Unintended Data Leakage - Application Backgrounding

Application Backgrounding iOS

If an application is open, it is possible that it can be sent in to the background by a change in state, such as the user pressing the Home button or from an incoming call. 

When an application is suspended in the background, iOS will take a “snapshot” of the app and store it in the application caches directory. 

If any sensitive information is open in the application when it enters the background, the snapshot is written to the filesystem in clear text. This can then be accessed by a malicious user.

iGoat Example

iGoat has an example of this type of vulnerability under Data Protection (Rest) > Backgrounding. Just click on Start to begin the exercise.

Enter any answers in the security question text fields and tap on the home button on your device to take the application in the background. iOS will take a screenshot of the application before it goes in the background.

If you navigate to the /Library/Caches/Snapshots/ folder you will find the snapshot containing the information you entered.

In order to prevent this kind of a vulnerability, these text fields can be set with the hidden attribute.

Example

The UIApplication delegate method applicationDidEnterBackground can be used to detect when an application is entering the background and modify the display accordingly.

- (void)applicationDidEnterBackground:(UIApplication *)application {

viewController.creditcardNumber.hidden = YES;

}

Insecure Local Data Storage iOS

iGoat

iGoat is a deliberately vulnerable mobile application that allows developers and testers to learn about common security issues that are often seen in iOS. If you want to find out more about the project then you can click on this link.

Setup

In order to run this application via a simulator you will need xcode installed from the app store. The next step is to download the latest version of iGoat here. You should be able to open the project file iGoat.xcodeproj with xcode, when you run the application you should see the simulator on the screen.

Optional: Inside the iGoat folder there is a ruby server igoat_server.rb. We do not need it for this tutorial but we will need it later on, you will need to install some necessary ruby gems - this can be done by running the command 'sudo gem install sinatra json'. To start the server you can run the command below

Insecure Data Storage 

Insecure data storage vulnerabilities occurs when development teams assume that users or malware will not have access to a mobile device's filesystem and subsequent sensitive information in data-stores on the device. Filesystems are easily accessible. Organizations should expect a malicious user or malware to inspect sensitive data stores. Rooting or jailbreaking a mobile device circumvents any encryption protections. When data is not protected properly, specialized tools are all that is needed to view application data.

In the iGoat mobile application we will exploit sensitive data stored locally on the device. In the simulator navigate to Data Protection (Rest) > Local Data Storage.

Once you click on the 'Start' link you will see a login page similar to below. All you have to do is enter a username and password pair then login.

 Now we can try and via the insecure data. Finding the correct directory can be tricky when using a simulator. First you need to locate your device, an easy way to do this is to go to Finder and enter the path below.

 

Then you can sort the directory by Date Modified to determine your current device.

Once inside the device you can navigate to /Containers/Data/Application/<UUID>/ . Next navigate into the Documents directory - you will see a sqlite file called credentials.sqlite. Use the command sqlite3 credentials.sqlite to enter the sqlite3 interpreter with the database file. 

To view the tables type '.tables', you will see a table called creds. We can dump all of the information from the table by entering the command 'select * from creds;' 

Recommendations 

It is important for developers to note that the data stored in Sqlite files is saved unencrypted in the application sandbox on the device.For databases consider using SQLcipher for Sqlite data encryption.

References: https://www.owasp.org/index.php/Mobile_Top_10_2014-M2

Dumping iOS Keychain Contents

In this post we will look at dumping the contents of the keychain on an iOS device. To do this we will use the Keychain Dumper tool available here

A keychain is a secure storage container that can be used to store sensitive information such as passwords, WiFi passwords and authentication tokens for different applications.The devices passcode is used to encrypt the keychain so once the device is jailbroken it is possible to read the contents of the .db file.

The steps outlined below are performed using a Jailbroken iPad (7.0.6) and a Mac.

First we need to sftp into the jailbroken iOS device. The default password is 'alpine'

Next we want to upload the keychain_dumper binary to the iOS device. We can move it to the temp folder.

