1

In my thesis I'm trying to analyze leaking private data on Android apps. I noticed that the vast majority of data is encrypted.

How can I analyze this data without decrypting it?

  • This question includes at least two independent questions, which should better be asked separately. The second one is a duplicate of How can I intercept Android application's SSL traffic where SSL pinning is used?. – Steffen Ullrich May 8 at 9:34
  • Hello Jan and welcome to Stack Exchange. I suggested an edit for your question in order to make things a bit clearer. However, I noticed that you asked multiple questions at once. Please try to boil your question down to one answerable question in the future. If you are not sure how to do that, please look at the How to Ask help page. – MechMK1 May 8 at 10:00
  • I have retained the first question, as the second is a duplicate and the third is entirely unrelated. – Rory Alsop May 8 at 18:17
1

Rory, one method of getting information of this nature from your device is to use binary instrumentation in order to read what the app's functions are seeing.

Frida is a toolkit that will help do this for you. See here for more information: https://www.notsosecure.com/pentesting-android-apps-using-frida/. It works by decompiling, adding gadgets to and then recompiling the binary in order to allow you to see what's happening inside the functions or to rewrite them altogether.

Drozer is another toolkit (unrelated) that can help you look at an app from the perspective of another app. See here: https://resources.infosecinstitute.com/android-penetration-tools-walkthrough-series-drozer/#gref. It's useful for when you're pentesting android databases, it can be used to query the db directly using the app's exported functions sometimes.

I don't know if this pertains to your question but I thought I should note it. Analyzing encrypted data without violating the confidentiality of that data is difficult. The only way I can think of a computationally secure way to do this would to use a TEE to decrypt and analyze the data, send the analysis to userspace, re-encrypt the data in the TEE and wipe memory. That way all computations on the secure data are done in an isolated processor space that is cryptographically secure as opposed to decrypting in userspace where malware will have a chance to access the data. Does this help?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.