3

I have been pen testing an android mobile application for security vulnerabilities. As part of the test, I started Frida server on a mobile phone where the mobile application to be tested is installed, running, and after login (Already inserted credentials and logged in). While being logged in the application, I dumped the application's memory using Frida (with strings), and was able to find my session token in clear-text JSON format.

I was wondering, is there any way to mitigate this vulnerability? Of course it makes sense that the session token is saved in memory, but is there a way to store it securely (E.g. not in clear text) and thus mitigate such a vulnerability?

I find this issue risky as if the mobile device is rooted, a malicious mobile application (running with sufficient permissions) can conduct the same attack locally on the mobile phone and thus extract the session token.

Improve this question
7
  • 5
    The mitigation is to not root the phone and break the security barriers between memory locations.
    – schroeder ♦
    Commented Jul 30, 2019 at 12:14
  • 1
    Yet this is not something that can be decided by the application owner, if the mobile phone is rooted and the application is installed on it
    – user3091216
    Commented Jul 30, 2019 at 12:32
  • 1
    So, you are asking how to mitigate this as an application developer? Not as the device owner? If so, please edit your question to include that.
    – schroeder ♦
    Commented Jul 30, 2019 at 12:52
  • 1
    If you encrypt this data and place it in memory, you are going to have to decrypt it in memory at some point.
    – schroeder ♦
    Commented Jul 30, 2019 at 12:53
  • 1
    @domen OP is talking about a session token. I'm not sure how a keystore could help with that.
    – forest
    Commented Jul 31, 2019 at 5:56

1 Answer 1

Reset to default
1

No, you cannot mitigate this vulnerability without a major change in hardware. If your adversary has the ability to dump memory from arbitrary processes, there is no way to store credentials confidentially. On Intel's x86 CPUs, a feature called SGX can be used to create a secure enclave that can hide data even from the kernel, but that is not a feature that you have access to on typical Android hardware.

There are only a few places where data can be stored by a process. Typically, the data can be stored in memory (e.g. on the stack or in the heap), or in process registers. A rooted device running a malicious process with sufficient permissions will be able to access all of those locations. There is no way you can hide a session token. The reason is simple: The data needs to be retrievable by your process. Any data that your process can access, a malicious process with sufficient permissions can also access.

The only solution is to not allow any malicious processes to have high privileges.

Improve this answer
2
  • Hello forest and thanks a lot for your thorough answer. Actually on PC's (x86's..) there are ways to mitigate this issue, for example, in Java you will create a list of char[]'s and then when you are done with using the password, you overwrite the list. Additionally as one suggested above in a comment, is it possible to use the Keystore for this? In order to store the password/session token encrypted in memory?
    – user3091216
    Commented Jul 31, 2019 at 11:05
  • @user3091216 That technique wouldn't be sufficient as an attacker could pause the program and run it step by step. Whether or not a keystore works depends more on your exact requirements.
    – forest
    Commented Jul 31, 2019 at 18:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .