1
00:00:00,150 --> 00:00:02,790
- So now this is Nikita Kurtin.

2
00:00:02,790 --> 00:00:07,467
He's going to talk about
"Default - the faults."

3
00:00:08,494 --> 00:00:11,661
(audience applauding)

4
00:00:15,300 --> 00:00:17,103
- So, hello everyone.

5
00:00:18,840 --> 00:00:22,050
Thank you for joining me here today.

6
00:00:22,050 --> 00:00:23,760
My name is Nikita Kurtin.

7
00:00:23,760 --> 00:00:27,483
I'm a software engineer
and a security researcher.

8
00:00:29,070 --> 00:00:31,890
And well, when I'm not researching

9
00:00:31,890 --> 00:00:32,850
or developing anything,

10
00:00:32,850 --> 00:00:33,810
usually you can find me

11
00:00:33,810 --> 00:00:36,480
training street workout, calisthenics.

12
00:00:36,480 --> 00:00:37,680
For example, in this picture,

13
00:00:37,680 --> 00:00:39,390
I'm doing Eiffel handstand

14
00:00:39,390 --> 00:00:42,483
in front of a Eiffel tower, here in Vegas.

15
00:00:44,670 --> 00:00:47,520
And today I want to
share with you some work.

16
00:00:47,520 --> 00:00:48,353
At the end of the field

17
00:00:48,353 --> 00:00:52,230
of the research of Android permissions,

18
00:00:52,230 --> 00:00:55,470
which I call "Default - the faults."

19
00:00:55,470 --> 00:00:59,370
As I found how to bypass
different permissions

20
00:00:59,370 --> 00:01:02,610
from different protection level,

21
00:01:02,610 --> 00:01:05,340
actually from all protection levels,

22
00:01:05,340 --> 00:01:08,373
using just default services in Android.

23
00:01:11,190 --> 00:01:15,780
So first of all, a
little bit of statistics.

24
00:01:15,780 --> 00:01:17,850
At the moment I was
making this presentation,

25
00:01:17,850 --> 00:01:21,300
I looked in the Google for
the last statistical data.

26
00:01:21,300 --> 00:01:26,300
I found that Android holds
72% of the market share

27
00:01:29,820 --> 00:01:32,370
of all smartphones in the world,

28
00:01:32,370 --> 00:01:34,500
which is a little less than
they have in the previous years.

29
00:01:34,500 --> 00:01:39,500
But the absolute number of
smartphones increased so much,

30
00:01:39,780 --> 00:01:41,190
that this is actually more

31
00:01:41,190 --> 00:01:42,540
than how it was previously.

32
00:01:43,530 --> 00:01:46,590
Android OS has 32 distributions

33
00:01:46,590 --> 00:01:49,530
or as it called officially, API levels.

34
00:01:49,530 --> 00:01:54,530
And it runs on over 3
billion active devices.

35
00:01:55,080 --> 00:01:57,810
3 billion, think about it.

36
00:01:57,810 --> 00:01:58,650
This is me, by the way,

37
00:01:58,650 --> 00:01:59,483
trying to imagine

38
00:01:59,483 --> 00:02:02,283
how 3 billion active devices looks like.

39
00:02:04,770 --> 00:02:06,780
So why it's important.

40
00:02:06,780 --> 00:02:09,000
You can imagine that everything

41
00:02:09,000 --> 00:02:10,410
that is happening in Android,

42
00:02:10,410 --> 00:02:11,610
every technique that works there,

43
00:02:11,610 --> 00:02:15,840
every bug, has a very huge impact.

44
00:02:15,840 --> 00:02:17,910
Because of the nature of Android,

45
00:02:17,910 --> 00:02:20,880
there is no particular version

46
00:02:20,880 --> 00:02:22,680
or a particular device model

47
00:02:22,680 --> 00:02:25,140
that dominates the world completely.

48
00:02:25,140 --> 00:02:29,520
Instead, it's distributed
across multiple API levels,

49
00:02:29,520 --> 00:02:31,440
multiple device models.

50
00:02:31,440 --> 00:02:34,680
But even if you take one
particular combination

51
00:02:34,680 --> 00:02:36,660
of version and device model,

52
00:02:36,660 --> 00:02:39,900
you will, let's say that has 1%.

53
00:02:39,900 --> 00:02:43,770
Still 1% of that is tens of millions.

54
00:02:43,770 --> 00:02:46,203
So this is how the impact is heavy.

55
00:02:47,790 --> 00:02:50,796
So let's dive into permission mechanism.

56
00:02:50,796 --> 00:02:53,370
Now, because there were a lot of changes

57
00:02:53,370 --> 00:02:54,600
in the permission mechanism

58
00:02:54,600 --> 00:02:56,640
in the last few years,

59
00:02:56,640 --> 00:02:59,100
I'm trying to focus on this presentation

60
00:02:59,100 --> 00:03:02,610
in the most solid concepts.

61
00:03:02,610 --> 00:03:04,050
So, first of all,

62
00:03:04,050 --> 00:03:05,670
all Android permissions can be divided

63
00:03:05,670 --> 00:03:07,620
into three permission types

64
00:03:07,620 --> 00:03:09,840
or categories, if you wish.

65
00:03:09,840 --> 00:03:13,500
First, it's Install-time permissions.

66
00:03:13,500 --> 00:03:16,440
Now Install-time permissions basically

67
00:03:16,440 --> 00:03:19,170
permission that enabled

68
00:03:19,170 --> 00:03:21,810
right after the application
is installed on the device.

69
00:03:21,810 --> 00:03:24,660
So you can say that the
allowance of this permission

70
00:03:24,660 --> 00:03:26,853
is the action of installation.

71
00:03:28,290 --> 00:03:31,770
Above that, there is a Runtime permission

72
00:03:31,770 --> 00:03:34,470
from dangerous protection level.

73
00:03:34,470 --> 00:03:36,003
And as the name suggests,

74
00:03:36,900 --> 00:03:40,710
this permission protect the
more dangerous abilities,

75
00:03:40,710 --> 00:03:43,443
the more serious resources.

76
00:03:44,760 --> 00:03:47,070
Such a permission, it is not enabled

77
00:03:47,070 --> 00:03:49,680
right after application is
installed on the device.

78
00:03:49,680 --> 00:03:52,350
Instead, application needs to check

79
00:03:52,350 --> 00:03:57,300
whether the permission that allow us

80
00:03:57,300 --> 00:04:00,450
to do the access, the ability it needs,

81
00:04:00,450 --> 00:04:03,240
or the resource is allowed

82
00:04:03,240 --> 00:04:06,060
at that particular moment at runtime.

83
00:04:06,060 --> 00:04:07,170
And if not,

84
00:04:07,170 --> 00:04:10,140
then it will trigger the built-in alert,

85
00:04:10,140 --> 00:04:11,250
where the user can either

86
00:04:11,250 --> 00:04:13,953
allow this permission, or deny.

87
00:04:15,090 --> 00:04:17,010
And to be even more precise,

88
00:04:17,010 --> 00:04:19,230
actually, there is smaller category.

