So in this lecture, we're going to access the credentials because of insecure data storage vulnerabilities.
So after getting the encrypted data will decode them and then hijack the username and password sound
like a plan?
Let's start.
I was always will make sure that the Android emulator and application server running.
And here we're looking at the do logging activity last and something must have caught your attention
here.
I'm going to wager.
So when a user logs in, the credentials are saved using the Save Krebs method.
So this method creates a new file called My Shared Preferences if it doesn't already exist.
The method then base64 encoded the username and encrypts the password with its encryption before storing
them in the shared preferences file.
And then this file is overwritten each time a user successfully logs in with their own credentials.
So let's have a look at the Log-in activity class.
As you can see, there's a method called fail data.
And it enables users to autofill credentials in order to save them from having to enter in their username
and password every time they wish to log in.
The failed data method is opening the Mind Shared Preferences file.
The username and password are decoded and decrypted, respectively, before being used to fill in the
login input fields.
Now, as you remember, the password is encrypted with, yes, encryption using crypto class.
So let's also have a look at this class.
And the password has been encrypted with a method called A-s encrypted string.
We saw that the developer was using years, yes, encryption with the cipher block chaining mode, but
used a static initialization vector and hard coded the encryption key.
So we can decode a password using this static initialization vector and hard coded encryption key.
So first, let's get the credentials from the insecure bank at.
We can use HDB to identify where the mind shared preferences file is stored in the insecure bank, the
two apps private directory.
So open up the terminal and first we'll check the devices.
All right, so when you can verify that you're connected, run the ADB shell command.
Now, don't forget the the my shared preferences file will not be created until you've logged in successfully
at least once.
All right, so we'll make sure that we've successfully logged into the app.
And we'll log in with the default credentials.
OK, so now we can go to the directory where the shared preferences file is.
So it should be under the folder called data slash data slash com android, that insecure bank to slash
shared perhaps.
And list the files.
All right, so here it is.
So let's copy the location.
And we'll use the exit command to get out of the shell.
Now, to get this file, run ADB, pull location of the file, and don't forget adding the file name
and the location.
All right, so that pulls a file.
And let's open the file with Nano.
So as you can see, the password is an encrypted form, but it should not be forgotten that base64 is
not secure because base64 is not encryption, it's encoding.
It's a way of representing binary data, using only text characters so we can retrieve the username
quite easily.
Using an online tool such as cyber chef, in fact, we can decode the username and password, so just
open the Web browser, search for cyber chef.
And click on the first website.
Select to base64 as the option from the left pane.
So we can start with a username.
Will copy this.
Paste it into the input field.
And there you see it, there's the username quite easily gotten.
So why don't we just continue with the password?
And what do you think, all from the source code, we have the information needed, such as encryption,
key, initialization vector and ciphertext so that we can decrypt the password.
So we'll just copy this part.
Paste it into the input field.
Now, before decoding the s encryption will need to change, decode the base64 password and encode it
to hex.
So I'll just add the two option into the recipe field.
And this is the Hecks format of the password.
So we'll copy it.
And now we can start the A-S decryption.
Over the encryption and coding section from the left pane.
So like a yes decrypt.
Now we can disable these options because we'll just use the yes encryption now.
So paste the hex format of the password here.
Open the source code and copy the key and paste it into the tool.
Now, copy the initialization vectors.
So this is in an array format in the Java programming language, so that means we'll need to transform
it into the Hecks format again.
We'll just remove the commas and add one more zero for each one.
The value of all the initialization vectors is zero, making it predictable and easy to decode the password.
Mode is OK, as you remember from the source code, it was CBC, which, by the way, stands for cipher
block chaining.
Oh, and don't forget to set this Moad to UTF eight.
All right, great.
We've also got the password.
So here's the result of insecure storage of data.