• Home

  • Documents

  • Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware...
42
Classification: Internal www.nviso.be Using Mobile Malware tactics for red teaming November 2019

Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

  • Upload
    others

  • View
    6

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

www.nviso.be

Using Mobile Malware tactics for red teaming

November 2019

Page 2: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

JEROEN BECKERS

― Mobile solution lead at NVISO― Primary author of SEC575 (NVISO)― Co-author of

― OWASP Mobile Security Testing Guide (MSTG)

― OWASP Mobile Application Security Verification Standard (MASVS)

Page 3: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Mobile devices

www.nviso.be | 3

Malware tactics for red teaming

Page 4: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Mobile Malware in a tiny nutshellMalware tactics for red teaming

Subscription scams

Ransomware Ad fraud

Premium text fraud

Page 5: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Mobile Banking TrojansMalware tactics for red teaming

Page 6: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Android vs iOS

www.nviso.be | 6

Malware tactics for red teaming

?

https://www.cvedetails.com/vulnerability-list/vendor_id-49/product_id-15556/Apple-Iphone-Os.html
https://www.cvedetails.com/vulnerability-list.php?vendor_id=1224&product_id=19997&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=1695&sha=1bd76566e804bd0baf4aa6ef43598ed24565b5b6
Page 7: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Necessary stepsMalware tactics for red teaming

Create application

Install application

Get the data

Page 8: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Creating an application

www.nviso.be | 8

Page 9: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Different optionsCreating an application

Page 10: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

How does malware do it?Creating an application

0

10

20

30

40

50

60

70

80

90

Create Steal

Page 11: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Can we do it?Creating an application

Page 12: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

» adb pull /data/app/com.limebike-1/base.apk/data/app/com.limebike-1/base.apk: 1 file pulled. 23.6 MB/s (26939075 bytes in 1.090s)»

Obtaining a valid APKCreating an application

Get APK from deviceSTEP 1

Page 13: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

» apktool d base.apkI: Using Apktool 2.4.0 on base.apkI: Loading resource table... ...I: Baksmaling classes.dex...I: Baksmaling classes2.dex...I: Baksmaling classes3.dex...I: Copying assets and libs...I: Copying unknown files...I: Copying original files...»

Modifying the applicationCreating an application

Decompile the applicationSTEP 2

Page 14: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

SMALI codeCreating an application

Page 15: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Adding SMALI codeCreating an application

ModifySTEP 3

Page 16: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

» apktool b baseI: Using Apktool 2.4.0...I: Building apk file...I: Built apk...» jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 –keystore keystore.keystorebase/dist/base.apk mykeystore...

adding: META-INF/MYKEYSTORE.RSAsigning: resources.arsc

...jar signed.

Recompiling & signingCreating an application

Recompile & signSTEP 4

Page 17: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Testing the applicationCreating an application

Possible hurdles:

- Original application already installed

- Application contains Runtime Application

Self Protection (RASP)

Page 18: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

A toast message is nice, but …Creating an application

Page 19: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Installing the application

www.nviso.be | 19

Page 20: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Different approachesInstalling the application

Page 21: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

How does malware do it?Installing the application

Page 22: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Chamois Family

www.nviso.be | 22

Installing the application

- 5 stages of obfuscation and anti-RE

- Dynamic payload system

- Premium SMS & Ad fraud

Source: Chamois: The Most Impactful Android Botnet

of 2018 - Maddie Stone

Page 23: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

How does malware do it?Installing the application

Source: Android Security & Privacy

2018 Year In Review (Google)

Page 24: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Third party app storesInstalling the application

Page 25: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Drive-by downloadsInstalling the application

=

Page 26: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Can we do it?Installing the application

Yes, but…

Accepts malware

Allowed by EULA

Controlled environment

Loading external code

Easy installation

Page 27: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Can we do it?Installing the application

Yes, but…

Accepts malware

Allowed by EULA

Controlled environment

Loading external code

Easy installation

Page 28: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Can we do it?Installing the application

Yes, but…

Accepts malware

Allowed by EULA

Controlled environment

Loading external code

Easy installation

Page 29: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Get the data

www.nviso.be | 29

Page 30: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Application sandboxesGet the data

Page 31: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

How does malware do it?

www.nviso.be | 31

Get the data

Accessibility Overlay attacks Phishing

Page 32: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Accessibility (A11Y)

www.nviso.be | 32

Get the data

Page 33: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Accessibility (A11Y)

www.nviso.be | 33

Get the data

Page 34: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Overlay attacks

www.nviso.be | 34

Get the data

Page 35: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Drawing on top

www.nviso.be | 35

Get the data

http://cloak-and-dagger.org/

Page 36: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

BankBot

www.nviso.be | 36

Get the data

Page 37: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Can we do it?Get the data

Annoy user to give access

Pretend to be Google / Samsung / …

Full control over all visual items

Can be activated with Accessibility

Not granted by default

Probably not needed

Page 38: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Can we do it? – Credentials

www.nviso.be | 38

Get the data

Intune Gmail Full controlWIFI

Page 39: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Can we do it? – 2FA

www.nviso.be | 39

Get the data

G Suite MS Authenticator

Page 40: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Conclusion

www.nviso.be | 40

Page 41: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

Can we do it?

www.nviso.be | 41

Conclusion

Create application

Install application

Get the data

Social engineering

Blocked by MDM

Easy to copy

Some development

required

Easy social

engineering

Most applications

not protected

Page 42: Using Mobile Malware tactics for red teaming · Verification Standard (MASVS) ... | 3 Malware tactics for red teaming. Classification: Internal Mobile Malware in a tiny nutshell Malware

Classification: Internal

www.nviso.be

Thank you!