89
00:04:19,230 --> 00:04:23,130
In that of very few permissions,

90
00:04:23,130 --> 00:04:25,500
for example, location permission.

91
00:04:25,500 --> 00:04:29,100
In that case, when the alert is triggered,

92
00:04:29,100 --> 00:04:32,430
then user can not just allow
or deny the permission,

93
00:04:32,430 --> 00:04:34,893
but also allow for one-time usage.

94
00:04:35,790 --> 00:04:37,920
Anyway, above that,

95
00:04:37,920 --> 00:04:40,650
there is the top highest protection level

96
00:04:40,650 --> 00:04:43,140
called special system permissions.

97
00:04:43,140 --> 00:04:45,360
And this is like very unique

98
00:04:45,360 --> 00:04:47,220
and very rare permissions.

99
00:04:47,220 --> 00:04:50,220
They are intended for
system level interaction,

100
00:04:50,220 --> 00:04:54,273
and their job is to protect
the most powerful actions.

101
00:04:55,140 --> 00:04:59,490
And for that reason, it cannot be allowed

102
00:04:59,490 --> 00:05:00,570
from the application context.

103
00:05:00,570 --> 00:05:01,680
The user has actually need to go

104
00:05:01,680 --> 00:05:03,630
outside of the application context

105
00:05:03,630 --> 00:05:05,010
to the advanced settings,

106
00:05:05,010 --> 00:05:07,710
and enable this permission

107
00:05:07,710 --> 00:05:10,080
for that particular application

108
00:05:10,080 --> 00:05:12,573
explicitly in advanced settings.

109
00:05:15,300 --> 00:05:17,073
Now from the API perspective,

110
00:05:18,150 --> 00:05:20,670
all permissions that
application wants to use

111
00:05:20,670 --> 00:05:22,680
from all protection levels,

112
00:05:22,680 --> 00:05:25,860
must to be declared in Manifest,

113
00:05:25,860 --> 00:05:27,963
which is basically an XML file.

114
00:05:28,830 --> 00:05:30,270
Now, in this example,

115
00:05:30,270 --> 00:05:33,900
you can see a list of
different permissions

116
00:05:33,900 --> 00:05:36,030
that application use.

117
00:05:36,030 --> 00:05:38,220
So some of them from a
normal protection level,

118
00:05:38,220 --> 00:05:40,350
some of them from a
dangerous protection level,

119
00:05:40,350 --> 00:05:42,600
and some from special system permission.

120
00:05:42,600 --> 00:05:43,433
But you can see that

121
00:05:43,433 --> 00:05:47,190
all of them appear in the AndroidManifest.

122
00:05:47,190 --> 00:05:48,120
If they're not declared there,

123
00:05:48,120 --> 00:05:49,410
they cannot be used at all.

124
00:05:49,410 --> 00:05:51,690
This is like the most basic thing

125
00:05:51,690 --> 00:05:54,213
in the permission mechanism.

126
00:05:55,470 --> 00:05:56,550
Now, because of that,

127
00:05:56,550 --> 00:05:59,100
since all the permissions
that application is using,

128
00:05:59,100 --> 00:06:00,420
must be declared in Manifest,

129
00:06:00,420 --> 00:06:02,820
that makes it very easy to manage,

130
00:06:02,820 --> 00:06:05,430
and very easy to check

131
00:06:05,430 --> 00:06:06,720
which permissions are used.

132
00:06:06,720 --> 00:06:09,060
This is how, when you are uploading

133
00:06:09,060 --> 00:06:11,190
your application to Google Play Store,

134
00:06:11,190 --> 00:06:13,080
Google Play Store know
which permissions are used.

135
00:06:13,080 --> 00:06:15,480
Or when the application is
installed on the device,

136
00:06:15,480 --> 00:06:17,940
it's how Play Protect can scan,

137
00:06:17,940 --> 00:06:19,890
extract the Manifest,

138
00:06:19,890 --> 00:06:22,143
and know exactly which
permissions are used,

139
00:06:22,980 --> 00:06:26,760
and obviously any other
security external tool

140
00:06:26,760 --> 00:06:28,620
doing exactly the same thing.

141
00:06:28,620 --> 00:06:29,970
So before you download the app,

142
00:06:29,970 --> 00:06:32,250
you can see which permissions are used.

143
00:06:32,250 --> 00:06:33,600
For example, on the screenshot,

144
00:06:33,600 --> 00:06:36,480
we can see that this application is using

145
00:06:36,480 --> 00:06:38,550
this list of permissions.

146
00:06:38,550 --> 00:06:40,917
And obviously, the more permissions

147
00:06:40,917 --> 00:06:42,990
the application is using,

148
00:06:42,990 --> 00:06:44,610
or the higher protection level

149
00:06:44,610 --> 00:06:47,490
of these permissions are,

150
00:06:47,490 --> 00:06:51,600
basically it means that this
application can do more thing.

151
00:06:51,600 --> 00:06:53,750
The more things it can
do, more privileged.

152
00:06:56,070 --> 00:06:58,830
But everything I said until now,

153
00:06:58,830 --> 00:07:00,660
this is just the documented part.

154
00:07:00,660 --> 00:07:03,783
Now the undocumented part ahead.

155
00:07:06,060 --> 00:07:07,650
Below that, there is something

156
00:07:07,650 --> 00:07:09,180
I call default protection level,

157
00:07:09,180 --> 00:07:11,340
or default permissions.

158
00:07:11,340 --> 00:07:12,720
It's not an official name for that.

159
00:07:12,720 --> 00:07:14,850
It's just the way I call it.

160
00:07:14,850 --> 00:07:15,990
But the idea is that,

161
00:07:15,990 --> 00:07:17,700
default permissions is basically

162
00:07:17,700 --> 00:07:20,010
all these magical permissions,

163
00:07:20,010 --> 00:07:22,230
which you don't need to declare anywhere.

164
00:07:22,230 --> 00:07:24,330
You don't need to get
approval from the user.

165
00:07:24,330 --> 00:07:25,410
They're just there.

166
00:07:25,410 --> 00:07:27,810
You just need to know how to use them.

167
00:07:27,810 --> 00:07:28,740
And today I'm gonna show you

168
00:07:28,740 --> 00:07:31,260
how we use such default permissions

169
00:07:31,260 --> 00:07:33,540
to bypass and get the access

170
00:07:33,540 --> 00:07:35,340
for resources and abilities

171
00:07:35,340 --> 00:07:37,443
that protected by real permissions.

172
00:07:38,880 --> 00:07:41,790
So, first example is permission

173
00:07:41,790 --> 00:07:44,690
from a normal protection level
called internet permission.

174
00:07:45,690 --> 00:07:46,710
As the name suggest,

175
00:07:46,710 --> 00:07:48,840
internet permission is protecting

176
00:07:48,840 --> 00:07:50,430
the access for the internet.

177
00:07:50,430 --> 00:07:53,910
So if you wanna send URL request,

178
00:07:53,910 --> 00:07:56,520
then you obviously need
internet permission.

179
00:07:56,520 --> 00:07:57,920
You cannot do it without it.

180
00:07:59,400 --> 00:08:01,860
So I created a few video recordings

181
00:08:01,860 --> 00:08:04,560
to explain every concept.

182
00:08:04,560 --> 00:08:06,810
So how we can understand the setup.

183
00:08:06,810 --> 00:08:09,270
Here, we can see the Android device.

184
00:08:09,270 --> 00:08:11,400
I'm using a virtual Android device,

185
00:08:11,400 --> 00:08:13,920
just for simplicity of the presentation.

186
00:08:13,920 --> 00:08:15,750
Obviously the same things can work

187
00:08:15,750 --> 00:08:17,373
on the real devices as well.

188
00:08:18,900 --> 00:08:22,350
So here we can see the logs
of the Android, and the code.

189
00:08:22,350 --> 00:08:25,680
In this setup, I created
basically small Node.js server,

190
00:08:25,680 --> 00:08:28,890
which will receive the
request from the Android

191
00:08:28,890 --> 00:08:30,660
and then respond with some random number.

192
00:08:30,660 --> 00:08:34,470
This is how we can see that
the basically POC idea,

193
00:08:34,470 --> 00:08:36,990
just to prove the concept that it works.

194
00:08:36,990 --> 00:08:38,793
So let's see the video.

195
00:08:40,020 --> 00:08:41,280
Something is happening.

196
00:08:41,280 --> 00:08:42,510
Android is sending request.

197
00:08:42,510 --> 00:08:44,220
We can see it in the logs.

198
00:08:44,220 --> 00:08:46,680
And some random number,

199
00:08:46,680 --> 00:08:49,290
which we can see also in
logs of the server, right?

200
00:08:49,290 --> 00:08:52,380
Was received from the
server by the Android.

201
00:08:52,380 --> 00:08:53,790
And why it worked?

202
00:08:53,790 --> 00:08:54,990
This is the normal behavior.

203
00:08:54,990 --> 00:08:55,823
Why it worked?

204
00:08:55,823 --> 00:08:57,660
Because the application
has internal permission.

205
00:08:57,660 --> 00:08:59,643
Makes sense, nothing special.

206
00:09:02,580 --> 00:09:04,650
So what will happen

207
00:09:04,650 --> 00:09:07,950
when the application
is attempting to access

208
00:09:07,950 --> 00:09:09,630
something that is
protected with permission?

209
00:09:09,630 --> 00:09:12,300
In this case, exactly the same thing.

210
00:09:12,300 --> 00:09:14,553
Without the permission, in that case,

211
00:09:15,990 --> 00:09:17,040
application is crashing.

212
00:09:17,040 --> 00:09:19,470
We see this built-in alert.

213
00:09:19,470 --> 00:09:20,430
And why it happened,

214
00:09:20,430 --> 00:09:22,830
because there is a security exception.

215
00:09:22,830 --> 00:09:24,063
We can see it here.

216
00:09:24,930 --> 00:09:26,940
Permission denied.

217
00:09:26,940 --> 00:09:28,890
You don't have the needed permission

218
00:09:28,890 --> 00:09:30,690
to perform this action,

219
00:09:30,690 --> 00:09:32,790
'cause you can see I removed
it from the Manifest.

220
00:09:32,790 --> 00:09:34,953
No permissions at all.

221
00:09:36,120 --> 00:09:38,490
But now, let's see the bypass.

222
00:09:38,490 --> 00:09:41,010
Again, the same setup.

223
00:09:41,010 --> 00:09:46,010
Android virtual device, Android
logs, and server side logs.

224
00:09:46,260 --> 00:09:47,910
So something is happening.

225
00:09:47,910 --> 00:09:49,560
We can see logs from both side.

226
00:09:49,560 --> 00:09:51,720
There is a communication.

227
00:09:51,720 --> 00:09:54,663
We can see the prints on the Android logs.

228
00:09:55,890 --> 00:09:58,620
The request was sent from the Android,

229
00:09:58,620 --> 00:10:00,390
as we can see it here.

230
00:10:00,390 --> 00:10:01,437
It's coming from here.

231
00:10:01,437 --> 00:10:04,087
And we can see the random
number that's also received

232
00:10:05,430 --> 00:10:08,130
from the server by the Android.

233
00:10:08,130 --> 00:10:09,600
And we can see the SecretSecret string,

234
00:10:09,600 --> 00:10:11,850
which I sent from the
Android to the server side.

235
00:10:11,850 --> 00:10:14,100
So 2 way internet communication work.

236
00:10:14,100 --> 00:10:17,100
And this is the Node.js server code.

237
00:10:17,100 --> 00:10:18,720
We can see how the data is received,

238
00:10:18,720 --> 00:10:21,000
and how it created the random number.

239
00:10:21,000 --> 00:10:22,263
Very simple code.

240
00:10:23,760 --> 00:10:25,110
And in addition to that,

241
00:10:25,110 --> 00:10:28,890
I also send scheme aaaa

242
00:10:28,890 --> 00:10:31,140
and host bbbb params,

243
00:10:31,140 --> 00:10:33,393
which also received by the server.

244
00:10:35,280 --> 00:10:36,210
And why I did that,

245
00:10:36,210 --> 00:10:39,090
because this is the
custom URI configurations

246
00:10:39,090 --> 00:10:43,080
of my application under
the category BROWSABLE.

247
00:10:43,080 --> 00:10:44,040
And we can see here,

248
00:10:44,040 --> 00:10:47,763
that this POC works
without permissions at all.

249
00:10:49,110 --> 00:10:49,943
Okay?

250
00:10:51,270 --> 00:10:53,040
So how did it work?

251
00:10:53,040 --> 00:10:55,200
I use Implicit Intent,

252
00:10:55,200 --> 00:10:59,100
which is a default service
with default action view.

253
00:10:59,100 --> 00:11:02,370
And in Android, when you're
creating Implicit Intent

254
00:11:02,370 --> 00:11:03,570
with a default action,

255
00:11:03,570 --> 00:11:06,720
you basically give the
Android ability to decide

256
00:11:06,720 --> 00:11:08,270
who is the receiving component.

257
00:11:09,450 --> 00:11:10,860
And how it does it?

258
00:11:10,860 --> 00:11:13,260
It basically checks the URI.

259
00:11:13,260 --> 00:11:15,690
So I'm abusing this functionality,

260
00:11:15,690 --> 00:11:17,730
and I'm giving the URI

261
00:11:17,730 --> 00:11:21,420
of a default deeplink
format of Chrome browser.

262
00:11:21,420 --> 00:11:24,330
And I'm injecting the URL inside the URI,

263
00:11:24,330 --> 00:11:25,740
which basically triggered the browser

264
00:11:25,740 --> 00:11:27,840
to send the request for me.

265
00:11:27,840 --> 00:11:30,150
And then I receive the data back

266
00:11:30,150 --> 00:11:34,260
using exactly the same
technique, but vice versa.

267
00:11:34,260 --> 00:11:36,450
because I'm giving the
custom URI configuration

268
00:11:36,450 --> 00:11:37,530
of my own application

269
00:11:37,530 --> 00:11:38,980
when it's sent to the server.

270
00:11:40,230 --> 00:11:42,270
So how I created the payload.

271
00:11:42,270 --> 00:11:45,960
I basically downloaded the Chrome APK,

272
00:11:45,960 --> 00:11:47,820
extracted the Manifest.

273
00:11:47,820 --> 00:11:52,380
I can see they're the unique
scheme, Google Chrome,

274
00:11:52,380 --> 00:11:55,020
so I can know how to
trigger Chrome browser

275
00:11:55,020 --> 00:11:56,580
to open an Android.

276
00:11:56,580 --> 00:11:59,910
Then I looked in the decompiled code,

277
00:11:59,910 --> 00:12:01,770
and I founded the implementation of that.

278
00:12:01,770 --> 00:12:04,890
So I can see that scheme, Google Chrome,

279
00:12:04,890 --> 00:12:07,020
with the host navigate,

280
00:12:07,020 --> 00:12:09,840
receives a query param URL.

281
00:12:09,840 --> 00:12:12,963
So we can inject URL inside the URI,

282
00:12:14,190 --> 00:12:16,950
and that will trigger the
browser to send the request.

283
00:12:16,950 --> 00:12:19,620
So this is how I'm
creating the payload URI

284
00:12:19,620 --> 00:12:21,780
with Google Chrome scheme.

285
00:12:21,780 --> 00:12:25,590
Host navigate takes the query param URL.

286
00:12:25,590 --> 00:12:26,550
This is my URL.

287
00:12:26,550 --> 00:12:29,400
I'm giving the address
of my Node.js server

288
00:12:29,400 --> 00:12:32,820
with the additional query params,

289
00:12:32,820 --> 00:12:35,190
scheme aaaa and host bbbb.

290
00:12:35,190 --> 00:12:37,050
Obviously it can be anything else.

291
00:12:37,050 --> 00:12:39,180
It's just for the
simplicity of presentation.

292
00:12:39,180 --> 00:12:40,590
But as you can see,

293
00:12:40,590 --> 00:12:42,300
this is the custom URI configuration

294
00:12:42,300 --> 00:12:45,240
of my application under
category browsable.

295
00:12:45,240 --> 00:12:48,390
Now, category browsable
basically means that

296
00:12:48,390 --> 00:12:50,910
this link can be triggered
from the browser.

297
00:12:50,910 --> 00:12:55,083
The browser can communicate
back to the application.

298
00:12:56,730 --> 00:13:00,630
So the Node.js server
receives the request,

299
00:13:00,630 --> 00:13:04,290
extract the scheme and
host from the request,

300
00:13:04,290 --> 00:13:08,670
and uses to create dynamically,
link on that webpage.

301
00:13:08,670 --> 00:13:12,033
And then use JavaScript
to trigger this link.

302
00:13:13,350 --> 00:13:16,890
So let's see the whole flow over a diagram

303
00:13:16,890 --> 00:13:18,930
to make it completely clear.

304
00:13:18,930 --> 00:13:21,330
Application is sent Implicit Intent

305
00:13:21,330 --> 00:13:23,100
with the Chrome URI

306
00:13:23,100 --> 00:13:26,163
that is wrapping our custom URI.

307
00:13:27,360 --> 00:13:29,760
Android API recognize the Chrome URI

308
00:13:29,760 --> 00:13:33,540
and open the browser, the Chrome browser.

309
00:13:33,540 --> 00:13:37,020
Chrome browser extracting
the URL from the URI

310
00:13:37,020 --> 00:13:40,590
and sending the URL request to our server.

311
00:13:40,590 --> 00:13:43,320
Server receiving the request,

312
00:13:43,320 --> 00:13:45,150
processing the request,

313
00:13:45,150 --> 00:13:46,890
unwrap the custom URI from it,

314
00:13:46,890 --> 00:13:51,540
and creates the URI link
dynamically on that webpage.

315
00:13:51,540 --> 00:13:54,510
And then use the JavaScript
to trigger the browser

316
00:13:54,510 --> 00:13:56,280
to use this link,

317
00:13:56,280 --> 00:13:58,560
which goes back to the Android API,

318
00:13:58,560 --> 00:14:01,380
that checks who is the
receiving component.

319
00:14:01,380 --> 00:14:04,290
And the receiving component
is again, our application.

320
00:14:04,290 --> 00:14:07,960
And this is how I have the
2 way internet communication

321
00:14:08,820 --> 00:14:10,950
without internet permission at all.

322
00:14:10,950 --> 00:14:11,900
Pretty cool, right?

323
00:14:12,805 --> 00:14:16,410
(audience applauding)

324
00:14:16,410 --> 00:14:17,243
Thank you.

325
00:14:18,870 --> 00:14:22,710
Next, system alert window permission.

326
00:14:22,710 --> 00:14:23,730
This permission is coming

327
00:14:23,730 --> 00:14:27,180
from the top highest protection level,

328
00:14:27,180 --> 00:14:28,563
special system permissions.

329
00:14:29,580 --> 00:14:32,940
This permission is very unique.

330
00:14:32,940 --> 00:14:35,820
It is intended for a system
level interaction with the user.

331
00:14:35,820 --> 00:14:37,410
And what it allows you to do,

332
00:14:37,410 --> 00:14:41,160
is create an overlay that
will appear above any app,

333
00:14:41,160 --> 00:14:44,520
and above any view in the system.

334
00:14:44,520 --> 00:14:47,550
So you can imagine why it
consider highly sensitive.

335
00:14:47,550 --> 00:14:51,660
Because for example, there
is, let's say Gmail screen,

336
00:14:51,660 --> 00:14:53,880
and you can create your
own screen of Gmail

337
00:14:53,880 --> 00:14:56,100
and cover it completely,

338
00:14:56,100 --> 00:14:58,173
or cover a part of it, for example.

339
00:14:59,460 --> 00:15:01,410
Now, like I explained in the beginning,

340
00:15:02,790 --> 00:15:05,190
every permission must to be
declared in the Manifest,

341
00:15:05,190 --> 00:15:06,390
which application is using.

342
00:15:06,390 --> 00:15:10,950
So this is how any security tool

343
00:15:10,950 --> 00:15:12,960
can scan the application

344
00:15:12,960 --> 00:15:14,280
and know which permissions are used.

345
00:15:14,280 --> 00:15:15,420
So all of these tools,

346
00:15:15,420 --> 00:15:18,270
they are very much aware of
the permission mechanism.

347
00:15:18,270 --> 00:15:20,280
So obviously, they know exactly

348
00:15:20,280 --> 00:15:22,680
which permissions are
the most privileged ones.

349
00:15:22,680 --> 00:15:26,100
So if such a privileged
permission appears there,

350
00:15:26,100 --> 00:15:27,420
they detect it immediately.

351
00:15:27,420 --> 00:15:29,520
And the suspiciousness of this application

352
00:15:29,520 --> 00:15:31,323
automatically increased.

353
00:15:33,090 --> 00:15:35,280
But even if the application

354
00:15:35,280 --> 00:15:37,350
which are very highly privileged,

355
00:15:37,350 --> 00:15:42,350
permissions are uploaded
to the Google Play Store.

356
00:15:42,450 --> 00:15:45,390
And let's say, successfully downloaded

357
00:15:45,390 --> 00:15:46,500
and installed to the device,

358
00:15:46,500 --> 00:15:48,510
and then launched on the device.

359
00:15:48,510 --> 00:15:50,130
Because it's a special system permission,

360
00:15:50,130 --> 00:15:52,170
it is not enabled yet.

361
00:15:52,170 --> 00:15:53,520
Actually the user need to go

362
00:15:53,520 --> 00:15:55,533
outside of the application context,

363
00:15:56,370 --> 00:15:59,340
and perform some external steps

364
00:15:59,340 --> 00:16:02,883
in the advanced system settings.

365
00:16:04,860 --> 00:16:06,813
Let's see how it works normally.

366
00:16:07,800 --> 00:16:09,333
Like in any case,

367
00:16:11,160 --> 00:16:14,820
first, the application
declared in the Manifest.

368
00:16:14,820 --> 00:16:17,280
But since it's a special
system permission,

369
00:16:17,280 --> 00:16:20,880
the user needs to go externally
to the advanced settings,

370
00:16:20,880 --> 00:16:22,650
either from the setting screen,

371
00:16:22,650 --> 00:16:25,110
or from the shortcut from app info

372
00:16:25,110 --> 00:16:26,103
like I do it here.

373
00:16:27,270 --> 00:16:30,510
And you can see that in that case,

374
00:16:30,510 --> 00:16:35,510
there is completely separate
screen just for that.

375
00:16:36,240 --> 00:16:37,710
Like a dedicated screen,

376
00:16:37,710 --> 00:16:40,020
just for this particular permission

377
00:16:40,020 --> 00:16:42,870
for that specific application.

378
00:16:42,870 --> 00:16:45,780
And the user can either
enable or disable it.

379
00:16:45,780 --> 00:16:47,910
And the Android states very clearly here

380
00:16:47,910 --> 00:16:49,500
as you can see.

381
00:16:49,500 --> 00:16:51,300
Hopefully you can read it from there,

382
00:16:51,300 --> 00:16:54,360
that user needs to be aware

383
00:16:54,360 --> 00:16:56,940
that this is a very,
very serious permission,

384
00:16:56,940 --> 00:16:58,710
because it will allow this application

385
00:16:58,710 --> 00:17:00,760
to create the views above any other apps.

386
00:17:03,360 --> 00:17:05,430
But like I said, we're gonna
bypass everything, right?

387
00:17:05,430 --> 00:17:08,100
So, I found that exactly the same ability

388
00:17:08,100 --> 00:17:11,643
can be achieved by a default
service called Toast.

389
00:17:14,190 --> 00:17:17,643
Now, Toast is a very interesting service.

390
00:17:18,840 --> 00:17:20,160
Originally it was created

391
00:17:20,160 --> 00:17:25,160
to show just small text
messages, small popups,

392
00:17:27,810 --> 00:17:29,910
with showing some small text.

393
00:17:29,910 --> 00:17:33,420
And it was created in the first API level.

394
00:17:33,420 --> 00:17:34,470
And today, like I said

395
00:17:34,470 --> 00:17:35,670
in the beginning of the presentation,

396
00:17:35,670 --> 00:17:38,610
there are 32 API levels.

397
00:17:38,610 --> 00:17:42,390
Means that this service is available

398
00:17:42,390 --> 00:17:46,620
on all API levels in Android.

399
00:17:46,620 --> 00:17:48,540
So if you remember that big number,

400
00:17:48,540 --> 00:17:50,250
3 billion active devices,

401
00:17:50,250 --> 00:17:53,013
this service works on every one of them.

402
00:17:55,080 --> 00:17:59,523
So I noted that, because of
the nature of this service,

403
00:18:00,540 --> 00:18:03,090
it doesn't matter how you call it,

404
00:18:03,090 --> 00:18:06,600
how you invoke a creation
of the view with the Toast.

405
00:18:06,600 --> 00:18:09,330
It always appear on top of everything,

406
00:18:09,330 --> 00:18:11,103
because this is just how it works.

407
00:18:12,150 --> 00:18:13,320
But in addition to that,

408
00:18:13,320 --> 00:18:16,470
I also noticed that it can be triggered

409
00:18:16,470 --> 00:18:20,250
by any application with
no permissions at all,

410
00:18:20,250 --> 00:18:23,350
as opposed completely to the
special system permission

411
00:18:24,214 --> 00:18:25,203
that it uses.

412
00:18:26,520 --> 00:18:29,910
And third thing, very interesting thing,

413
00:18:29,910 --> 00:18:33,180
as I say, last but not least, right?

414
00:18:33,180 --> 00:18:35,630
Toast views, they don't
receive focus by default.

415
00:18:38,010 --> 00:18:39,873
So I asked myself,

416
00:18:41,130 --> 00:18:43,410
is this service when I
creating views with that,

417
00:18:43,410 --> 00:18:46,770
is it really limited for
a small text messages?

418
00:18:46,770 --> 00:18:48,570
And I found that it is not.

419
00:18:48,570 --> 00:18:51,570
You can actually
customize completed views,

420
00:18:51,570 --> 00:18:56,370
and they can show whatever
you want, wherever you want.

421
00:18:56,370 --> 00:18:58,680
So let's see this small example.

422
00:18:58,680 --> 00:19:03,090
The simplest Toast example
will look something like that.

423
00:19:03,090 --> 00:19:05,400
Probably Android users recognized already.

424
00:19:05,400 --> 00:19:08,160
But you can also show images with that.

425
00:19:08,160 --> 00:19:10,653
You can also show videos with that.

426
00:19:13,710 --> 00:19:17,463
You can even load web content
with a web view with that,

427
00:19:18,420 --> 00:19:21,813
and you can even cover the
entire screen with that.

428
00:19:26,580 --> 00:19:28,117
So knowing that, I ask myself,

429
00:19:28,117 --> 00:19:32,157
"Okay, I can show whatever
I want wherever I want."

430
00:19:33,180 --> 00:19:34,560
Does it have some limitations?

431
00:19:34,560 --> 00:19:37,653
But Toast has a limitation,
appearance duration.

432
00:19:38,610 --> 00:19:40,050
You cannot, for example, say,

433
00:19:40,050 --> 00:19:42,750
show this Toast view for
two and a half minutes.

434
00:19:42,750 --> 00:19:44,610
It just doesn't work this way.

435
00:19:44,610 --> 00:19:47,910
Instead you need to pass one
of these constant values,

436
00:19:47,910 --> 00:19:50,013
either LENGTH_SHORT or LENGTH_LONG.

