1

We need to pass a specific security audit in our company. All our front line workers use the mobile phone provided by our company (controlled by Intunes) and they require to install apps such as CamScanner to capture some document.

So far only the apps developed by the company were installed on the devices. When installing CamScanner it asks for storage permission, which seems to fail the security audit.

Is there a way for us to prove that this specific software does not randomly access device storage (while the app is running in the background / not active) and send the data to their data center?

1

Is there a way for us to prove that this specific software does not randomly access device storage (while the app is running in the background / not active) and send the data to their data center?

First of all, the auditor should provide evidence that data is sent to a data center. Failing a security audit based on the assumptions that an application might send data to a data center is not valid. The audit should be all about facts.

Network Traffic

In order to monitor possible HTTP traffic of this mobile application, one could use an intercepting proxy for example. The certificate of this proxy is loaded into the phone and should be trusted in order to capture the TLS data streams.

Configure the phone to use a proxy server and point it to the IP address of the machine that is running the proxy.

Side Note: Make sure the intercepting proxy server is listening on an external network interface in order to accept connections from the phone. Any web based traffic should be captured now and displayed in the intercepting proxy.

When HTTP is not expected to be used as a communication protocol, it will be a bit more difficult to analyze the communication stream. In that case I'd suggest use a Pinapple device. Connect the phone to the device over WiFi and use TCP dump to capture its traffic.

TCP dump allows you to store the network capture in PCAP format. This PCAP can be loaded in a tool such as Wireshark in order to analyze all traffic.

Data Storage

First of all, requesting storage permissions should not fail an audit. It can be perfectly legitimate for the application to (temporary) store data on the storage device.

Again, it should be proven that the application could maliciously do things on the storage device.

Analyzing the application

In my opinion the best way to analyze the application is by reviewing the source code. If the source code is available, this is the best and fastest way in order to determine if data is sent to a remote server and if it will randomly read data from a storage device.

In case the application source code is not available, it could be decompiled and analyzed (I'll leave the law out of this for now and focus mainly on the technical details)

Conclusion
I cannot stress this enough: It is the auditor's responsibility to prove that the application performs malicious actions. Assuming an application might be malicious is not good enough.

The auditor should be provided with a security assessment report that is performed on the application. Based on that report, the auditor can state whether the application is malicious or not.

It's all about the evidence!

0

checking if it does send data should be fairly easy once you can monitor the device's traffic. Typically you need a pc with two network interfaces, one for the "internet" one for a fake hotspot. You monitor the traffic inbetween and you will see where the traffic goes. (Easier way is using an ESP8266 and https://github.com/martin-ger/esp_wifi_repeater)Still it will be hard to distinguish normal traffic from the app's traffic.

Alternatively you could disassemble the code (please check legal stuff before) and look for anything that tries to make an connection.

I'd go with the second approach if the program is not all to big. That way you will be totally sure what is exchanged over the internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.