WEBVTT 00:00.000 --> 00:01.660 Thank you for joining my talk. 00:02.660 --> 00:09.520 I guess some of you are having night time and some of you are having day time, but again, thank you for joining in. 00:10.040 --> 00:18.720 I would like to thank the DEF CON Red Team Village for providing me the opportunity to speak on the subject, which is from discovery to disclosure. 00:22.510 --> 00:27.190 So I do the cybersecurity stuff for a financial institution here in Pakistan. 00:27.530 --> 00:36.110 And when I'm done with my official responsibilities, I do the security researching, which is one of my hobby. 00:36.750 --> 00:44.330 Before the information security career, I used to develop mobile applications, web applications, and vice versa. 00:45.790 --> 00:57.790 Mobile applications and IoT industry have been really fascinating and I look forward to learn more about them as they are one of the growing industries. 00:57.790 --> 01:06.450 And with the stuff that is growing, it also has vulnerabilities or bugs or risk around it. 01:08.790 --> 01:14.690 Today, my focus of talk would be Android application and their controls. 01:15.510 --> 01:17.770 Why Android applications? 01:17.770 --> 01:22.990 Because commonly used by the people around for the ease of access. 01:23.130 --> 01:38.730 So when you are developing mobile applications, let's say an iOS or an Android, you are required to integrate API because that helps you to fetch the dynamic data or the data that is stored in the database. 01:38.730 --> 01:50.730 So with the help of API, which is actually a bridge between a database and an application, you are able to perform your operations more smoothly and easily. 01:52.710 --> 01:58.370 Let's talk about some mobile application security breaches that happened earlier. 01:58.770 --> 02:06.110 One of them was Zigna that faced a data breach for around 200 million customers. 02:07.290 --> 02:16.710 The British Airways recently, a year back, faced a huge fine due to the data breach. 02:17.190 --> 02:30.050 And there was this health application which used to suggest the weight or the calories you were taking in. 02:30.050 --> 02:40.110 So let's say you need to record the calories you have taken in for the dinner or for the lunch. 02:40.110 --> 02:45.470 It would predict the weight for you. 02:45.470 --> 02:47.690 So you can maintain it more easily. 02:48.430 --> 02:58.030 And in the data breach, 150 million accounts were affected and the data is still out there. 03:00.570 --> 03:21.590 This year, there was a security misconfiguration in Firebase databases, which allowed the malicious actors or the users that could pass a specific and a simple parameter would allow them to look into the whole database or the whole data into the database. 03:25.300 --> 03:33.180 With the passage of time, the vulnerabilities of Android applications or the Android have been increasing year by year. 03:33.180 --> 03:38.280 So let's say in 2009, we had five vulnerabilities. 03:38.280 --> 03:48.180 And when we see 2016 and onwards, we have a large amount of vulnerabilities in Android and Android applications. 03:50.020 --> 03:55.060 So how did I discover vulnerabilities in one of the applications I was looking into? 03:55.700 --> 04:04.480 So this specific application had around 1.5 million of downloads on the App Store with a great amount of reputation. 04:05.240 --> 04:10.000 They had been providing premium services to their customers, to their premium customers. 04:10.000 --> 04:27.140 So let's say you need to modify the notification, the time of the notification, and customize the notification for the premium users for if you are one of them, that would be very easy for you. 04:28.060 --> 04:50.160 If you want to send greeting cards or cards with subject to a specific occasion, you could have easily do that by going to the specific function and generating a specific greeting card or the occasion card and write down whatever stuff you want to. 04:53.020 --> 05:05.670 So while looking into the application through a technical perspective, I found the application was using Firebase for the data storage. 05:06.310 --> 05:16.590 And they were using Google Cloud Platform for their dynamic stuff, or let's say the stuff they wanted to host. 05:17.510 --> 05:36.970 And as well as the Google Identity Toolkit, let's say if you are a user, you want to register on this platform, all of the identity and access management were handled by the relying party, which is also known as Google Identity Toolkit. 05:36.970 --> 05:44.570 So this area had really fascinated me and I decided to look more into this perspective. 05:45.390 --> 05:54.710 So when I went into the Google Identity Toolkit, there were a lot of functions that were visible in their documentation. 05:54.710 --> 06:12.710 I went to their whole documentation one by one and tried every function on this application and tried to find out which of the functions are enabled by this application and which of them are disabled. 06:13.540 --> 06:21.510 So one of the function which says get account info was really fascinating for me and really interesting for me. 06:21.510 --> 06:30.930 So let's say I wanted to find details for an account if it is registered on the platform or if it is not registered on the platform. 06:30.930 --> 06:43.330 This specific function was able to return the details for a specific account or for a specific email address or for a number, if known. 06:44.550 --> 06:59.210 So what I did is I searched for the organization emails and one of them was the no reply email that was not registered and I found that to be available for the signup. 06:59.210 --> 07:03.070 I signed up to that email address. 07:03.130 --> 07:13.090 Again, it wasn't sending a verification token to the email address and allowed the users to log in directly to the application. 07:13.110 --> 07:23.690 So I signed up through this email address and I was logged in as a corporate user with the same privileges a corporate user would have. 07:24.810 --> 07:42.710 So in the second attacking scenario, the API, as we discussed about the API security, this API was actually using local ID, which was being, again, part of the Google Identity Toolkit. 07:42.710 --> 07:47.350 The API was providing the local ID along with the username. 07:47.730 --> 07:57.930 So what I did was I tried to replace the local ID one with the local ID two and the username respectively. 07:58.290 --> 08:06.590 And my request was submitted and was requested, was approved and respond. 08:06.590 --> 08:10.770 And I got a response to that request successfully. 08:10.770 --> 08:23.590 So that means I can take over an account or I can post anything from a specific account by using the local ID and the username if known. 08:25.100 --> 08:33.530 So in the third attacking scenario, the API, the marketing API was used by the APK. 08:33.530 --> 08:39.090 So while reverse engineering the APK, I found this specific marketing API. 08:39.090 --> 08:47.470 And then when I Googled that marketing API, I discovered the domains, the subdomains that application were using it. 08:47.470 --> 08:57.870 So that increased my attacking surface for against that organization in a more broader perspective. 08:57.870 --> 09:07.250 And then I was able to access one of their internal portals which was used for the support perspective. 09:09.370 --> 09:17.010 Now I had found everything and found all of the vulnerabilities in this specific application. 09:17.010 --> 09:21.630 It was time to disclose it responsibly to the organization. 09:22.330 --> 09:26.350 So I reached out to their platform, their support platform. 09:26.350 --> 09:29.970 Again, I knew the internal portal they were using. 09:29.970 --> 09:41.950 So I reached out to their customer support and requested them to look into the vulnerabilities, but I just didn't submit those vulnerabilities on a public platform. 09:41.950 --> 09:53.530 Rather asked them for the email address or the support platform where I can post these vulnerabilities in a very secure way. 09:53.670 --> 09:59.150 And then they invited me to another platform. 09:59.270 --> 10:03.830 I submitted all the vulnerabilities, all the bugs to that platform. 10:04.210 --> 10:08.670 I received the response from the engineering team. 10:08.670 --> 10:10.970 Again, that take a lot of time. 10:11.030 --> 10:14.850 That, I guess, took around a month. 10:14.850 --> 10:23.790 But again, a response, a positive response from such organization was really appreciating. 10:24.830 --> 10:29.510 So I got this email from their head of platform engineering. 10:29.510 --> 10:45.530 And this was an unexpected moment for me because I wasn't expecting any kind of monetary support or any kind of monetary benefit in response to the bugs that I submitted. 10:45.750 --> 11:01.390 So I was really kind enough to their platform engineering team and their head of platform engineering for considering the vulnerabilities and acknowledging my efforts. 11:03.070 --> 11:12.930 So what is the conclusion of all of this exercise or all of the effort that we had invested? 11:13.390 --> 11:19.450 So when you are disclosing vulnerabilities to an organization, you should act responsibly. 11:19.450 --> 11:34.390 So let's say you are disclosing vulnerability to an organization that doesn't have any vulnerability disclosing program or a coordinated vulnerability disclosure program. 11:34.390 --> 11:38.330 You look for their engineering teams, their development teams. 11:38.450 --> 11:47.010 You can approach them in a very respectful manner and provide as much as detail as you can. 11:47.650 --> 11:49.630 Also respect the privacy. 11:49.630 --> 12:22.430 So let's say if you found out a vulnerability that is around insecure direct object reference or that revolves around insecure ways of accessing data, what you can do is create two accounts for yourself and then you can play with your both of the accounts and see if any of this has any vulnerability or bugs in it. 12:22.430 --> 12:29.360 And then you can submit that by claiming both of the accounts being used by you. 12:31.340 --> 12:39.720 Again, play within the boundaries, as discussed earlier in my talk. 12:40.790 --> 12:50.530 There are certain boundaries and there are certain responsibilities that lies on the shoulder of the information security researcher. 12:50.710 --> 12:55.070 So look through these boundaries and act responsibly. 12:55.070 --> 13:00.170 And then again, patience because that's what is needed the most. 13:06.810 --> 13:14.570 So there have been certain vulnerability disclosure programs out on the internet. 13:15.050 --> 13:26.150 Yes, we had has a really cool plugin for the Google Chrome, I guess, and for the Mozilla Firefox, you can integrate that. 13:26.150 --> 13:38.050 When you are visiting a website or an application, you can get the details for the vulnerability disclosure program. 13:38.250 --> 13:50.230 And even though if they are not available on these platforms, you can approach them to their email address they have specified in their usual security.txt folder. 13:51.330 --> 13:58.610 There are a lot of bug bounty platforms which support the vulnerability disclosure or the coordinated vulnerability disclosure programs. 13:58.610 --> 14:07.170 So you can approach these platforms as well and submit your vulnerabilities in an efficient way. 14:07.170 --> 14:17.690 And then again, as I discussed, the development or engineering department because they are the one who are developing the applications and they know the stuff. 14:19.570 --> 14:22.370 With that, I would like to thank everyone. 14:22.370 --> 14:25.250 Again, for joining in. 14:25.770 --> 14:30.230 Stay safe and hack the planet more responsibly. 14:30.590 --> 14:36.270 I'll be available around the Discord Red Team channel. 14:36.270 --> 14:43.990 So if you have any questions, please drop them in or you have my email address and Twitter account, The Handler. 14:44.030 --> 14:55.790 So you can share your concerns or the email, or I mean, you can share your concerns and your questions over the Twitter or Discord or whatever medium you would like to. 14:55.790 --> 14:57.090 Thank you so much. 14:57.090 --> 14:57.930 Goodbye.