1
00:00:00,000 --> 00:00:01,660
Thank you for joining my talk.

2
00:00:02,660 --> 00:00:09,520
I guess some of you are having night time and some of you are having day time, but again, thank you for joining in.

3
00:00:10,040 --> 00:00:18,720
I would like to thank the DEF CON Red Team Village for providing me the opportunity to speak on the subject, which is from discovery to disclosure.

4
00:00:22,510 --> 00:00:27,190
So I do the cybersecurity stuff for a financial institution here in Pakistan.

5
00:00:27,530 --> 00:00:36,110
And when I'm done with my official responsibilities, I do the security researching, which is one of my hobby.

6
00:00:36,750 --> 00:00:44,330
Before the information security career, I used to develop mobile applications, web applications, and vice versa.

7
00:00:45,790 --> 00:00:57,790
Mobile applications and IoT industry have been really fascinating and I look forward to learn more about them as they are one of the growing industries.

8
00:00:57,790 --> 00:01:06,450
And with the stuff that is growing, it also has vulnerabilities or bugs or risk around it.

9
00:01:08,790 --> 00:01:14,690
Today, my focus of talk would be Android application and their controls.

10
00:01:15,510 --> 00:01:17,770
Why Android applications?

11
00:01:17,770 --> 00:01:22,990
Because commonly used by the people around for the ease of access.

12
00:01:23,130 --> 00:01:38,730
So when you are developing mobile applications, let's say an iOS or an Android, you are required to integrate API because that helps you to fetch the dynamic data or the data that is stored in the database.

13
00:01:38,730 --> 00:01:50,730
So with the help of API, which is actually a bridge between a database and an application, you are able to perform your operations more smoothly and easily.

14
00:01:52,710 --> 00:01:58,370
Let's talk about some mobile application security breaches that happened earlier.

15
00:01:58,770 --> 00:02:06,110
One of them was Zigna that faced a data breach for around 200 million customers.

16
00:02:07,290 --> 00:02:16,710
The British Airways recently, a year back, faced a huge fine due to the data breach.

17
00:02:17,190 --> 00:02:30,050
And there was this health application which used to suggest the weight or the calories you were taking in.

18
00:02:30,050 --> 00:02:40,110
So let's say you need to record the calories you have taken in for the dinner or for the lunch.

19
00:02:40,110 --> 00:02:45,470
It would predict the weight for you.

20
00:02:45,470 --> 00:02:47,690
So you can maintain it more easily.

21
00:02:48,430 --> 00:02:58,030
And in the data breach, 150 million accounts were affected and the data is still out there.

22
00:03:00,570 --> 00:03:21,590
This year, there was a security misconfiguration in Firebase databases, which allowed the malicious actors or the users that could pass a specific and a simple parameter would allow them to look into the whole database or the whole data into the database.

23
00:03:25,300 --> 00:03:33,180
With the passage of time, the vulnerabilities of Android applications or the Android have been increasing year by year.

24
00:03:33,180 --> 00:03:38,280
So let's say in 2009, we had five vulnerabilities.

25
00:03:38,280 --> 00:03:48,180
And when we see 2016 and onwards, we have a large amount of vulnerabilities in Android and Android applications.

26
00:03:50,020 --> 00:03:55,060
So how did I discover vulnerabilities in one of the applications I was looking into?

27
00:03:55,700 --> 00:04:04,480
So this specific application had around 1.5 million of downloads on the App Store with a great amount of reputation.

28
00:04:05,240 --> 00:04:10,000
They had been providing premium services to their customers, to their premium customers.

29
00:04:10,000 --> 00:04:27,140
So let's say you need to modify the notification, the time of the notification, and customize the notification for the premium users for if you are one of them, that would be very easy for you.

30
00:04:28,060 --> 00:04:50,160
If you want to send greeting cards or cards with subject to a specific occasion, you could have easily do that by going to the specific function and generating a specific greeting card or the occasion card and write down whatever stuff you want to.

31
00:04:53,020 --> 00:05:05,670
So while looking into the application through a technical perspective, I found the application was using Firebase for the data storage.

