickly.
117860	128440	On the top, you have the information section where it will actually show you the app scores, the various app scores like average CVSS, the security score, the number of trackers identified from the app, etc.
128440	134560	Then we have the file information section that shows the name of the file, the size, the basic hashes of the file.
134780	144260	And the app information section shows different information about the app, like the package name, the main activity, the version, so on and so forth.
144380	153160	And after that, you have a section that will actually show you the activities, services, receivers and providers, like the number of these components.
153160	160160	These are like the fundamental components of an Android application. It will also list out what components are exported.
160400	169660	When you talk about exported components, these are the components which can be invoked or called upon by a different app running inside the device.
170140	181460	So if you look at it from an application security perspective, there are certain cases when you do not want a third-party application to access or invoke a particular activity or a service in your application.
181460	188660	So you need to be careful about that. This needs to be manually investigated and see if this is a possible security issue.
189300	197440	Then comes the scan options, where you can actually do a rescan or you can perform dynamic analysis. We'll come to that later.
197580	204540	Also, it shows you the decompiled code, where it actually shows you the decompiled Android manifest file.
204540	221720	So that's the decompiled Android manifest XML file. And then you can also go through the Java source code. The decompiled Java source code is listed. All the files are listed. If you want to search for something inside the file, you can find inside the file.
221720	238780	Like in this case, the string SSL is present in these three different files. Similarly, if you want to search for a particular file name, like if you want to search for activity, the files that contain the word activity, then you can search that here and it will list out all the files that contain the word activity.
241660	261080	Similarly, you can even view the Smiley code corresponding to the binary. Mobisoft also convert the DEX code into Smiley. And if you're interested in looking into Smiley source code, you can look into this section. Like Java source code, you can find inside the files or you can search for a specific file as well.
262060	270920	And this section will also allow you to download the Java source code, the download the Smiley source code, or even you can download the APK itself.
271240	288000	And then comes sign a certificate. So this section lists out the basic information about the code signing certificate, like the version of the signature, the hash algorithm used, the fingerprint, the issuer identification, so on and so forth.
288000	300060	Also, Mobisoft does some checks on the signer certificate to see if there are any misconfigurations, like whether the app is signed with a debug certificate or if it's actually using a weak hash algorithm, things like that.
300060	312440	So if it detects anything, it will actually show that in the certificate status section with a small description. So that's actually quite handy when you're analyzing production-ready Android applications.
313820	322620	The next section will list out permissions. So you can see the table shows the permission that's used by the app, status, info, and description.
322720	330320	So this is something that you can actually use to check and verify that the permissions used by the applications are actually necessary.
330320	346060	Then again, it strengthens the point of least privilege model. So you should always have an application with the least permissions. So use only the permissions that are actually required. Do not provide permissions that are not required by the application.
346240	351740	Also, if you note here, you can see the status as normal, dangerous, and signature or system.
351740	363380	The reason why you see dangerous here is that this is one feature that can be abused. Let's say this was a third party application and you're doing a black box testing or you're doing a malware analysis.
363380	375220	Then this might be one permission that can be actually abused by the application like using the Bluetooth or like connecting to internet to exfiltrate data and things like that.
375220	387320	So some of the permissions are actually considered dangerous. It does not mean that the permission is dangerous. It depends upon the context. Like if it's a malicious app, then it might be a dangerous permission that the app is actually requesting.
387320	407040	The next section is shared library binary analysis. So what happens here is if your application is having any native code, for example, if you're using JNI or you're using an SDK which has a native code, then you will have shared objects.
407140	416880	So we do binary analysis on the shared objects. We check and see if there are some misconfigurations while it's actually being compiled or built.
417320	423600	Things like that. So if you identify any security issues on the shared object that will be listed under binary analysis.
425460	432880	This section actually give you a quick idea about what this app is capable of doing from looking at the APIs that's actually being used.
432880	447020	It's quite handy if you're doing malware analysis or you're doing, you know, black box pen testing on third party application like it will give you an idea about what are the core functionalities of the app and then you can start your investigation from the critical APIs.
448520	451300	After that you have the browsable activities.
451760	459660	So this section lists out all the browsable activities like all the activities that can be browsed by a particular scheme.
459960	468040	The scheme is a good place to start fuzzing the application. You can take out the scheme and then append the first string and perform fuzzing.
468040	474700	So you can see how the application or the particular activities behaving with your fuzzing input.