We also want to make sure that it is executable, you can do this using the chomd command

Next we want to make sure that the keychain is readable, again we can use chmod

Now we can run the binary. To do this you can run the ./key_dumper command in the tmp folder

The tool dumps out all the contents of the keychain. This can include usernames and passwords used by applications and also wireless keys.

You can see usage information by using the -h switch

One of the best ways to make your keychain more secure is to use a strong passcode. As shown in an older post it is possible to brutefore a 4 digit passcode in a matter of minutes using the iPhone dataprotection tools.

Test your iOS skills with DVIA

Hey,

If you are interested in testing your iOS penetration skills in a legal environment then the Damn Vulnerable iOS Application (DVIA) is for you available here @  http://damnvulnerableiosapp.com/. The application covers the most common security vulnerabilities found in iOS applications aligning with the OWASP Mobile Top 10.

 Vulnerabilities and Challenges

• Insecure Data Storage
• Jailbreak Detection
• Runtime Manipulation
• Piracy Detection
• Transport Layer Security
• Client Side Injection
• Information Disclosure
• Broken Cryptography
• Security Decisions via Untrusted input
• Side channel data leakage
• Application Patching

One of the ways to install the IPA is to use the IPA Installer Console

First download the IPA from the site here Download

Then copy the file over to your iOS device using sftp

sftp root@X.X.X.X

put DamnVulnerableIOSApp.ipa

Now run the command "ipainstaller DamnVulnerableIOSApp.ipa" or "installipa DamnVulnerableIOSApp.ipa" to install the application.

You should now see the application on the device

Happy Hacking :)

iOS Pin Guessing Attack

In this post I would like to talk about the threat posed by lost or stolen mobile devices.It is inevitable that devices will be misplaced it's human nature, right? Mobile devices are also a common target for theft. Device passcodes are seen as the first line of defense to prevent unauthorized access and subsequent data compromise.

The length and complexity of  the passcode will largely determine how successful this measure will be against the malicious user. When deciding on a passcode complexity policy we also have to take the user into consideration since they will have to  enter it each time they want to access the device.

In order to demonstrate the pitfalls of weak passcodes we will use the iPhone Data Protection Tools project http://code.google.com/p/iphone-dataprotection/. With these tools we can mount a PIN guessing attack against the device. The initial setup is quite complex and requires multiple steps but once this is done the actual attack is quite easy. You will need an iOS device sucepitble to jailbreaking e.g. 5.1.1 and a Mac.

Fortunately there is an easy to follow document provided by Joshua Wright available here http://www.willhackforsushi.com/ios-key-recovery.pdf . Once you have the installation and preparation done we can walk through the exploit.

The first step is to plug the device into the Mac via USB and let iTunes start. Next power off the device ensuring that it is completely turned off

Start redsn0w to jailbreak the device using the patched iOS firmware file, custom kernel and ramdisk you created during the preparation.

When redsn0w starts you will see the window below:

Click next and follow the steps on the menu

• Press and hold the suspend button for 3 seconds
• Without releasing the suspend button, press the home button for 10 seconds
• Release the suspend button but keep holding the home button for another 15 seconds

After a minute or two you should see OK on the device. This signals a successful exploit.

Now start an SSH listener on the device using the command below. The tcprelay.sh script is part of the iPhone Data Protection Tools.

At this point you can SSH into the iOS device using the following command (Note: the default password will be alpine).

The final step is to launch the bruteforce attack. The script will start to iterate through all the possible combinations i.e. 0000 - 9999 until it hits the correct number. The attack will not trigger a lockout as it bypasses the UI calling the low-level MKBUnlockDevice() kernel function. As you can see below the passcode has been returned as 0022

Using this technique an attacker could recover a 4 digit pin in 13 minutes on average, increasing the length to 6 digits dramatically increases the recovery time to 22 hours. If the user has a strong alphanumeric passcode then it cannot be brute forced in a reasonable amount of time meaning it gives the user the ability to initiate a device wipe.

Once the pin has been recovered it is then possible to decrypt the keybag and recover wireless keys etc. It will also be possible to do an iTunes backup containing the victims email, SMS and photos. The device can then be rebooted leaving no trace of the attack and returned to the victim if desired. Pretty scary stuff!!