- 0xduraki

Android Vulnerability Checklist

Official Google Android-related Security Checklist are present on developer.android.com website, click on “Guides” tab in the sidebar, and then click " Understand common security risks" menu.

Android Vulnerability Checklist

Manifest Exploration & Static Analysis

  • Check if AndroidManifest.xml contains: <interesting_info>, basically a blueprint of the application
  • Check if AndroidManifest.xml contains: android:allowBackup = TRUE
  • Check if AndroidManifest.xml contains: android:debuggable = TRUE
  • Check if AndroidManifest.xml contains: android:exported = TRUE (or not set), allowing external apps to access data
  • Check if AndroidManifest.xml contains: android:permission.READ|WRITE_EXTERNAL_STORAGE, only if sensitive data was stored/read externally, resulting in:
    • The app, opens website in external browser (not inApp), however requires “android.permission.INTERNET” indicating incorrect usage of permissions (ie. over-privileged)
    • The app’s android:protectionLevel was not set properly (ie. <permission android:name="my_custom_permission_name" android:protectionLevel="signature"/>)
    • The app is missing android:permission (permission tags limiting exposure to other apps)
  • Cleartext Credentials (ie. Base64-encoded, Hardcoded, or Weak Encrypted)
    • Hard-coded User Authentication Information (Credentials, PINs, etc.)
    • Hard-coded Cryptographi Keys
    • Hard-coded Keys used for Encrypted Databases
    • Hard-coded API Keys
    • Hard-coded Keys that might’ve been encoded (Base64/XOR/etc.)
    • Hard-coded Server IPv4 Addresses
  • File Permissions uses MODE_WORLD_READABLE / MODE_WORLD_WRITEABLE (other apps/users are able to read/write the file)
  • Debug Information, Information Disclosure, or anything that shouldn’t be in the APK
  • Find exported components, API keys, DeepLink Schemas, Endpoints in file resources.arsc/strings.xml
  • Explore all file save paths in file res/xml/file_paths.xml
  • Search source code recursively, especially BuildConfig files
  • Search for Firebase related value leaks using firebase.io/https://*.firebase.io/.json
  • Extract API Keys by:
    • Looking up string reference in Android Classes (getString(R.string.<stringResourceLabel>))
    • Finding these string references in corresponding strings.xml file
    • Joining together the domains and required parameters as per decompiled code
  • Android Exported Components:
    • Activities: Entrypoints for application interactions of components specified in AndroidManifest.xml
      • Has several states managed by callbacks such as onCreate()
      • Access to protected intents via exported activites
      • One exported activity that accepts a user provided intent can expose protected intents
      • Access to sensitive data via exported activity
      • Often combined with deep links to steal data via unvalidated parameters, write session tokens to an external file
      • Access to sensitive files, stealing files, replacing imported files via exported activities, external-files-path, external-path, public app. directories
      • Look for content:// in decompiled source code
    • Service: Supplies additional functionality in the background
      • Custom file upload service for example, that is vulnerable due to android:exported="TRUE" flag
      • When exported, third-party applications can send data to the service
      • When exported, third-party applications can steal sensitive data from application depending on the service function
      • Check if parameters and intent data can be set with PoC application
    • Broadcast Receivers: Receives broadcasts from events of interest
      • Usually specified broadcasted intents in the broadcast receiver activity
      • Vulnerable when receiver is exported and accepts user provided broadcasts
      • Any application, including malicious ones, can send an intent to the broadcast receiver causing it to be triggered without any restrictions
    • Content Providers: Helps application to manage access to stored data and ways to share data with other Android apps
      • Content providers that connect to SQLite can be exploited via SQL Injection by a third-party apps
  • Deep Links:
    • A deep link is a link that takes user directly to a specific destination with-in an app
    • Usally mirros web application except with different schemas that navigate directory to specific Android activity
    • Verified deep links can only use http and https schemas, but custom schemas can be implemented by developers
    • Type of vulnerabilities are based on how thre scheme://, host:// and parameters are validated
      • CSRF: Test when autoVerify="true" is not present in AndroidManifest.xml
      • Open Redirect: Test when custom schemes do not verify endpoint parameters or hosts
      • XSS: Test when endpoint parameters or hosts are not validated, use of addJavaScriptInterface(...)/setJavascriptEnabled(true)
      • LFI: Test when deep link parameters aren’t validated, ie. appschema://app/goto?file=[...]
  • Database Encryption:
    • Check if database is encrypted under /data/data/<package_name>/
    • Check if decompiled code contains database credentials
  • Allowed Backup:
    • Check if any backup results in Sensitive Information Disclosure
    • Use the adb backup com.example.app to backup the allowed app. data
  • Verbose Logging Enabled
    • Check logs using logcat when user tries to Log-in
    • Check logs using logcat on other actions performed
  • External Storage
    • Check data stored on External Storage, ie. /sdcard/android/data/<com.example.app>/ directory
  • Weak Hashing Algorithm
    • Use of MD5 or equivalent hashing algorithm that may be vulnerable to collisions
    • Predictable PRNG due to use of java.util.Random function
  • Check for “Debug Mode” enabled flag
    • Start a shell on Android using: adb shell
    • Gain an interactive shell with run-as command: run-as <com.example.app> in adb
    • Execute app. via forced debug mode: adb exec-out run-as com.example.app cat databases/AppName > AppNameDB-COPY
  • Built-in WebView Testing
    • If application is using built-in WebView, try to access it
    • Deeplink WebView Open URL: appscheme://webview?url=https://google.com
    • Deeplink WebView Javascript: appscheme://webview?url=javascript:document.write(document.domain)

Public Disclosures

Links to this note

duraki notes

* [Android Vulnerability Checklist](/android-vulnerability-checklist)