Category: Mobile Hacking

Oct 01 2013

New Touch ID Hack Allows to Unlock iPhone by Multiple FingerPrints

iPhone 5S Touch ID HackThe Iranian group defeated the very basic phenomenon of an iPhone Fingerprinting scanner, which allows them to unlock an iPhone device with multiple Fingerprints.

Apple‘s iPhone 5s, was launched just available in stores two weeks before with a new feature of biometrics-based security system called “Touch ID”, that involves analyzing a user’s fingerprint and using that to unlock the phone.

Apple launched the technology that it promises will better protect devices from criminals and snoopers seeking access. With this you can purchase things from the iTunes App Store. Basically, you can now use it in place of your password.

“Fingerprint is one of the best passcodes in the world. It’s always with you, and no two are exactly alike,” according to the Apple’s website.

Last week Germany Hackers showed that how they were able to deceive Apple’s latest security feature into believing they’re someone they’re not, using a well-honed technique for creating a latex copy of someone’s fingerprint.

Another interesting fact is that, Touch ID is not only designed to scan the fingerprints of your fingers, it works with various human body parts and appendages which are also not fingers.

In a video demonstration, the Group set up a mixed Fingerprint scan of 5-6 people for an iPhone 5S handset (as shown in the video), which allowed all of them to unlock the locked device with their individual fingerprint.

According to Apple, the chance that Touch ID will misread a finger is 1 in 50,000 , this is because Touch ID is not designed to capture the fingerprint in strict mode. It scans the fingerprint on a very high-resolution (2400 dpi), to get and match the partial parts of an impression for faster unlocking.

If the iPhone is not able to scan the thumb impression in the strict mode to be unique, there is a possibility that out of 1000 thumb impressions iPhone’s Touch ID system can count 2-3 impressions as of the same person.

Sep 16 2013

Android WebView Exploit Allows Hackers to Install Malicious Apps

There’s a vulnerability that affects WebView control in Android applications installed on Android devices running versions older than 4.2.

This vulnerability makes a large number of Android applications act as a hacker pipeline into user’s devices and provides a way to install malicious software, send SMSs and more.

Android WebView Exploit

WebView allows the user to view a web application (or just a web page) as a part of an ordinary Android application. The WebView class is an extension of Android’s View class that allows you to display web pages as a part of the appication’s screen layout.

All that WebView does, by default, is show a web page. When developing an Android application, if the web page you plan to load in your WebView uses JavaScript, you must enable JavaScript for your WebView.

Once JavaScript is enabled, you can create interfaces between your application code and your JavaScript code.

addJavascriptInterface (Object object, String name) method:
The addJavascriptInterface method injects a supplied Java object into WebView.
The object is injected into the JavaScript context of the main frame, using a supplied name and this allows the Java object’s methods to be accessed from JavaScript.

For applications running Android 4.1 or older, all public methods (including the inherited ones) can be accessed, so when a user’s installed application with addJavascriptInterface method loads an external webpage it can use WebView and javascript to call a java object (like a ‘Javascript pipeline’ and usage of reflection to invoke any other unregistered Java class) which allows attackers to call Android’s Java methods.

The Fix:
For applications running Android 4.2 all public methods that are annotated with JavascriptInterface can be accessed from JavaScript.

So if you develop an application for SDK version 17 or higher, you must add the @JavascriptInterface annotation to any method that you want available to your JavaScript.

If you do not provide the annotation, the method is not accessible by your web page when running on Android 4.2 or higher.

Infection Method:
Users can be infected when they click on a URL link using a vulnerable application that allows opening a Java enabled browser or web page.

The device will automatically perform the malicious actions that were ordered in the malicious web page that contain those JavaScript commands.

The commands in the JavaScript code can enable attackers to install malicious software, send SMSs, steal personal information and more.

Source: Analyzing an Android WebView exploit : AVG Official Blogs

Aug 14 2013

Android Malware Exploiting Google Cloud Messaging Service

Google Cloud Messaging Hacking Researchers have discovered a number of malicious Android apps are using Google’s Cloud Messaging (GCM) service and leveraging it as a command and control server to carry out attacks.

