4

I'am writing some small security report about Android devices in general related to accessing information from RAM. Main condition is that device initially is non-rooted.

Use case: User opens 3rd-party app, enters some password in password field. After that the device is lost with this running application. Source code of this application shows that this password information available in RAM while application is up and running. For example in class AllMyAppPasswords in public String myPassword. Now is the question about possible way to access this password info (correct me if I am wrong):

  1. The way to access this pwd is to dump the memory.
  2. For memory dump I need to have device to be rooted.
  3. In order to root the device I need to unlock bootloader.
  4. To achieve unlock bootloader and root operations it is requires that device needs to be rebooted at least once.
  5. After device is rebooted the information about password is gone from RAM

More info to current use case: We assume that user just un-boxed new device and 100% sure that it is not rooted and not contain any keylogger apps. So user just installed my app, entered password, and application uses this password internally during run-time for periodically connecting the server (password only RAM, never stored on disk). So, visually there is nothing left in Edit text fields, info about password only in application memory for internal use, of course it is not possible just to read password text from the screen. Now user lost his phone.

Conclusion and my question: It is not possible to get password residing in RAM memory from app if device is non-rooted (without physical disassembling frozen memory chip). Is it correct? Should user concern about someone who found his phone can get this password info from RAM?

Improve this question

2 Answers 2

Reset to default
3

Your assumptions about rooting a phone are not necessarily correct. The most typical way is to unlock the bootloader, since it allows root to be granted at boot time, however a flaw in the OS could result in it being possible to root the phone without unlocking the bootloader. While I am not aware of any current ways to do this against Android 4, it was very possible in versions prior to 2.2 and there was even a virus that rooted on a running phone that made it in to the wild. This is likely why that particular flaw (which had been used to root phones for some time) was finally patched.

Rooting only requires some exploit that will allow for permissions to be elevated to the superuser context. There are many ways this could be done, just most people don't bother to try and find them since they just want to unlock their devices and the bootloader is the path of least resistance.

Improve this answer
2
  • Thank you for info. It is up to vendor of application, to recommend secure conditions. If he can find out that it is not possible to protect old phones, then it will be only e.g. 4.x and up Android devices recommended to use. But if we unsure even about 4.x devices for different manufacturers, then here is bigger problem.
    – PerecFX
    Mar 7, 2013 at 14:49
  • @PerecFX - the bigger key is simply that it is not a safe assumption that the memory won't be accessible on any phone. There are other alternatives like encrypting values in memory, but then you still have the key management problem.
    – AJ Henderson
    Mar 7, 2013 at 15:18
1

If I recall correctly, depending on the version of Android you are using, even when the phone is stolen, it's not simple to access the RAM unless you are willing to freeze it. The previous linked technique even allows to bypass encryption mechanisms.

I think more interesting attack vectors would be finding passwords stored on the SD card or internal storage. Again if the user is using full disk encryption, then this is probably not going to work.

The largest problem with Android is that there are tons of different versions available

Improve this answer
1
  • Yes I agree about Android fragmentation. It is hard to predict all kind of situations. Thank you for info.
    – PerecFX
    Mar 7, 2013 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .