start	end	text
0	1660	Thank you for joining my talk.
2660	4400	I guess some of you are having night time
4400	6560	and some of you are having day time,
6560	9520	but again, thank you for joining in.
10040	12360	I would like to thank the DEF CON Red Team Village
12360	16280	for providing me the opportunity to speak on the subject,
16280	18720	which is from discovery to disclosure.
22510	24370	So I do the cybersecurity stuff
24370	27190	for a financial institution here in Pakistan.
27530	31930	And when I'm done with my official responsibilities,
31930	36110	I do the security researching, which is one of my hobby.
36750	39450	Before the information security career,
39450	42010	I used to develop mobile applications,
42010	44330	web applications, and vice versa.
45790	48770	Mobile applications and IoT industry
48770	50390	have been really fascinating
51070	53890	and I look forward to learn more about them
54410	57790	as they are one of the growing industries.
57790	61870	And with the stuff that is growing,
61870	66450	it also has vulnerabilities or bugs or risk around it.
68790	72010	Today, my focus of talk would be Android application
72770	74690	and their controls.
75510	77770	Why Android applications?
77770	80250	Because commonly used by the people around
81030	82990	for the ease of access.
83130	86750	So when you are developing mobile applications,
86750	89590	let's say an iOS or an Android,
89590	91530	you are required to integrate API
92410	95250	because that helps you to fetch the dynamic data
95250	98730	or the data that is stored in the database.
98730	100770	So with the help of API,
100770	103270	which is actually a bridge between a database
104070	105510	and an application,
105510	107870	you are able to perform your operations
108670	110730	more smoothly and easily.
112710	115730	Let's talk about some mobile application security breaches
115730	118370	that happened earlier.
118770	123010	One of them was Zigna that faced a data breach
123010	126110	for around 200 million customers.
127290	131010	The British Airways recently, a year back,
131010	136710	faced a huge fine due to the data breach.
137190	141550	And there was this health application
142170	145650	which used to suggest the weight
146910	150050	or the calories you were taking in.
150050	156910	So let's say you need to record the calories
156910	160110	you have taken in for the dinner or for the lunch.
160110	165470	It would predict the weight for you.
165470	167690	So you can maintain it more easily.
168430	174990	And in the data breach, 150 million accounts were affected
176010	178030	and the data is still out there.
180570	183750	This year, there was a security misconfiguration
183750	185630	in Firebase databases,
185630	188930	which allowed the malicious actors or the users
189870	193810	that could pass a specific and a simple parameter
193810	198730	would allow them to look into the whole database
198730	201590	or the whole data into the database.
205300	207280	With the passage of time,
207280	209520	the vulnerabilities of Android applications
209520	213180	or the Android have been increasing year by year.
213180	218280	So let's say in 2009, we had five vulnerabilities.
218280	222680	And when we see 2016 and onwards,
222680	224940	we have a large amount of vulnerabilities
225480	228180	in Android and Android applications.
230020	232040	So how did I discover vulnerabilities
232040	235060	in one of the applications I was looking into?
235700	239340	So this specific application had around 1.5 million
239340	241240	of downloads on the App Store
242060	244480	with a great amount of reputation.
245240	248660	They had been providing premium services to their customers,
248660	250000	to their premium customers.
250000	254620	So let's say you need to modify the notification,
254620	256980	the time of the notification,
256980	261220	and customize the notification for the premium users
262160	264940	for if you are one of them,
264940	267140	that would be very easy for you.
268060	269980	If you want to send greeting cards
269980	276960	or cards with subject to a specific occasion,
276960	278620	you could have easily do that
278620	281300	by going to the specific function
282080	284620	and generating a specific greeting card
284620	286820	or the occasion card
287240	290160	and write down whatever stuff you want to.
293020	298210	So while looking into the application
298530	301130	through a technical perspective,
301130	303890	I found the application was using Firebase
303890	305670	for the data storage.
306310	309730	And they were using Google Cloud Platform
309730	313050	for their dynamic stuff,
313050	316590	or let's say the stuff they wanted to host.
317510	321190	And as well as the Google Identity Toolkit,
321190	323070	let's say if you are a user,
323070	326110	you want to register on this platform,
326110	329930	all of the identity and access management
329930	333430	were handled by the relying party,
333430	336970	which is also known as Google Identity Toolkit.
336970	340730	So this area had really fascinated me
340730	344570	and I decided to look more into this perspective.
345390	349390	So when I went into the Google Identity Toolkit,
349390	351150	there were a lot of functions
351810	354710	that were visible in their documentation.
354710	358050	I went to their whole documentation one by one
358050	362810	and tried every function on this application
363280	367930	and tried to find out which of the functions
367930	370450	are enabled by this application
370450	372710	and which of them are disabled.
373540	377190	So one of the function which says get account info
377880	379690	was really fascinating for me
379690	381510	and really interesting for me.
381510	385930	So let's say I wanted to find details for an account
385930	387810	if it is registered on the platform
387810	390930	or if it is not registered on the platform.
390930	395670	This specific function was able to return the details
395670	399630	for a specific account or for a specific email address
399630	403330	or for a number, if known.
404550	409070	So what I did is I searched for the organization emails
409610	412890	and one of them was the no reply email
412890	414090	that was not registered
415170	419210	and I found that to be available for the signup.
419210	423070	I signed up to that email address.
423130	426950	Again, it wasn't sending a verification token
427210	428430	to the email address
428430	433090	and allowed the users to log in directly to the application.
433110	435830	So I signed up through this email address
435830	438430	and I was logged in as a corporate user
438750	443690	with the same privileges a corporate user would have.
444810	448710	So in the second attacking scenario,
448710	453690	the API, as we discussed about the API security,
454230	458090	this API was actually using local ID,
458090	462710	which was being, again, part of the Google Identity Toolkit.
462710	467350	The API was providing the local ID along with the username.
467730	472550	So what I did was I tried to replace the local ID one
472550	477930	with the local ID two and the username respectively.
478290	481390	And my request was submitted
481390	486590	and was requested, was approved and respond.
486590	490770	And I got a response to that request successfully.
490770	494290	So that means I can take over an account
494290	498510	or I can post anything from a specific account
498510	501450	by using the local ID and the username
502040	503590	if known.
505100	507770	So in the third attacking scenario,
507770	513530	the API, the marketing API was used by the APK.
513530	515910	So while reverse engineering the APK,
515910	519090	I found this specific marketing API.
519090	522070	And then when I Googled that marketing API,
522070	525350	I discovered the domains, the subdomains
525350	527470	that application were using it.
527470	530490	So that increased my attacking surface
530810	533150	for against that organization
533790	537870	in a more broader perspective.
537870	541830	And then I was able to access one of their internal portals
542470	547250	which was used for the support perspective.
549370	551230	Now I had found everything
551230	553670	and found all of the vulnerabilities
554170	557010	in this specific application.
557010	559370	It was time to disclose it responsibly
559370	561630	to the organization.
562330	565070	So I reached out to their platform,
565070	566350	their support platform.
566350	569970	Again, I knew the internal portal they were using.
569970	573930	So I reached out to their customer support
573930	577990	and requested them to look into the vulnerabilities,
577990	580410	but I just didn't submit those vulnerabilities
580410	581950	on a public platform.
581950	584330	Rather asked them for the email address
584970	587830	or the support platform
587830	590750	where I can post these vulnerabilities
591550	593530	in a very secure way.
593670	599150	And then they invited me to another platform.
599270	601590	I submitted all the vulnerabilities,
601590	603830	all the bugs to that platform.
604210	608670	I received the response from the engineering team.
608670	610970	Again, that take a lot of time.
611030	614850	That, I guess, took around a month.
614850	618930	But again, a response, a positive response
618930	623790	from such organization was really appreciating.
624830	629510	So I got this email from their head of platform engineering.
629510	632470	And this was an unexpected moment for me
632470	636930	because I wasn't expecting any kind of monetary support
637450	640230	or any kind of monetary benefit
641230	645530	in response to the bugs that I submitted.
645750	647890	So I was really kind enough
647890	650690	to their platform engineering team
650690	652430	and their head of platform engineering
653390	655130	for considering the vulnerabilities
655970	661390	and acknowledging my efforts.
663070	666110	So what is the conclusion of all of this exercise
666110	672930	or all of the effort that we had invested?
673390	675610	So when you are disclosing vulnerabilities
675610	679450	to an organization, you should act responsibly.
679450	683590	So let's say you are disclosing vulnerability
685510	687870	to an organization that doesn't have
687870	691250	any vulnerability disclosing program
691250	694390	or a coordinated vulnerability disclosure program.
694390	696430	You look for their engineering teams,
696430	698330	their development teams.
698450	702430	You can approach them in a very respectful manner
703390	707010	and provide as much as detail as you can.
707650	709630	Also respect the privacy.
709630	712530	So let's say if you found out a vulnerability
713470	718930	that is around insecure direct object reference
719850	727470	or that revolves around insecure ways of accessing data,
727470	730350	what you can do is create two accounts for yourself
730630	734710	and then you can play with your both of the accounts
734970	739910	and see if any of this has any vulnerability
740410	742430	or bugs in it.
742430	745610	And then you can submit that by claiming
745860	749360	both of the accounts being used by you.
751340	753690	Again, play within the boundaries,
754280	759720	as discussed earlier in my talk.
760790	762230	There are certain boundaries
762230	764490	and there are certain responsibilities
764490	767330	that lies on the shoulder
767330	770530	of the information security researcher.
770710	775070	So look through these boundaries and act responsibly.
775070	776530	And then again, patience
776530	780170	because that's what is needed the most.
786810	791810	So there have been certain vulnerability disclosure programs
792410	794570	out on the internet.
795050	799170	Yes, we had has a really cool plugin
799170	802610	for the Google Chrome, I guess,
802610	806150	and for the Mozilla Firefox, you can integrate that.
806150	810670	When you are visiting a website or an application,
810670	814330	you can get the details
814830	818050	for the vulnerability disclosure program.
818250	820390	And even though if they are not available
820390	822350	on these platforms,
822350	825050	you can approach them to their email address
825050	830230	they have specified in their usual security.txt folder.
831330	833390	There are a lot of bug bounty platforms
833710	835670	which support the vulnerability disclosure
835670	838610	or the coordinated vulnerability disclosure programs.
838610	841390	So you can approach these platforms as well
841390	847170	and submit your vulnerabilities in an efficient way.
847170	849770	And then again, as I discussed,
849770	851990	the development or engineering department
851990	855470	because they are the one who are developing the applications
855810	857690	and they know the stuff.
859570	862370	With that, I would like to thank everyone.
862370	865250	Again, for joining in.
865770	870230	Stay safe and hack the planet more responsibly.
870590	876270	I'll be available around the Discord Red Team channel.
876270	878930	So if you have any questions, please drop them in
878930	882790	or you have my email address and Twitter account,
882790	883990	The Handler.
884030	887670	So you can share your concerns or the email,
887670	889950	or I mean, you can share your concerns
889950	893670	and your questions over the Twitter or Discord
893670	895790	or whatever medium you would like to.
895790	897090	Thank you so much.
897090	897930	Goodbye.