A post on Securelist today by Kaspersky Lab’s Roman Unuchek, breaks down five Trojans that have been spotted checking in with GCM after launching.

  • Trojan-SMS.AndroidOS.FakeInst.a
  • Trojan-SMS.AndroidOS.Agent.ao
  • Trojan-SMS.AndroidOS.OpFake.a
  • Backdoor.AndroidOS.Maxit.a
  • Trojan-SMS.AndroidOS.Agent.az

These trojans having a relatively wide range of functions:

— Sending premium text messages to a specified number
— Sending text messages to a specified number on the contact list
— Performing self-updates
— Stealing text messages
— Deleting incoming text messages that meet the criteria set by the C&C
— Theft of contacts
— Replacing the C&C or GCM numbers
— Stopping or restarting its operations
— Generate shortcuts to malicious sites
— Initiate phone calls
— Collect information about the phone and the SIM card & upload on server

Kaspersky Lab detected millions of installers in over 130 countries and Kaspersky Mobile Security (KMS) blocked attempted installations for these Trojans.

No doubt, GCM is a useful service for legitimate software developers. But virus writers are using Google Cloud Messaging as an additional C&C for their Trojans. Furthermore, the execution of commands received from GCM is performed by the GCM system and it is impossible to block them directly on an infected device.

The only way to cut this channel off from virus writers is to block developer accounts with IDs linked to the registration of malicious programs.

Jul 05 2012

Android Clickjacking Rootkit Demonstrated

ClickJackingA team of security researchers have demonstrated how a security flaw in Android 4.0.4 can be exploited by a clickjacking rootkit.

The research team is lead by North Carolina State University professor Xuxian Jiang, who succeeded in developing a proof-of-concept rootkit that attacks the Android framework as opposed to the underlying operating system kernel. The researchers contend that such a rootkit could potentially be downloaded with an infected app and be used to manipulate the smartphone.

In the video, the demonstrator was able to hide applications on the device, as well as get them to launch when icons for other applications are clicked. If downloaded with an infected application, the rootkit could for example hide the smartphone’s browser and replace it with a browser that looks exactly the same but actually steals all of the user’s information.

Dec 16 2011

Apple Crash Reports to Jailbreak iPhone

Apple Jailbreak ExploitThousands of iPhone owners have joined forces with a team of hackers to help them find new ways to jailbreak Apple’s phone software.

Jailbreaking involves unlocking a device so that it is not restricted to running software officially approved by the manufacturer.

Mobile phones that run Google’s Android operating system do not face this restriction and Microsoft allows its Windows Phone 7 operating system to be unlocked. But Apple has always fought very hard to prevent anyone jailbreaking its devices.

The latest version of the iPhone’s operating system is proving to be extremely hard to jailbreak fully, according to Joshua Hill, a member of the Chronic Dev hacker team.

“Apple is really making it tough for us. The iPhone is now better protected than most nuclear missile facilities,” he says.

Bug Hunt
Bugs may result in a program crashing or shutting down, and they are like gold dust to hackers because sometimes they can be exploited to create a jailbreak.

To help prevent this, Apple’s phones record details of program crashes and send these reports back to the company. Apple’s programmers can then analyse the crash reports and fix any underlying bugs that pose serious security risks.

Crash Reports
The solution to this problem is to subvert Apple’s crash reporting capability by turning it against the company, he says.

“Chronic Dev is ready to turn this little information battle into an all-out, no-holds-barred information WAR,” Mr Hill wrote on the Chronic-Dev blog recently, using his nom de guerre Posixninja.

To do this he has written and distributed a program called CDevreporter that iPhone users can download to their PC or Mac. The program intercepts crash reports from their phones destined for Apple and sends them to the Chronic Dev team.

“In the first couple of days after we released CDevreporter we received about twelve million crash reports,” he says.

Legal Breaks
Jailbreaking phones is legal in the United States, thanks to a ruling in July 2010 by the Library of Congress – an agency that carries out legal research for the US government.

“There’s nothing Apple can do that would make jailbreaking impossible,” he says.

“Apple will always add new features to its phones, and there will always be bugs in its software. It’s just a matter of find the right ones.”