In my thesis I'm trying to analyze leaking private data on Android apps. I noticed that the vast majority of data is encrypted.
How can I analyze this data without decrypting it?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Rory, one method of getting information of this nature from your device is to use binary instrumentation in order to read what the app's functions are seeing.
Frida is a toolkit that will help do this for you. See here for more information: https://www.notsosecure.com/pentesting-android-apps-using-frida/. It works by decompiling, adding gadgets to and then recompiling the binary in order to allow you to see what's happening inside the functions or to rewrite them altogether.
Drozer is another toolkit (unrelated) that can help you look at an app from the perspective of another app. See here: https://resources.infosecinstitute.com/android-penetration-tools-walkthrough-series-drozer/#gref. It's useful for when you're pentesting android databases, it can be used to query the db directly using the app's exported functions sometimes.
I don't know if this pertains to your question but I thought I should note it. Analyzing encrypted data without violating the confidentiality of that data is difficult. The only way I can think of a computationally secure way to do this would to use a TEE to decrypt and analyze the data, send the analysis to userspace, re-encrypt the data in the TEE and wipe memory. That way all computations on the secure data are done in an isolated processor space that is cryptographically secure as opposed to decrypting in userspace where malware will have a chance to access the data. Does this help?