437
00:19:51,480 --> 00:19:52,650
LENGTH_SHORT will make it appear

438
00:19:52,650 --> 00:19:54,000
approximately for two seconds,

439
00:19:54,000 --> 00:19:56,370
and LENGTH_LONG makes it appear

440
00:19:56,370 --> 00:19:57,660
for approximately four secs,

441
00:19:57,660 --> 00:19:59,823
and then it disappears.

442
00:20:01,590 --> 00:20:04,380
Actually exact time can be different

443
00:20:04,380 --> 00:20:05,370
between different devices,

444
00:20:05,370 --> 00:20:07,653
but this is pretty much accurate.

445
00:20:09,630 --> 00:20:13,203
But this limitation can
bypassed also very easily.

446
00:20:14,130 --> 00:20:17,733
Simply by calling recursively
again and again and again.

447
00:20:18,720 --> 00:20:20,793
With the same Toast view configuration,

448
00:20:22,170 --> 00:20:24,300
as long as the delay between the calls

449
00:20:24,300 --> 00:20:27,000
is shorter than the appearance time,

450
00:20:27,000 --> 00:20:31,023
you can make it appear
before it disappears.

451
00:20:32,250 --> 00:20:34,440
So the overlay will remain

452
00:20:34,440 --> 00:20:36,483
on the screen theoretically forever.

453
00:20:38,400 --> 00:20:40,023
Let's consider the next example.

454
00:20:41,400 --> 00:20:46,200
Ransomware blocking the
screen for the user.

455
00:20:46,200 --> 00:20:48,810
So I created a small recursive method,

456
00:20:48,810 --> 00:20:50,790
they call it overlay one,

457
00:20:50,790 --> 00:20:53,670
which takes integer count

458
00:20:53,670 --> 00:20:56,410
and count it down to zero

459
00:20:57,480 --> 00:20:59,253
with the delays of one second.

460
00:21:00,450 --> 00:21:03,000
As you can see, the
duration is LENGTH_LONG,

461
00:21:03,000 --> 00:21:05,310
which approximately four seconds.

462
00:21:05,310 --> 00:21:09,330
So I created the view, customized view

463
00:21:09,330 --> 00:21:11,430
with the resource layout file,

464
00:21:11,430 --> 00:21:13,170
which is this file.

465
00:21:13,170 --> 00:21:14,940
And I set the gravity of it

466
00:21:14,940 --> 00:21:16,290
to fill the screen

467
00:21:16,290 --> 00:21:18,750
from the region point 0 and 0.

468
00:21:18,750 --> 00:21:20,730
Basically it filled the screen entirely

469
00:21:20,730 --> 00:21:23,313
from the top left corner.

470
00:21:24,810 --> 00:21:26,160
In the layout configuration,

471
00:21:26,160 --> 00:21:28,620
the width and height set to match parent

472
00:21:28,620 --> 00:21:30,090
with the background black.

473
00:21:30,090 --> 00:21:31,830
Basically black screen,

474
00:21:31,830 --> 00:21:35,470
completely covering the
entire screen of the user

475
00:21:36,570 --> 00:21:38,167
with a message saying,

476
00:21:38,167 --> 00:21:40,110
"Well, your screen is blocked.

477
00:21:40,110 --> 00:21:41,100
And if you want to unblock it,

478
00:21:41,100 --> 00:21:44,310
you just need to pay 01 Bitcoin."

479
00:21:44,310 --> 00:21:45,143
Not a lot.

480
00:21:46,560 --> 00:21:47,913
So let's see it running.

481
00:21:52,140 --> 00:21:53,610
The user uses his device,

482
00:21:53,610 --> 00:21:58,610
and overlay appear with
no permissions at all.

483
00:21:58,800 --> 00:22:01,050
And as you can see,
overlay doesn't disappear.

484
00:22:01,050 --> 00:22:04,980
The user can click back button,
home button, tasks button.

485
00:22:04,980 --> 00:22:06,570
It doesn't matter,

486
00:22:06,570 --> 00:22:09,570
because it will always stay on top

487
00:22:09,570 --> 00:22:10,683
as much as we want.

488
00:22:11,640 --> 00:22:12,757
Cool, right?

489
00:22:12,757 --> 00:22:15,924
(audience applauding)

490
00:22:17,196 --> 00:22:18,029
Thank you.

491
00:22:19,593 --> 00:22:21,630
And please notice that

492
00:22:21,630 --> 00:22:23,480
there are no permissions at all used.

493
00:22:25,410 --> 00:22:30,030
Now creating an overlay to
block the screen entirely,

494
00:22:30,030 --> 00:22:32,970
it's cool, but this is not
the only thing we can do.

495
00:22:32,970 --> 00:22:34,710
If you remember the
third ability of Toast,

496
00:22:34,710 --> 00:22:37,470
that the views, they don't
receive focus by default.

497
00:22:37,470 --> 00:22:39,660
It means that this technique

498
00:22:39,660 --> 00:22:41,613
can also be used for a clickjacking.

499
00:22:42,900 --> 00:22:44,940
And sometimes to make
something crucial to happen,

500
00:22:44,940 --> 00:22:47,253
you just need one single
click from a user.

501
00:22:48,330 --> 00:22:49,950
Now, according to some article I read

502
00:22:49,950 --> 00:22:54,950
about the usage behavior of Android users,

503
00:22:55,980 --> 00:23:00,180
an average Android user touch the screen

504
00:23:00,180 --> 00:23:03,840
for a little bit more
than 2,600 times a day.

505
00:23:03,840 --> 00:23:05,130
And that just an average user.

506
00:23:05,130 --> 00:23:07,740
So, like heavily user do it more.

507
00:23:07,740 --> 00:23:09,810
By the way, the link for that article

508
00:23:09,810 --> 00:23:12,213
is referenced in the end of the CFP.

509
00:23:14,250 --> 00:23:17,310
Anyway, that makes it
very hard to remember

510
00:23:17,310 --> 00:23:19,140
every time you tap the screen.

511
00:23:19,140 --> 00:23:21,450
And it makes it easy to trick the user

512
00:23:21,450 --> 00:23:24,330
to tap in the specific spot

513
00:23:24,330 --> 00:23:27,723
using the common alert popups.

514
00:23:28,620 --> 00:23:30,750
I mean, think about it for a second.

515
00:23:30,750 --> 00:23:32,820
Let's test it a little bit.

516
00:23:32,820 --> 00:23:35,010
Like how many of you have Android device,

517
00:23:35,010 --> 00:23:38,130
let's say for more than five or six years?

518
00:23:38,130 --> 00:23:39,840
Okay, with the raise of your hand.

519
00:23:39,840 --> 00:23:42,360
Okay, a lot of people,
definitely more than half.

520
00:23:42,360 --> 00:23:43,830
I would say like 70%.

521
00:23:43,830 --> 00:23:47,130
So ask yourself how many times

522
00:23:47,130 --> 00:23:49,320
in this five, six years
that you have the device,

523
00:23:49,320 --> 00:23:52,380
how many times you have
seen these alerts, right?

