3

I have been pen testing an android mobile application for security vulnerabilities. As part of the test, I started Frida server on a mobile phone where the mobile application to be tested is installed, running, and after login (Already inserted credentials and logged in). While being logged in the application, I dumped the application's memory using Frida (with strings), and was able to find my session token in clear-text JSON format.

I was wondering, is there any way to mitigate this vulnerability? Of course it makes sense that the session token is saved in memory, but is there a way to store it securely (E.g. not in clear text) and thus mitigate such a vulnerability?

I find this issue risky as if the mobile device is rooted, a malicious mobile application (running with sufficient permissions) can conduct the same attack locally on the mobile phone and thus extract the session token.

  • 5
    The mitigation is to not root the phone and break the security barriers between memory locations. – schroeder Jul 30 at 12:14
  • 1
    Yet this is not something that can be decided by the application owner, if the mobile phone is rooted and the application is installed on it – user3091216 Jul 30 at 12:32
  • 1
    So, you are asking how to mitigate this as an application developer? Not as the device owner? If so, please edit your question to include that. – schroeder Jul 30 at 12:52
  • 1
    If you encrypt this data and place it in memory, you are going to have to decrypt it in memory at some point. – schroeder Jul 30 at 12:53
  • 1
    @domen OP is talking about a session token. I'm not sure how a keystore could help with that. – forest Jul 31 at 5:56
1

No, you cannot mitigate this vulnerability without a major change in hardware. If your adversary has the ability to dump memory from arbitrary processes, there is no way to store credentials confidentially. On Intel's x86 CPUs, a feature called SGX can be used to create a secure enclave that can hide data even from the kernel, but that is not a feature that you have access to on typical Android hardware.

There are only a few places where data can be stored by a process. Typically, the data can be stored in memory (e.g. on the stack or in the heap), or in process registers. A rooted device running a malicious process with sufficient permissions will be able to access all of those locations. There is no way you can hide a session token. The reason is simple: The data needs to be retrievable by your process. Any data that your process can access, a malicious process with sufficient permissions can also access.

The only solution is to not allow any malicious processes to have high privileges.

  • Hello forest and thanks a lot for your thorough answer. Actually on PC's (x86's..) there are ways to mitigate this issue, for example, in Java you will create a list of char[]'s and then when you are done with using the password, you overwrite the list. Additionally as one suggested above in a comment, is it possible to use the Keystore for this? In order to store the password/session token encrypted in memory? – user3091216 Jul 31 at 11:05
  • @user3091216 That technique wouldn't be sufficient as an attacker could pause the program and run it step by step. Whether or not a keystore works depends more on your exact requirements. – forest Jul 31 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.