476080	488840	After that comes security analysis. In security analysis we have manifest analysis where we actually perform a static analysis on the Android manifest files and pull out any insecure findings.
488840	493500	So you can see the issue, the severity and the description corresponding to each issue.
494160	502860	And then moving on, you have the code analysis section. So this is a section where mobiles have performed a static analysis on all the decompiled Java files.
502860	513940	And if it finds any issues, it will list out the issues. So it's not just issues, it will also list out informational issues. It will also list out any good findings as well.
513940	527660	So the table has the issue description, the severity, the CVSS score of the issue, the CW identifier and we also classify the different issue under OWASP top mobile risk.
527660	534280	So you can see a classification identified corresponding to the issue and the files with the findings.
534380	543100	After that you have the file analysis section. This section will actually list out all the sensitive files like certificates that are hard-coded in the application.
543100	552370	It will also help you to identify any accidentally hard-coded certificates like private keys and things like that. So that's the file analysis section.
553120	560060	After that we have malware analysis. Under that we have APK ID analysis.
560060	579380	APK ID looks into the DEX files and tells us the possible behavioral patterns like the kind of compiler being used if an obfuscator was used or does the DEX file has code that corresponds to anti-VM detection or anti-debugging checks, things like that.
579380	585500	So it gives you a good idea about the behavior of the application from code perspective.
586260	599760	And after that we have a section called domain malware check. So what it does is it actually extracts out all the domains from the binary and checks that against a non-list of rogue or bad domains or IPs.
599760	612580	So we have a database of non-malware related IPs and domains and all the domains inside the binary is actually checked against those to see if it's actually present in that database.
612580	629460	And based on that you have a status that tells if this particular domain is good or bad. And we also do geolocation on all the domains that's available inside the app. So you can even plot that to Google Map to see what's the location of the particular IP address.
630340	648200	Alright, now comes the reconnaissance section. Here, Mobilesoft will actually list out all the URLs extracted from the different source code files. Similarly, if your application is having Firebase database, Mobilesoft will also extract all the Firebase database URL from the app.
648200	652840	It also performs an additional check to see if the database is exposed to the internet.
652840	660960	And in the next section, Emails, Mobilesoft will extract out all the emails that it found from the source code.
660960	678700	And after that comes trackers. Trackers are possible SDKs or add-ons that actually do telemetry collection on the application's behalf. Sometimes it can be a privacy concern, so it will list out all the trackers that's used inside the app.
678740	689360	And there's a URL that actually explains what kind of trackers and some analytics with respect to the tracker. So that's also available from Mobilesoft.
692420	702000	And finally, in this section, we have strings. So this will actually list out all the hard-coded strings in the binary, especially the ones from the string resource.
702000	712240	So if there is any hard-coded sensitive API keys or any other secrets in the string section, that will be dumped and shown over here.
712240	726140	After that, we have the components, which is nothing but the different components of the application. It will list out all the activities, services, receivers, providers, and any libraries that's used by this particular application.
727200	731740	Also, it will list out all the files inside the application binary.
732420	739660	And after that, you have the PDF report section. So this allows you to generate a nice and beautiful PDF report.
739660	747740	So let me generate a PDF report. And that's the Mobilesoft Static Analysis PDF report.
747740	762600	It gives a PDF report with high-level information about the different findings. It's quite handy if you want to document your security analysis for audit or for getting mobile application security certifications, etc.
764680	774740	So in order to start Dynamic Analysis, I can click on Start Dynamic Analysis from here, or I can actually perform Dynamic Analysis after Static Analysis.
774740	784600	Like, I can go to one of the Static Analysis reports, and from there, if I go to the Scan Options, I can perform Dynamic Analysis from there as well.
784600	788380	It's up to you. So I'm clicking Start Dynamic Analysis.
789860	802900	And if I take the console, I can see that there are some operations happening, like ADB restarted, waiting for two seconds, trying to connect to this device, so on and so forth.
803920	812840	So Mobilesoft will automatically prepare the environment, connect to the VM, and then install the APK so that we can perform Dynamic Analysis.
812840	822680	So since I have used Android version 7.0, we are actually seeing a lot of options which are related with Frida.
823480	835720	So here, there's an option called Show Screen, which will cast the device screen to the web interface. So if I enable that, I will be able to see my screen here.
835720	840300	I can also do some basic operations like touches and clicks.
844860	852800	Now you can remove the Mobilesoft Root CA, which is responsible for intercepting the traffic from the device if you want to.