524
00:23:52,380 --> 00:23:55,440
Unfortunately, Google
Play Service has stopped.

525
00:23:55,440 --> 00:23:57,000
Unfortunately, browser stopped,

526
00:23:57,000 --> 00:23:58,800
unfortunately application crashed,

527
00:23:58,800 --> 00:23:59,880
blah, blah, blah, whatever.

528
00:23:59,880 --> 00:24:02,370
You can see it all the time, right?

529
00:24:02,370 --> 00:24:06,330
And what you usually do is,
"Okay, something crashed."

530
00:24:06,330 --> 00:24:08,640
You click okay, and you
continue with your life.

531
00:24:08,640 --> 00:24:13,640
You continue with your
2,616 other tabs. Right?

532
00:24:14,610 --> 00:24:17,370
But what if at that particular time,

533
00:24:17,370 --> 00:24:19,920
at one of these times when
you clicked okay button,

534
00:24:21,060 --> 00:24:25,350
your actual click went through this okay.

535
00:24:25,350 --> 00:24:27,510
Because the view didn't receive the focus

536
00:24:27,510 --> 00:24:30,150
to some other clickable element,

537
00:24:30,150 --> 00:24:31,473
which you didn't even see.

538
00:24:33,120 --> 00:24:36,633
Let's consider the next
example, clickjacking POC.

539
00:24:37,560 --> 00:24:39,900
I created some small dummy application,

540
00:24:39,900 --> 00:24:41,997
I call it "clickjack victim."

541
00:24:43,020 --> 00:24:46,180
I used this small dummy examples

542
00:24:47,070 --> 00:24:49,170
and not real applications,

543
00:24:49,170 --> 00:24:51,990
obviously to prevent
potential copyright issues

544
00:24:51,990 --> 00:24:53,190
from me and DEF CON.

545
00:24:53,190 --> 00:24:54,840
But as you can understand,

546
00:24:54,840 --> 00:24:57,750
it'll also work with
any other applications.

547
00:24:57,750 --> 00:24:59,670
So anyway, this application's very simple.

548
00:24:59,670 --> 00:25:03,870
You have two buttons, a
no button, yes button.

549
00:25:03,870 --> 00:25:07,470
And here in the logs, we can
see what exactly happened.

550
00:25:07,470 --> 00:25:12,470
So if the user will click
no, we will see POC No.

551
00:25:12,690 --> 00:25:16,743
And when the user click
yes, we will see POC Yes.

552
00:25:17,730 --> 00:25:19,413
All right? Very simple example.

553
00:25:20,490 --> 00:25:22,623
So I'm running this build.

554
00:25:24,480 --> 00:25:26,700
User is using his device,

555
00:25:26,700 --> 00:25:27,870
and then at some point,

556
00:25:27,870 --> 00:25:31,177
Bam! Some alert is popping up,

557
00:25:31,177 --> 00:25:32,940
"Google Play Services has stopped."

558
00:25:32,940 --> 00:25:34,590
He clicks okay.

559
00:25:34,590 --> 00:25:37,500
Doesn't suspect anything, uses his device.

560
00:25:37,500 --> 00:25:39,090
But what actually happened,

561
00:25:39,090 --> 00:25:42,570
he was just tricked to click the POC Yes.

562
00:25:42,570 --> 00:25:43,803
So how did it work?

563
00:25:45,240 --> 00:25:48,060
While the user saw this alert pop up,

564
00:25:48,060 --> 00:25:50,460
Google Play Service has stopped,

565
00:25:50,460 --> 00:25:54,870
and supposedly clicked on the okay button,

566
00:25:54,870 --> 00:25:57,390
the actual click went to the yes button.

567
00:25:57,390 --> 00:25:59,973
That was exactly behind it.

568
00:26:03,240 --> 00:26:08,240
So what can we do with these techniques?

569
00:26:08,490 --> 00:26:11,910
What can be real-life exploitations

570
00:26:11,910 --> 00:26:13,560
with different combinations
of this technique?

571
00:26:13,560 --> 00:26:18,560
So first, I showed you
unauthorized 2 way communication.

572
00:26:19,260 --> 00:26:22,350
So we can communicate with
our server, for example,

573
00:26:22,350 --> 00:26:23,400
for commnand in control.

574
00:26:23,400 --> 00:26:25,480
And the server can tell the Android app

575
00:26:26,400 --> 00:26:28,383
what to do and when to do it.

576
00:26:29,610 --> 00:26:33,540
For example, when to block
the screen for a ransomware,

577
00:26:33,540 --> 00:26:35,550
or when to unblock it,

578
00:26:35,550 --> 00:26:36,543
when the user paid.

579
00:26:37,710 --> 00:26:40,320
Or which applications to disrupt,

580
00:26:40,320 --> 00:26:43,413
on which buttons to
make the user to click,

581
00:26:44,340 --> 00:26:47,700
or which applications to uninstall.

582
00:26:47,700 --> 00:26:51,810
Because in Android to
uninstall an application,

583
00:26:51,810 --> 00:26:56,670
it's basically a built-in
alert with just one click.

584
00:26:56,670 --> 00:26:58,830
And then the application is uninstalled.

585
00:26:58,830 --> 00:27:01,590
I mean, yeah, in the latest API levels,

586
00:27:01,590 --> 00:27:05,040
it also need a normal level permission,

587
00:27:05,040 --> 00:27:07,623
but still this is pretty simple.

588
00:27:09,000 --> 00:27:10,770
But also it can be used

589
00:27:10,770 --> 00:27:13,260
to bypass even more permissions

590
00:27:13,260 --> 00:27:15,543
from dangerous protection level.

591
00:27:16,770 --> 00:27:18,033
Let's see some examples.

592
00:27:21,030 --> 00:27:22,920
CALL_PHONE permission.

593
00:27:22,920 --> 00:27:24,900
In Android, there is a permission

594
00:27:24,900 --> 00:27:29,760
from a runtime dangerous
protection level called CALL_PHONE.

595
00:27:29,760 --> 00:27:34,260
And it protects a particular action,

596
00:27:34,260 --> 00:27:35,520
it's called ACTION_CALL.

597
00:27:35,520 --> 00:27:39,510
If you create a Implicit
Intent with ACTION_CALL,

598
00:27:39,510 --> 00:27:43,020
and you gives a URI with a phone number,

599
00:27:43,020 --> 00:27:45,120
the Android will open a dialer.

600
00:27:45,120 --> 00:27:46,590
It will parse the URI,

601
00:27:46,590 --> 00:27:48,420
and put the phone number in the dialer,

602
00:27:48,420 --> 00:27:51,483
and then it will start the phone call.

603
00:27:52,860 --> 00:27:55,620
But that will work only if the application

604
00:27:55,620 --> 00:27:58,563
has the needed CALL_PHONE permission.

605
00:28:00,000 --> 00:28:01,080
If it doesn't have it,

606
00:28:01,080 --> 00:28:03,840
then as we have seen
previously security exception,

607
00:28:03,840 --> 00:28:04,833
it cannot work.

608
00:28:06,030 --> 00:28:07,950
But at the same time,

609
00:28:07,950 --> 00:28:10,713
in Android there is another
action called ACTION_DIAL,

610
00:28:11,580 --> 00:28:13,983
which work with default permissions.

611
00:28:15,180 --> 00:28:16,710
And it does exactly the same thing,

612
00:28:16,710 --> 00:28:19,440
or almost exactly the same thing.

613
00:28:19,440 --> 00:28:21,510
It'll also trigger the dialer.

614
00:28:21,510 --> 00:28:24,240
It'll also parse the URI,

615
00:28:24,240 --> 00:28:26,130
take the phone number, put in the dialer.

616
00:28:26,130 --> 00:28:28,110
But it will not start the phone call.

617
00:28:28,110 --> 00:28:29,210
That's the difference.

618
00:28:30,450 --> 00:28:33,213
You just need one single
click from a user to start it.

619
00:28:34,050 --> 00:28:36,150
So you see where I'm going with it, right?

620
00:28:36,990 --> 00:28:39,270
So, normal behavior.

621
00:28:39,270 --> 00:28:42,090
If you're trying to access a action call,

622
00:28:42,090 --> 00:28:45,900
application crashing,
alert, blah, blah, blah.

623
00:28:45,900 --> 00:28:48,840
Security exception is strong.

624
00:28:48,840 --> 00:28:49,803
Permission denied.

625
00:28:50,880 --> 00:28:53,100
You cannot access ability

626
00:28:53,100 --> 00:28:56,613
that is protected by permissions normally.

627
00:28:59,820 --> 00:29:03,760
But a combination of these techniques

628
00:29:04,650 --> 00:29:09,270
using the ACTION_DIAL, users see some...

629
00:29:09,270 --> 00:29:11,490
Again, some alert, clicking okay.

630
00:29:11,490 --> 00:29:13,590
But what actually happened as you can see,

631
00:29:14,490 --> 00:29:16,293
the phone call started,

632
00:29:17,610 --> 00:29:19,293
and no permissions used.

633
00:29:20,520 --> 00:29:22,830
All right, as you can understand,

634
00:29:22,830 --> 00:29:24,930
obviously I purposely removed the overlay

635
00:29:24,930 --> 00:29:27,330
so we can see the dialer.

636
00:29:27,330 --> 00:29:28,950
But, like I showed previously,

637
00:29:28,950 --> 00:29:30,873
the overlay can remain if needed.

638
00:29:33,300 --> 00:29:36,483
Another example, location permissions.

639
00:29:37,770 --> 00:29:42,710
Now when application need
to access device location...

640
00:29:44,520 --> 00:29:46,470
Like all of the location permissions

641
00:29:46,470 --> 00:29:49,050
like fine location, coarse
location, et cetera.

642
00:29:49,050 --> 00:29:50,640
They are all runtime permissions

643
00:29:50,640 --> 00:29:52,340
from a dangerous protection level.

644
00:29:53,250 --> 00:29:55,470
So application needs to check

645
00:29:55,470 --> 00:29:57,840
before it try to access
the device location.

646
00:29:57,840 --> 00:30:01,233
Need to check whether
this permission is given.

647
00:30:02,190 --> 00:30:03,747
And if not, to trigger the alert.

648
00:30:03,747 --> 00:30:05,670
And I explained it previously,

649
00:30:05,670 --> 00:30:06,720
in case of location,

650
00:30:06,720 --> 00:30:08,790
it will trigger the alert

651
00:30:08,790 --> 00:30:11,730
where the user can allow this permission,

652
00:30:11,730 --> 00:30:14,403
denied it, or allow it for one-time usage.

653
00:30:15,240 --> 00:30:18,963
But this how it works
for normal applications,

654
00:30:19,950 --> 00:30:21,063
not for a browser.

655
00:30:21,960 --> 00:30:25,950
In the browser, when
the webpage is executing

656
00:30:25,950 --> 00:30:28,200
javascript:
`navigator.getCurrentPosition()`,

657
00:30:29,640 --> 00:30:33,180
it triggers alert from the browser.

658
00:30:33,180 --> 00:30:35,010
And with one single click,

659
00:30:35,010 --> 00:30:37,860
the user can allow this webpage

660
00:30:37,860 --> 00:30:39,303
to access device location.

661
00:30:40,320 --> 00:30:42,810
So using the first technique

662
00:30:42,810 --> 00:30:44,910
with the URI of Chrome browser,

663
00:30:44,910 --> 00:30:47,280
we can trigger the Chrome browser

664
00:30:47,280 --> 00:30:49,800
to open a malicious webpage

665
00:30:49,800 --> 00:30:52,300
that will trigger the needed

666
00:30:53,280 --> 00:30:55,380
JavaScript navigator getCurrentPosition,

667
00:30:55,380 --> 00:30:58,263
that will make this built-in alert.

668
00:30:59,160 --> 00:31:00,780
And then with the ClickJacking,

669
00:31:00,780 --> 00:31:02,673
we can allow the access for ourself.

670
00:31:03,540 --> 00:31:05,490
So that would look something like that.

671
00:31:08,760 --> 00:31:10,650
User uses his device.

672
00:31:10,650 --> 00:31:12,390
A browser has stopped, blah, blah, blah.

673
00:31:12,390 --> 00:31:16,080
Clicks okay, browser stopped.

674
00:31:16,080 --> 00:31:17,670
Browser restarted.

675
00:31:17,670 --> 00:31:21,240
Nothing suspicious, no
permissions used, right?

676
00:31:21,240 --> 00:31:22,443
But what just happened?

677
00:31:23,880 --> 00:31:25,680
The device location was just stolen.

678
00:31:27,420 --> 00:31:28,267
All right.

679
00:31:28,267 --> 00:31:31,434
(audience applauding)

680
00:31:34,110 --> 00:31:35,517
Thank you.

681
00:31:35,517 --> 00:31:36,780
And hopefully at this moment,

682
00:31:36,780 --> 00:31:38,700
this is clear for everyone why it were.

683
00:31:38,700 --> 00:31:43,620
But still, when the user saw this alert

684
00:31:45,210 --> 00:31:48,270
and supposedly clicked on the okay button,

685
00:31:48,270 --> 00:31:50,040
the okay button appeared

686
00:31:50,040 --> 00:31:54,780
exactly above the built-in
alert from the browser,

687
00:31:54,780 --> 00:31:57,810
where he allowed actually the permission,

688
00:31:57,810 --> 00:32:00,540
the device location for the webpage.

689
00:32:00,540 --> 00:32:01,840
And this is how it worked.

690
00:32:04,170 --> 00:32:06,450
Okay, that's it.

691
00:32:06,450 --> 00:32:09,450
I see that we still have some time.

692
00:32:09,450 --> 00:32:11,343
So if you have any questions,

693
00:32:12,180 --> 00:32:13,580
I'll be glad to answer them.

694
00:32:14,775 --> 00:32:17,942
(audience applauding)