32
00:05:06,310 --> 00:05:16,590
And they were using Google Cloud Platform for their dynamic stuff, or let's say the stuff they wanted to host.

33
00:05:17,510 --> 00:05:36,970
And as well as the Google Identity Toolkit, let's say if you are a user, you want to register on this platform, all of the identity and access management were handled by the relying party, which is also known as Google Identity Toolkit.

34
00:05:36,970 --> 00:05:44,570
So this area had really fascinated me and I decided to look more into this perspective.

35
00:05:45,390 --> 00:05:54,710
So when I went into the Google Identity Toolkit, there were a lot of functions that were visible in their documentation.

36
00:05:54,710 --> 00:06:12,710
I went to their whole documentation one by one and tried every function on this application and tried to find out which of the functions are enabled by this application and which of them are disabled.

37
00:06:13,540 --> 00:06:21,510
So one of the function which says get account info was really fascinating for me and really interesting for me.

38
00:06:21,510 --> 00:06:30,930
So let's say I wanted to find details for an account if it is registered on the platform or if it is not registered on the platform.

39
00:06:30,930 --> 00:06:43,330
This specific function was able to return the details for a specific account or for a specific email address or for a number, if known.

40
00:06:44,550 --> 00:06:59,210
So what I did is I searched for the organization emails and one of them was the no reply email that was not registered and I found that to be available for the signup.

41
00:06:59,210 --> 00:07:03,070
I signed up to that email address.

42
00:07:03,130 --> 00:07:13,090
Again, it wasn't sending a verification token to the email address and allowed the users to log in directly to the application.

43
00:07:13,110 --> 00:07:23,690
So I signed up through this email address and I was logged in as a corporate user with the same privileges a corporate user would have.

44
00:07:24,810 --> 00:07:42,710
So in the second attacking scenario, the API, as we discussed about the API security, this API was actually using local ID, which was being, again, part of the Google Identity Toolkit.

45
00:07:42,710 --> 00:07:47,350
The API was providing the local ID along with the username.

46
00:07:47,730 --> 00:07:57,930
So what I did was I tried to replace the local ID one with the local ID two and the username respectively.

47
00:07:58,290 --> 00:08:06,590
And my request was submitted and was requested, was approved and respond.

48
00:08:06,590 --> 00:08:10,770
And I got a response to that request successfully.

49
00:08:10,770 --> 00:08:23,590
So that means I can take over an account or I can post anything from a specific account by using the local ID and the username if known.

50
00:08:25,100 --> 00:08:33,530
So in the third attacking scenario, the API, the marketing API was used by the APK.

51
00:08:33,530 --> 00:08:39,090
So while reverse engineering the APK, I found this specific marketing API.

52
00:08:39,090 --> 00:08:47,470
And then when I Googled that marketing API, I discovered the domains, the subdomains that application were using it.

53
00:08:47,470 --> 00:08:57,870
So that increased my attacking surface for against that organization in a more broader perspective.

54
00:08:57,870 --> 00:09:07,250
And then I was able to access one of their internal portals which was used for the support perspective.

55
00:09:09,370 --> 00:09:17,010
Now I had found everything and found all of the vulnerabilities in this specific application.

56
00:09:17,010 --> 00:09:21,630
It was time to disclose it responsibly to the organization.

57
00:09:22,330 --> 00:09:26,350
So I reached out to their platform, their support platform.

58
00:09:26,350 --> 00:09:29,970
Again, I knew the internal portal they were using.

59
00:09:29,970 --> 00:09:41,950
So I reached out to their customer support and requested them to look into the vulnerabilities, but I just didn't submit those vulnerabilities on a public platform.

60
00:09:41,950 --> 00:09:53,530
Rather asked them for the email address or the support platform where I can post these vulnerabilities in a very secure way.

61
00:09:53,670 --> 00:09:59,150
And then they invited me to another platform.

62
00:09:59,270 --> 00:10:03,830
I submitted all the vulnerabilities, all the bugs to that platform.

63
00:10:04,210 --> 00:10:08,670
I received the response from the engineering team.

