0

I am working on an Android project whose goal is to identify which Java or native functions should be hooked and monitored at runtime to check if the application contains malicious behaviour or weak programming practices.

For example, hooking the connect() allow to access the port information and detect connections that use http (80) instead of https (443), which is definitely a weak programming practice.

edit: apparently, checking the port number is not enough to know if it's http or https, and a traffic analysis would be required (thanks @André Borie).

I have identified many other potentially malicious behaviours and weak programming practices, and prepared similar hooking structures. I wanted to ask you which functions would you hook to check if the app tries to:

1) access the SD card,

2) detect GPS,

3) access camera or microphone,

4) call premium numbers.

Also, using deprecated methods is potentially dangerous for security reasons. Therefore, I want to check if the app is using any. What I'm thinking is to use a blacklist of all known deprecated methods and then scan the app code to search for methods of that list. Would you agree with this? (consider a scenario in which there is no code obfuscation). Same thing for weak encryption API (e.g. MD5?): how to spot them?

edit: I acknowledge the fact that not every deprecated method is deprecated due to security reasons (thanks @CommonsWare), but some of them are. How would you separate methods which have been deprecated for known security issues from the others? Would be nice to have a comprehensive list.

Improve this question
8
  • 3
    "Would you agree with this?" -- absolutely not. The vast majority of deprecated classes and methods have no security ramifications whatsoever. Using them is typically necessary for backwards compatibility. Blindly flagging all deprecated methods will give you so many false positives that it will make your head spin. "Same thing for weak encryption API" -- MD5 is not encryption, and simply using MD5 is not indicative of a security problem. It depends on what the hash is being used for.
    – CommonsWare
    Commented Nov 12, 2016 at 23:48
  • detect connections that use http (80) instead of https (443) you can perfectly run an HTTP (not Secure) server on port 443. The port alone doesn't mean anything.
    – André Borie
    Commented Nov 12, 2016 at 23:58
  • @CommonsWare Sounds legit. What would you suggest instead? Would you avoid dealing with deprecated methods at all? Maybe not all of them, but some of them could have been deprecated for security reasons?
    – noobsharp
    Commented Nov 13, 2016 at 0:04
  • @AndréBorie You're right. What would be a correct way to separate http from https connections?
    – noobsharp
    Commented Nov 13, 2016 at 0:04
  • @BranStark looking at the actual traffic (and tampering with it to make sure the app implements crypto correctly.
    – André Borie
    Commented Nov 13, 2016 at 0:06

1 Answer 1

Reset to default
1

I understand the current scenario that your work with you want something like SAST but on runtime something that a famous security company made these days which is not in the scope of the answer. However, some suggestions may help this case which is ... If the deprecated methods which your looking for are based on program dependencies here is a suggestion which I would use java for.

Open the dependency file, java normally is pom.xml or other programming language is in another file. Check the main version of the dependency and compare with the pom's current version i.e. if a spring version is 5.1.4 and the dependency is 5.1.2 then you may report the update believing it may imply in security purposes. By the way checking If there access to the SDCard or anything outside the app can be Done in the AndroidManifest as the example below.

<application android:allowBackup="true" ... > > Needs to be false

The second suggestion is as mentioned make a black list but instead a small database which is updated every now and then with all the deprecated methods that may cause harm due to security reasons. You may want to work with enhanced algorithm to make it work quickly because by time its gonna become big. These are the things that I would suggest.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .