Another common class of security vulnerabilities on
Android applications are known as hard.
Coating issues with hard coating issues. They're
mostly the active heart, coding
information into our service code that is
potentially exposing information about how the application runt
or maybe exposing something like a username or
password or some sort of sensitive data through two
types of hard coating issues. In this video of
the first one is sort of the classic hard-coding issue
where we hard-coded a password into some Java
file and since we can pile it, we figure known
as going to be able to decompile. Wouldn't be able to get that
password. However, that's not the case, as we can
see 3D compiling and then the other one will be a little bit more complex,
which will involve actually shared libraries and
shared objects in discussing, how we can potentially extract passwords
from those as well.
So you'll see this, we need to enter in some sort of vendor key
in order to access this is section.
So if we try to access it was a access denied
if we entered the wrong values. So in
order to extract the password for this,
we need to find first the activity that corresponds to this login
page. And in this case, it would be hard code activity. Now,
a lot of the times it might not be named exactly
like this. It might not be as easy to find the activity. If
you need to try to find this as well. You can also take a
look at the the log messages or the, the displayed messages
in the alerts. So as you can see, this one
has that same access denied message. So, we know that we're probably in the
right place.
Now, looking at this code, we can see that we're taking
a look at the the HCG text field.
We're going to text Amber checking if the string equals
a vendor secret key. So you can
see, we parked in the password and this means that it's very
easy for someone to decompile this application and figure
out the password for this. So, now from here, we can
just type in a fender secret key.
And press access. And as you can see access granted in
this case. So this is one type of a
very common hard-coded activity problem. We're on
it. We heard could a password in plain text rather than doing
something like obscuring it or Krypton get or hashing
it or, you know, putting it on a server or something
like that. There's a whole lot of different things that we could be doing.
That aren't this primarily? We would be sent
you like, hash the password in order to protect it.
But even then someone could get the hottest password
and try to force it with like an offline. It's hot. So
that's not really the best way to do it. Typically what
we want to do here is Sir. Is there a fight on server-side or place
it somewhere that someone wouldn't be able to access it if they decompiler application?
So I be the key idea.
So let's go ahead and discuss the other type of
hard coating issue.
And this one is relatively somewhere. Again, we have to enter in
like a password. If we got the wrong password. It will give us
the access denied message. And if you entering the correct password, Jose
access granted. We look at the heart
rate activity, which is hard code to activity. You'll see
that things are slightly different here.
You see it's grabbing D. J at I access.
So this is this is a
method from the DIA, the DJ and
I object, which is this one here.
So what we going to do, if you want to find this class to
determine what the access method is actually doing.
So if I go into this class here, which
I have here diva AJ, and I you'll see
that there is a static load, that happens to
hitting a shared library and the Esso
name is Diva AJ and I so we
can find shirt objects in the resources
under library and you'll
see that it's compiled for every different type of processor. Which of these
objects are going to be the same, the main difference being the Assembly Language
that is targeting the really any of these are
going to be able to give us information.
Saudi shirt object libraries as we discussed
they can't really be decompiled in the traditional sort of
way. We can't go from a shared object to source code. However, what
we can do to objects for
drinks. So what I mean by this is that any sort of
like static like texts were able to extract from the
shared object libraries. There's a number of different ways to
do it. I like to use a utility called strings and
what strengths does is that essentially allows us
to search the whole library for the Statics drink.
So you can see here. I've got the copy of
the library on. If you want to grab a copy of
them. What you can do is you can change this APK to
a zip folder. And then what you do this, you
can open up the set and then you can go into the libraries for
their like before and then extract the value from there.
So don't be the way that you would be able to extract it. If
you're looking to extract it onto your device and then
utilizing strings were able to search it for any sort
of text that may exist. So let's go ahead and open up command
line dance, CD to this directory. And
then the way that it works is you just go string. Exe
and then we type in the name of the file that we want
to search. So it would be the Liv Diva Janiya. And
you can see here, we get all
the texts drinks that are existing inside of
that. Soo file. Now, from here, we have
to do a little bit of thinking, to be able to extract the
ones that are important to us.
You'll notice Aldis. One's here.
If you have some familiarity with with Assembly
Language, is, you know, that these thoughts will typically correspond
to labels or points to jump
too. So these dots. Like text
file Center Street, like text, talk text
Data, they aren't really as important
to us because they're just like sort of like you. Divisions of
the file itself. So we aren't really interested in
those. You can see that these genuine GCC or
probably telling us this was compiled with so
this information again isn't necessarily relevant
interesting. The gold one point one looks
to me like a version number of something and you
can see here. It's you and you called - version so this is
probably just a version number. So that's not necessarily important.
You can see these are other shared objects that
are being used. So again, these aren't really particularly important
these again or mostly labels.
So it's indicating the end that the SS start the
E data. So those aren't really something that's going
to be interest.
Similar with this year, for the
same reasons as to your copy, is a c function. That's
like we be used inside of here. These appear
to be just like them information about the
actual Library itself, which will
leave us with these three pieces of information as
well as this
So when we're taking a look at these, we serve one of a structure, which
ones are relevant to us.
So from this week and we can serve essentially just trial-and-error
them to see which one is the correct input. There
are some other ways that we can sort of
like look at these and be able to decode information from them. Use it
when they help like the dollar sign character inside of them. It means that
there's some sort of script anything related to them. Potentially could
be like, an argument in a bash script or something like
that. A lot of the time, these will correspond to
like, hold lines for instance, which means that this is
probably the only one that's just general text. So,
if we think that this one is the right one, then we can bring
it over here and try to input it in, and see what will happen. So olustee.
F. G a d semicolon.
L a h.
We try to access. You see that we get access. Granted.
So obviously this is the proper password for it.
So you can see from here that even though
we can't necessarily decompile this year. Jex,
we can just search them for the strings that exist in
them. And if they have a hard-coded string inside of their, we're going to
be able to extract the string and potentially weakened
formation such as the password.
So this video gives you a bit of an idea behind how hard-coded
text is able to be utilized to potentially
exposed at about Android application. So,
these are the vulnerabilities to happen every so often and what
is X the shared object ones or maybe a
bit more common because people are a bit less careful when
they think that the thing can't be decompiled. But also if
they obscure the files at all, if we can sort of like
managed to an obscurity, the code
or unencrypted code, we can potentially figure out
the password. So not only are playing text to
information necessarily a bad idea. But
also even just like putting ashes into the code could
be dangerous because then, you can do, like, password-based. I
talked to try to decrypt them so you can
look out for 4:30. So
now you can take a look for these in any applications.