852800	858120	So that will remove the Root CA, and if you want to install that again, you can click on Install.
859040	864620	The Exported Activity Tester allows you to dynamically test for exported activities.
864620	871720	This helps you to create proof-of-concepts dynamically, and you can verify your findings from Static Analysis.
871720	883600	So I'm clicking Start Exported Activity Tester, and if I take the VM, you can see that an activity is invoked, then closed, another activity is invoked, and closed.
883600	891880	So what happens in the background is Mobilesoft will go through all the exported activities, open them, and take a screenshot of it, and then store it for you.
892000	895080	So that's useful for proof-of-concept generation.
895080	906260	Similarly, if you want to brute-force all the activities, you can perform Start Activity Tester, which is a good way to brute-force non-exported activities forcefully.
907300	915000	Also, you can take screenshots, like if you want to take screenshots of something, you can click on Take Screenshot, that will take a screenshot.
916580	925320	Also, you can see the Logcat stream, so this is the Android Logcat stream from the device, so if you want to debug something, you can look here.
925380	933640	And finally, you have a button called Generate Report. This is the option that tells Mobilesoft, let's stop all the analysis and generate a report.
933960	937100	You have to press that when you're done with your analysis.
937100	943840	Now, talking about dynamic analysis, Mobilesoft does not provide an option for automated dynamic analysis.
943840	949480	It only provides an interactive environment for semi-automatic dynamic analysis.
949880	955140	The reason being, Mobilesoft does not know what the business logic of your application is.
955140	962060	It does not know about the username, the password fields, and how to fill them, and what other data it should provide.
962060	971500	So in order to get the most out of Mobilesoft dynamic analysis, you need to manually go through the different business logic and flaws of the application.
971700	977280	And in the background, Mobilesoft will perform security analysis on these different flaws.
977280	983480	You can see the activity log in here. Also, if there is any errors, that will be listed under the Errors tab.
984500	988280	Now below that, there is some Frida scripts related option.
988280	994020	You will see a default section, which will actually show you the default Frida scripts that are loaded with Mobilesoft.
994020	999360	We have API monitoring script. This script will monitor all the critical APIs at runtime.
999360	1005060	We have the SSL pinning bypass script, which is responsible for bypassing SSL pinning.
1005380	1011660	Then there is a root detection bypass script. If your application is performing root detection, it will bypass that.
1011660	1016700	Similarly, it will also bypass debugger checks using the debugger check bypass script.
1016700	1021980	So these are some useful default scripts that loads with Mobilesoft by default.
1021980	1027360	If you do not want any of them, you can uncheck them. Otherwise, you can have them by default.
1028720	1033280	And after that comes the auxiliary section. We'll come to that later.
1033480	1041640	So in order to start dynamic analysis, the first thing that you need to do is start instrumentation.
1041640	1048540	You can see that your application will get loaded here and it will be instrumented by Mobilesoft.
1048540	1059960	If you look into the console, you can see the application has spawned. We can see a couple of Frida scripts being loaded and some messages that are coming from the Frida scripts.
1060720	1071360	So once you instrument the app with Frida, in order to see the output generated by these scripts, you can look into the console or the best place to look into is Frida Live Logs.
1071640	1075880	Frida Live Logs will show all the output from the different Frida scripts.
1076160	1083660	So if you're running a custom Frida script or if you're writing a custom Frida script and if you want to see the output, this is the place that you need to look into.
1084640	1089720	Once you click on Start Instrumentation, you should be navigating through the different floors of the app.
1089840	1095900	I'm actually going through the different floors of the app so that Mobilesoft can actually perform security analysis in the background.
1107780	1110820	Now you can see that I've done some operations in here.
1110820	1118360	Okay, so one another thing that I want to show is that if you scroll up, you'll see a new field called Live API Monitor.
1118420	1123180	So this button will be enabled only if you instrument the app.
1123180	1131460	So once you instrument the app, you can see the Live API Monitor, which will capture all the API calls that are happening at runtime.
1131460	1155120	Once inside the API Monitor, you can see the API name, the class, the method that was called at runtime, the arguments passed to the method, the result, if there was any, the return value, if the method returns a value, and then called from, which actually shows from where that method was actually called.
1155120	1160660	So this method was called from base64.java at line number 494.
1160660	1172100	This is a helpful feature that allows you to identify the API calls which are made at runtime, what are the arguments being passed, from where are they being getting called, things like that. Quite useful.