Jeroen Beckers

linkedin.com/in/beckersjeroen

[email protected]


Teaming Presentation

Teaming Presentation

Technology
Nic Teaming (Lbfo)

Nic Teaming (Lbfo)

Documents
A. Teaming Part - download.gigabyte.asiadownload.gigabyte.asia/FileList/Manual/...teaming_vlan_document.pdfA. Teaming Part a. Create Teaming Flow ... left click the icon in ProgramsÆRealtek

A. Teaming Part - download.gigabyte.asiadownload.gigabyte.asia/FileList/Manual/...teaming_vlan_document.pdfA. Teaming Part a. Create Teaming Flow ... left click the icon in ProgramsÆRealtek

Documents
Teaming wms814

Teaming wms814

Documents
DIY Blue Teaming - ShellCon · 2019. 10. 23. · DIY Blue Teaming Ways to make malware not work 0day (and it's often attached malware) tends to fail in the wild, like A LOT. When

DIY Blue Teaming - ShellCon · 2019. 10. 23. · DIY Blue Teaming Ways to make malware not work 0day (and it's often attached malware) tends to fail in the wild, like A LOT. When

Documents
Top teaming tactics - from in to win -- v8 -- comptroller of currency

Top teaming tactics - from in to win -- v8 -- comptroller of currency

Business
Top Teaming Tactics From In To Win

Top Teaming Tactics From In To Win

Documents
Tactics, Tactics, Tactics!

Tactics, Tactics, Tactics!

Documents
SpecialQuest Teaming

SpecialQuest Teaming

Education
Multi-Cultural Teaming

Multi-Cultural Teaming

Documents
Teaming Profiles

Teaming Profiles

Documents
Business Teaming

Business Teaming

Documents
OSCAR: Red Teaming

OSCAR: Red Teaming

Documents
Teaming Workshops

Teaming Workshops

Business
Red Teaming

Red Teaming

Documents
Red Teaming Handbook

Red Teaming Handbook

Documents
Teaming Agreement

Teaming Agreement

Documents
Waiting / Teaming Area

Waiting / Teaming Area

Documents
Building Teaming Agreements - diy5b2kdeokq1.cloudfront.net fileCMG Alliance Proprietary TEAMING AGREEMENTS Learning objec7ves • Definions • Teaming agreements VS Joint Venture

Building Teaming Agreements - diy5b2kdeokq1.cloudfront.net fileCMG Alliance Proprietary TEAMING AGREEMENTS Learning objec7ves • Definions • Teaming agreements VS Joint Venture

Documents
NIC Teaming - 3

NIC Teaming - 3

Documents
Novell Teaming 2...Novell Teaming 2.0 1 novdocx (en) 22 June 2009 Novell ® Novell Teaming 2.0 July 31, 2009 1 Product Overview Novell® Teaming 2.0 offers many enhancements over Teaming

Novell Teaming 2...Novell Teaming 2.0 1 novdocx (en) 22 June 2009 Novell ® Novell Teaming 2.0 July 31, 2009 1 Product Overview Novell® Teaming 2.0 offers many enhancements over Teaming

Documents
Teaming at DMS

Teaming at DMS

Documents
Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Documents
NET Hacking & In-Memory Malware...Adversary Emulation @ MITRE •Red teaming, but specific threat actors •Use open-source knowledge of their TTPs to emulate their behavior and operations

NET Hacking & In-Memory Malware...Adversary Emulation @ MITRE •Red teaming, but specific threat actors •Use open-source knowledge of their TTPs to emulate their behavior and operations

Documents
Collaborative Teaming Process

Collaborative Teaming Process

Education
Teaming and Subcontracting

Teaming and Subcontracting

Documents
POINT-OF-SALE (POS) MALWARE: TACTICS AND STRATEGIES FOR PROTECTING CUSTOMER PAYMENT ... · 2015-05-28 · Eric M. Fiterman // POS Malware // eric@spotkick.com “We don’t know the

POINT-OF-SALE (POS) MALWARE: TACTICS AND STRATEGIES FOR PROTECTING CUSTOMER PAYMENT ... · 2015-05-28 · Eric M. Fiterman // POS Malware // [email protected] “We don’t know the

Documents
Cross Teaming

Cross Teaming

Education
Teamwork: Insights from 40 years of Research and Practice€¦ · Edmondson - Teaming • Learning to team, teaming to learn • Teaming process (bottom-up) – Teaming mindset adopted

Teamwork: Insights from 40 years of Research and Practice€¦ · Edmondson - Teaming • Learning to team, teaming to learn • Teaming process (bottom-up) – Teaming mindset adopted

Documents
11 sure signs you’ve been hacked Sure Signs.pdf · and malware can change their tactics at will. Swap a few bytes around, and a previously recognized malware program becomes unrecognizable

11 sure signs you’ve been hacked Sure Signs.pdf · and malware can change their tactics at will. Swap a few bytes around, and a previously recognized malware program becomes unrecognizable

Documents