- Hello, and welcome to the new video of Android Security and Exploitation training
series by Pentester Academy. My name is Aditya, and I'm your course instructor for
this entire training series. You can also check out certifications at
securitytube-training.com.
So in this particular video, we are going to start off with a new set of
vulnerability that is called backup based vulnerability. Now backup is a recent
feature introduced in Android, where you can take the backups of any application
and you can also restore it back. This entire process happens without the root
privileges, right. So what an attacker can do over here is if you can take a backup
of an application which has some security restrictions, you can basically modify the
backup contents, and you can restore it back. So this was same vulnerability that
was discovered in Lastpass by Chris John Riley which is patched now. And the same
vulnerability was also discovered in Box by me. And the recent version of Box is
going to be patched against this kind of vulnerability, right.
So if you have a look at the Box application, it looks something like this.
And if you go to the settings, you can set in a passcode which you can use in order
to access Box, right. So if come back to the application after one minute, it will
need a passcode to enter the application.
So let's close it. Let's go back, right. Okay, so now you can take the backup of
the application using custom methods which is you can take the backup using adb
backup specifying the package name storing to any file.ab. And you can use dd to copy
the first 24 bytes into like skipping the first 24 bytes and then copying the rest
into app.tar as the first 24 contains the header. And then you specify the contents
of a tar in a file called app.list and then you extract the tar. And once you
have extracted and modified the content of the tar, you can again star it to combine
it back into a box_new.tar. And now you create the app_new.ab again by putting
back the header and then the contents of the tar. And then you restore it back. So
this is a bit more complicated process and there's also an automated tool which can
perform a few of this actions automatically which is called ABE or the
Android Backup Extractor which you can download from sourceforge with this
particular link. So in this, you just have to take the backup and you can unpack it
using java -jar abe.jar, and then you can again pack it back using java -jar abe.jar
pack. So let's see by going back into Box, it
asks us for a passcode now, and unless I enter the correct passcode it won't let us
in, right. So let's try to take a backup of the Box application. So for that we'll
need the package name of box. For that let me just connect to the device...adb
disconnect, then connect. So, let's do a ps and grep for Box. So this is the
package name. So now I can do an adb backup package name -f box.ab. Right. So
once you do this it will ask you to unlock your device and confirm the backup. So you
just have to click on backup my data. You might not specify a passcode or if you
want you can specify a passcode. In this case we'll go without a passcode and click
on backup my data. So the backup is starting, and now the backup has been
finished.
Right. So here we have a file called box.ab. So now if you look at the file
box.ab, you'll see that first 24 bytes actually contain the Android backup.
Right. So this is indeed a backup file which has a lot of data. Let's try to make
sense of this data using ab.jar. So once you download the Android backup extractor
and extract it, it will create these bunch of files, and now I can do java -jar
abe.jar unpack box.ab into box.tar. So it says the file has been created, right.
Also at the same time, let's create a list of it using tar -tf. So tar -tf box.tar to
box.list. And now let's extract it, xvf.box.tar. So it extracts into a folder
called apps where it has the folder called com.box.android which is also the package
name and inside that we'll have a few folders with their characters of like f is
for files, db is for the database, sp is for the shared preferences.
All right, so let's go inside apps, com.box.android inside the shared
preferences. Let's see which file contains something like a pin. So if you look for
pin, we see that there's a mention of pin in myPreference.xml. So let's open up the
myPreference.xml, and here you see there's a line called string name equals pinCode,
and which actually contains an encrypted value of the pin code. So we can simply
remove this particular line and this looks like the new file, let's just save it. And
now let's go back and compile this into an abe file again. So we'll use s tar for
this -c -v -f and box_new.tar, which will be our new file, -no-dirslash
list=box.list. And now we have a new.tar, and now we can simply do java -jar back
box_new.tar to box_new.ab. So there is some issue over here. Jar abe.jar pack.
Let's have a look, pack box_new.tar box_new.ab. Okay, looks like it worked
this time. Let's try to do a hexdump -c of box_new.ab. So a backup of this program
everything looks good. Not sure if this will work. Oh, we missed the abe.jar
earlier. Okay, so now let's try to restore this particular file, box_new.ab. Restore
my data, the restore is starting, and now let's try to exit Box. Whoa, so if you see
now the Box has been opened without any passcode, and you can verify it by going
into settings and says require passcode never which we set earlier to require
passcode. Right. So this is how you can identify a backup
based vulnerability and you can also exploit it, and one of the ways to secure
against it is to specify android:allowbackup equals to false in the
AndroidManifest.xml.
Now, that's all for this video. If you have any more feedback or queries, feel
free to reach out to me at adi@attify.com, or you can also send out a tweet to me
@adi1391. Thanks a lot.