1172220	1181720	From the Dynamic Analyzer, you have access to Frida Code Editor. So if you want to write custom Frida scripts, you can write in here and you can just click on Start Instrumentation.
1181720	1193960	You also have a set of pre-built scripts that comes with MobileSub. These are some helper scripts. So if you want to load a script, you can click on that and click on Load. That will load the script contents in here.
1193960	1201380	And once you have the contents in here, you can just click on Start Instrumentation, and that will instrument the app and load it with your custom script.
1202060	1211100	Now we will talk about auxiliary scripts. So these are some very useful scripts that you can use while you are performing dynamic analysis of an Android application.
1211100	1221440	Let's start with Enamorate Loaded Classes. As the name suggests, it will enamorate all the classes loaded at runtime. So let's click on Start Instrumentation.
1223960	1238780	Our app is loaded. Now if you look into Frida Livelogs, you can see the classes that are loaded at runtime. So if you need to understand what are the classes loaded by the application at runtime, you can make use of this auxiliary script.
1239660	1250680	Okay. Similarly, there is another auxiliary script called Capture Strings. What it does is it tries to capture all the strings at runtime. So let me start instrumentation.
1252920	1260500	My app is running. Let me go through different flows so that there are possible strings in here.
1265490	1275940	Yep. Now let me look into the Frida Logs. And you'll see that there are a couple of strings being caught by this auxiliary script.
1278580	1289070	Now let's see Capture String Comparison. So this is a useful auxiliary script that will capture all the string equal comparisons. Let's instrument the app.
1293600	1299840	Then let's go through some flows, hoping that there are some string comparisons happening.
1302320	1317500	Now if I click on Frida Livelogs, you can see all the string comparisons that happened at runtime. Like that's the first argument, that's the second argument, and the comparison returns false because they are not equal.
1317500	1329040	So this is also one quite handy feature when you are playing CTFs where you actually want to capture the flag, where the flag is actually getting compared with the user input and things like that. So it's quite useful.
1329160	1342460	Now we have an auxiliary script called Enumerate Class Methods. Like the name suggests, it will enumerate all the methods of a class. For example, if you have a class and you want to know what are the methods supported, you can give that here.
1343440	1346700	And then let's click on Start Instrumentation.
1349610	1361330	And if you look at Frida Livelogs, you can see the different methods supported by the class. So it will get all the methods and implementations of the class java.io.file.
1361330	1376970	Again, this is actually quite handy if you're trying to dig into third-party classes where you do not have documentation available on what are the methods available. So you can easily, you know, obtain all the methods and implementations of third-party classes.
1378450	1393070	Now we have Search Class Pattern. So this feature allows you to search for a particular class at runtime using pattern. Like for example, you are actually analyzing an Android application and it has a custom SSL pinning code.
1393070	1404710	And the default SSL pinning bypass that comes with mobile stuff is not detecting it. You might want to investigate and find out what is the custom code responsible for SSL pinning.
1404710	1414910	So for that, you can use the class pattern search. Like you can search for class names that have SSL in it. So if I just instrument the app.
1418950	1432570	And check the logs, I can see that pattern matches found. So these are the classes which are string SSL in it. So with this auxiliary script, you can easily find and filter out classes based on a particular pattern.
1435030	1443970	And finally, we have something called Trace Class Methods. This is another useful and handy feature that allows you to trace class methods.
1443970	1453610	Like for example, if you have a class and if you want to see what are the methods of the class that are invoked at runtime, what are the arguments passed, what's the return value.
1453610	1460250	Similar to that of API monitor. But if you want to do that on a custom method, you can actually provide
1460990	1469830	The class name here so that it will trace all the class methods. Let's put a class. So let's use Java.lang.string
1471050	1474670	And then let's instrument the class.
1481520	1484540	Let's try to go through one of the flow.
1489680	1492480	Let's look into the Frida Live logs.
1493260	1497780	And you can see that class tracing all the method implementation of Java.lang.string
1499160	1506520	There was this method called hashCode. This was the argument and that's the return value.
1507440	1517460	Similarly, it also called equals and that was the argument and that's the return value. And you can see other methods in this particular class.
1517460	1525700	And this helps you to isolate monitoring to a particular class like what are the methods of a particular class that are being called at runtime.
1526180	1530580	What are the arguments being passed, what's the return value and things like that.
1530580	1536940	Now that you have explored most of the features of Dynamic Analyzer, let's see how we can generate a report.
1536940	1539800	For that, click on generate report.
