Android Hacking - Insecure Content Providers

Content Providers

In this post we will look at an example of an insecure content provider in the Sieve application. Content Providers act as an interface for sharing data between applications. Each content provider has a URI that begins with content://

This allows other applications that the know the URI to perform functions on the data such as insert(), query(), update() or delete(). If the content provider permission is not set correctly in the manifest.xml file then it can lead to sensitive data leakage.

Analyzing Insecure Content Providers

As we have seen in the previous post, the Sieve application  has 2 content providers exported.

We can run the app.provider.info -a command on the Sieve application to retrieve further information. The output reveals that there are two content providers DBContentProvider and FileBackupProvider that do not have any permissions assigned for read/write access. However it does reveal that the DBContentProvider/Keys path requires permissions to read/write.

Another method for returning content:// URIs is the finduri module. This can reveal other sensitive paths, in the screenshot below you can see a /Passwords path.

If we try to query it using app.provider.query it returns a password table containing sensitive information including passwords in base64.

This is a good example of how unprotected content providers can reveal sensitive information.

SQL Injection Issues 

Another associated insecurity with content providers is SQL Injection. Content providers are commonly connected to SQLite databases. Therefore if the data has not been suitably sanitized then SQL commands can be injected in order to return information.

There are a number of ways of identifying and exploiting SQLi using Drozer. You can manually inject SQL queries via the app.provider.query or by scanner.provider.injection modules.

It is also possible to use existing tools in conjunction with Drozer modules. In the example below we will use auxiliary.webcontentresolver - this module offers a web service interface to all installed content providers. This then allows us to use sqlmap to exploit.

Drozer and SQLmap

The first thing to do is start the module and select a specified port.

Next navigate to http://localhost:1234 in your browser. You should see a list of content providers on the web page.

If you select the DBContentProvider/Passwords URI, you can then start to manipulate any parameters that are passed through the web interface to the back-end services. The example below shows an SQL error being returned by injecting a quote into the projection parameter.

We can fire up SQLmap and query the URI. The command below takes the URI and tries to manipulate the projection parameter in order to return the tables.

The results show 3 tables have been returned from the SQLite_masterdb.

Finally we can dump the contents of the Passwords database.

References: https://labs.mwrinfosecurity.com/tools/webcontentresolver/
                    http://sqlmap.org/
                    http://blog.mdsec.co.uk/2015/02/the-mobile-application-hackers-handbook.html

Analyzing Android Applications Using Drozer

Before we start analyzing Android applications we need to understand the different aspects of the Android architecture.

Android applications communicate with each other using an IPC (Inter-Process Communication) kernel module known as binder. The applications can make use of four components that can be invoked via calls to binder.

 Android Components

• Activities - An activity represents a single screen with a user interface. An example of an activity would be a login page.
• Services - A service is a component that runs in the background to perform long-running operations, it does not provide a UI. An example of a service might be music playing in the background while the user is in a different application.
• Broadcast Receivers - A broadcast receiver is a component that responds to system-wide broadcast announcements. A broadcast may announce that the battery is low or a picture was captured. Apps can also initiate broadcasts - for example to let other apps know that some data has been downloaded to the device and is available for them to use.
• Content Providers - A content provider supplies data from one application to others on request. You can store data in the file system, an SQLite database or any other persistent storage location the app can access.

Defining Components

Each Android Package contains a file named AndroidManifest.xml. This file contains various information such as the minimum Android version and the list of activities, services, broadcast receivers and content providers. Only components defined in the manifest file are usable within the application, the one exception are broadcast receivers.

One of the important aspects of securing components in the manifest is to use strongly configured permissions. 

In Android a component is public when exported is set to true but it is also public if the manifest specifies an intent filter for it.

Attacking Components

In this tutorial we will use Drozer to analyze an Android application to determine what components are exported and if so how they can be attacked.

We will use a deliberately vulnerable Android application created by MWR InfoSecurity called Sieve . Sieve is a password manager that allows a user to save passwords and makes use of a master password and pin to encrypt the passwords in the database. 

Analyzing the Manifest File

After you install the application you can find the package name of the application by running the command below

Drozer allows for examination of the manifest file, the command below returns the whole manifest file

An easier way to check for exported components is to run the command below. We can see that there are 3 activities,2 content providers and 2 services exported. 

Exploiting Activities

As mentioned earlier activities are individual user interfaces. Developers need to be careful when defining the activities to be exported in the manifest file. The Sieve application demonstrates how the application authentication page can be bypassed due to a misconfigured activity.

We have determined that 3 activities have been exported, run the command below to identify the pages.

When a user opens the Sieve application they must enter a master password and pin via the authentication page. We can try to bypass this page (MainLoginActivity) by calling one of the other activities. We can try to invoke the other activities using drozer.

By invoking this activity we have bypassed the authentication page without having to enter a password or pin.

Android Security Testing - Introduction To Drozer

In this post we will look at the Drozer framework for performing Android security testing.

Drozer allows you to assume the role of an Android app. and interact with other apps, through Androids Inter-Process Communication mechanism (IPC), and the underlying OS.

Drozer Components

Drozer comprises three components - Agent, Console and Server.

• The Agent is an Android application that runs on your test device or emulator.
• The Console is a command-line interface that allows for interaction with the agent.
• The Server provides a central point where consoles and agents can rendezvous, and routes sessions between them.

Setup

For this tutorial we will use the Appie pentesting environment, you can read more about Appie here
This is really useful as it comes packaged with lots of tools for performing Android security testing.

The first step is to connect your device to your PC, you must ensure that USB Debugging is turned on as this facilitates a connection between the two.

In order to get started we need to install the drozer agent on the Android device or emulator. The agent will be in the downloaded package, to install we will use ADB.

The next step is to set up port forwarding from the device to the PC, the server on the drozer agent listens on TCP port 31415. To do this run the following command.

You can now open the drozer agent on the device and turn on the embedded server.

Now that the embedded server is turned on we can connect to the agent from the PC. You should see a command prompt as below.

The console allows you to run modules that are installed. In order to view the modules you can use the list command

You can also search for modules from the repository using the module search -d command, the repository is located here

Then to install -  module install keyword

In the next post I will describe how to exploit vulnerable Android applications using Drozer

Download Drozer