64
00:10:08,670 --> 00:10:10,970
Again, that take a lot of time.

65
00:10:11,030 --> 00:10:14,850
That, I guess, took around a month.

66
00:10:14,850 --> 00:10:23,790
But again, a response, a positive response from such organization was really appreciating.

67
00:10:24,830 --> 00:10:29,510
So I got this email from their head of platform engineering.

68
00:10:29,510 --> 00:10:45,530
And this was an unexpected moment for me because I wasn't expecting any kind of monetary support or any kind of monetary benefit in response to the bugs that I submitted.

69
00:10:45,750 --> 00:11:01,390
So I was really kind enough to their platform engineering team and their head of platform engineering for considering the vulnerabilities and acknowledging my efforts.

70
00:11:03,070 --> 00:11:12,930
So what is the conclusion of all of this exercise or all of the effort that we had invested?

71
00:11:13,390 --> 00:11:19,450
So when you are disclosing vulnerabilities to an organization, you should act responsibly.

72
00:11:19,450 --> 00:11:34,390
So let's say you are disclosing vulnerability to an organization that doesn't have any vulnerability disclosing program or a coordinated vulnerability disclosure program.

73
00:11:34,390 --> 00:11:38,330
You look for their engineering teams, their development teams.

74
00:11:38,450 --> 00:11:47,010
You can approach them in a very respectful manner and provide as much as detail as you can.

75
00:11:47,650 --> 00:11:49,630
Also respect the privacy.

76
00:11:49,630 --> 00:12:22,430
So let's say if you found out a vulnerability that is around insecure direct object reference or that revolves around insecure ways of accessing data, what you can do is create two accounts for yourself and then you can play with your both of the accounts and see if any of this has any vulnerability or bugs in it.

77
00:12:22,430 --> 00:12:29,360
And then you can submit that by claiming both of the accounts being used by you.

78
00:12:31,340 --> 00:12:39,720
Again, play within the boundaries, as discussed earlier in my talk.

79
00:12:40,790 --> 00:12:50,530
There are certain boundaries and there are certain responsibilities that lies on the shoulder of the information security researcher.

80
00:12:50,710 --> 00:12:55,070
So look through these boundaries and act responsibly.

81
00:12:55,070 --> 00:13:00,170
And then again, patience because that's what is needed the most.

82
00:13:06,810 --> 00:13:14,570
So there have been certain vulnerability disclosure programs out on the internet.

83
00:13:15,050 --> 00:13:26,150
Yes, we had has a really cool plugin for the Google Chrome, I guess, and for the Mozilla Firefox, you can integrate that.

84
00:13:26,150 --> 00:13:38,050
When you are visiting a website or an application, you can get the details for the vulnerability disclosure program.

85
00:13:38,250 --> 00:13:50,230
And even though if they are not available on these platforms, you can approach them to their email address they have specified in their usual security.txt folder.

86
00:13:51,330 --> 00:13:58,610
There are a lot of bug bounty platforms which support the vulnerability disclosure or the coordinated vulnerability disclosure programs.

87
00:13:58,610 --> 00:14:07,170
So you can approach these platforms as well and submit your vulnerabilities in an efficient way.

88
00:14:07,170 --> 00:14:17,690
And then again, as I discussed, the development or engineering department because they are the one who are developing the applications and they know the stuff.

89
00:14:19,570 --> 00:14:22,370
With that, I would like to thank everyone.

90
00:14:22,370 --> 00:14:25,250
Again, for joining in.

91
00:14:25,770 --> 00:14:30,230
Stay safe and hack the planet more responsibly.

92
00:14:30,590 --> 00:14:36,270
I'll be available around the Discord Red Team channel.

93
00:14:36,270 --> 00:14:43,990
So if you have any questions, please drop them in or you have my email address and Twitter account, The Handler.

94
00:14:44,030 --> 00:14:55,790
So you can share your concerns or the email, or I mean, you can share your concerns and your questions over the Twitter or Discord or whatever medium you would like to.

95
00:14:55,790 --> 00:14:57,090
Thank you so much.

96
00:14:57,090 --> 00:14:57,930
Goodbye.