1543520	1549280	So this is a report generated after dynamic analysis of an Android application.
1549280	1553180	Here under information section, we have API monitor view.
1553340	1560400	You can see all the APIs that were captured at runtime, their arguments, return value, the caller function, etc.
1562160	1566720	And you also have Frida logs view, which will show all the Frida logs.
1568960	1572880	And you have startHttpTools. We'll come to that later.
1572880	1577880	You can also see the raw Frida API monitor logs.
1578140	1580220	That's a JSON log.
1581080	1584360	Similarly, you can see the raw Frida logs.
1586200	1592220	You can see the raw HTTPS traffic. So if there was any HTTPS traffic, that will be shown here.
1592220	1595780	Since there was no traffic generated, there is nothing in here.
1596300	1598740	Again, logcat logs.
1600120	1602300	The dumpsys logs.
1603040	1604840	And the application data.
1604840	1607740	So if you click on that, it will ask you to download a file.
1607740	1611080	And that file consists of the application data.
1611080	1615160	That's the data that is created by the application inside the device.
1615700	1626280	And then we have the Frida API monitor, where we will list out the different critical APIs or methods that were called at runtime.
1626540	1631240	We have the class name, the method, the arguments, the caller activity, etc.
1631240	1636660	So this is more of a nice representation of what you have seen in API monitor view already.
1637000	1639520	And then you have the results from exported activity tester.
1639520	1644120	So if you run the exported activity tester, that will invoke all the exported activities.
1644120	1645680	Take a screenshot of that.
1645680	1648840	So this is something that you can use in your proof of concept.
1648840	1654220	In this particular case, you can see that this particular exported activity has some sensitive information.
1654600	1659140	Also, if you have run activity tester, you will see similar results in here.
1659140	1663280	And if you have taken any screenshot, that will be shown here.
1663680	1667600	And then we have malware analysis, which has domain malware check.
1667600	1670260	So these are the domains which were captured at runtime.
1670800	1672700	And then there is clipboard dump.
1672700	1677160	So if the application copies anything to the clipboard, that will be shown here.
1677160	1679960	So we dump the device clipboard.
1680500	1683640	Similarly, all the URLs, emails.
1683920	1686080	And then we have file analysis.
1686080	1690860	Here it will list out all the SQLite database created by the application inside the device.
1691000	1696420	You can go through the database and it will dump the contents of the database.
1699660	1706260	Similarly, you can read the XML files or the shared preference files created by the application inside the device.
1709340	1711740	And there are other files as well.
1711880	1714140	And finally, you can download or print the report.
1714140	1718640	So that's a walkthrough of different sections of Android dynamic analysis report.
1723830	1726290	And finally, you can use HTTP tools.
1726290	1728470	Let's click on start HTTP tools.
1730310	1734270	Now you can see that all the captured traffic is actually visualized here.
1734270	1736430	So you can see the request response pair.
1736430	1743590	Now if you want to repeat this request to a specialized security tool like Burpsuite, you can use the send to fuzzer option.
1743890	1746430	So before doing that, let's run Burpsuite.
1753810	1755850	Let's go to the proxy tab.
1756030	1759090	And then obtain the proxy IP and port.
1759090	1762210	So the proxy is on localhost 8080.
1762570	1768670	So before repeating the traffic, just make sure that your proxy tool is not on intercepting mode.
1768690	1772110	So let's go to intercept tab and turn off intercept.
1772470	1781530	Now if I click on send to fuzzer, it will show this model with a field to enter the proxy IP and port.
1781570	1785570	So in our case, the proxy IP is localhost 8080.
1785750	1788450	So let's click on repeat request.
1789470	1791910	So that will repeat the request.
1791910	1794110	You can see the progress in the console.
1794110	1797550	So you can see that a couple of requests are repeated here.
1797550	1802490	And if you go to the proxy, you can see that the requests are populated over here.
1802490	1810150	And from here, you can use the specialized tool like Burpsuite to perform web application or API specific security tests.
1810370	1816410	I would like to give a shout out to our active collaborators, Maghafi, Mattan and Vincent.
1816410	1822630	Also, I would like to thank all the major contributors who had helped us with the various product features,
1822990	1831730	like Netguru team who helped us with the iOS SIFT support, Dominic, Amrita, Shanil, Maxim, Abhinav, Shuksan and Ekstaban.
1832150	1836690	If you have any questions, you can contact me over email or Twitter. Thank you.