UAHuntsville
Android Hacking and Analysis The Department of
Electrical
THE UNIVERSITY OF ALABAMA IN HUNTSVILLE
Engineering
Daun Lee, Seungwon Keum
Research Objective Android Security Android Propagation Hacking Method & Analysis
Android is based on Linux kernel security. The features of Linux on security are The function doExcuteTask run remote-controll on a victim’s
Smartphones become the most essential user-based permission models and process isolations. Especially, the process smartphone. The function doExcuteTask has five C&C command
There are many different methods for the propagation (execHompage, execInstall, execOpenUrl, execDelete, and
isolation is an important security key in Linux and Android because it prevents
part of modern life. Five billion people use mobile a third party from reading files and using resources and memory. Furthermore, execStartApp). The command execHompage orders to open the website
of malware and botnet in Android platform. Today,
phones and among the five billion, one billion the sandbox in the kernel layer isolates application data and code execution that is prepared by a hacker. The command execInstall install malicious
from other applications . Since sandbox is in the kernel layer, that effects whole application from the prepared website. The command execStartApp
people use smartphones around the world. There layers in the security. Android 3.0 offers full encryption. The file system
SMS/MMS (malicious link), malicious application, wireless
runs the application which is prepared in the URL. The command
are 91 million smartphone users in the United encryption makes users to save their data from third parties. The password of connections (Bluetooth), and kernel layer hacking are execOpenUrl is to open the URL. The command execDelete is to delete
States. As the smartphone market sharply grows, the encryption is the same as user’s password on Android device . An Android a file.
application has the same permission limitation for security in order to protect commonly used. We will show the hacking methods and
the threats against smartphones also are its data . For example, the application limits call, GPS, SMS/MMS, etc. by
increasing. For example, the mobile permission security. However, the permission can be changed by Android OS. analysis for SMS/MMS, malicious application, and kernel
For example, applications ask permissions from users. The application
botnets/malwares are very critical problems that developer codes the permission in manifest. Permission selection can be layer hacking on Android smartphones later
smartphones encounter. For example, a botmaster chosen when a user installs a new application .
uses an application in order to make slave mobile
bots. In fact, these bots are infected by
downloading applications from application
markets. There are more than 200,000 applications
in the official Android market in 2011. There have Hacking Method & Analysis Figure 7. Function doExecuteTask
been several attempts to track mobile There is a botnet called ‘DroidKungFu’ from App-Market in China. This Android platform is also weak on Wi-Fi packet sniffing. Anyone can catch
botnets/malware. Nevertheless, the numbers of application spreads through re-packaging normal applications. Once this packets without Android hacking knowledge by using Rootkit application.
First, you need to jail-break on your Android phone. Then, install Rootkit
mobile botnet/malware infected smartphones are application being installed, it transfers information from the victim’s
application. After the installation, you can see all Wi-Fi users’ information
smartphone to certain sever. Figure 2 and Figure 3 show how
increasing. Moreover, it is threatening the mobile ‘doSearchReport( ) -> updateInfo( )’ function collects the victim’s through the application. Figure 8 shows Wi-Fi users information.
network. Furthermore, mobile botnet/malware information. Furthermore, you can get information about personal privacy information
by analyzing packets. Figure 9 shows an Android smartphone user who is
tracking techniques will be discussed. connected to UAH website.
The Platform of Andorid
Understanding Android malware/botnet analysis and
Figure 8. Wi-Fi user information
tracking techniques requires knowledge on Android operating Figure 4. Function GetPermission3
system (OS). Android is composed of Linux kernel,
This exploit is /assets/ratc, encrypted by AES algorithm. It is executed with
middleware, libraries, framework, and application software. decryption when the application is installed. Figure 5 shows is the key for
The structure of Android application is shown in Figure 1. decryption.
Android OS uses a Linux-based system for smartphones.
Developers use Android software development kit written in
Java language to make applications. It can be extended in C or Figure 2. Function doSearchReport
C++ in the libraries layer. In the runtime layer, applications are
You can get imei, ostype, osapi, model, SDKVerion, SDcard information,
executed in Dalvik virtual machine (DVM). DVM translates internal memory size, net operator, phone number, and running service Figure 9. Android Phone user’s packet information
javabytecode to Dalvik dex-code. Java virtual machine (JVM) is Figure 5. Key for Encryption
from function updateInfo. Since an attacker got the victim’s all information
stack-based. Unlikely, DVM is register-based that can assign from function doSearchReport, the attacker needs to get permission on
variables to 216 resisters. So, they can use memory more Android platform. Figure 4 shows the function getPermission3 in which
efficiently. The Linux kernel layer has an important role attackers are rooting the target smartphone.
because it has main system functions such as memory,
security, and network. Conclusion
As smartphone users are sharply increasing, a
mobile network is targeted to hacker groups.
Actually, mobile devices have more private stuffs
than PCs. For this reason, hacker groups are
focusing on mobile devices than PC. In this project,
we have discussed the hacking methods and
analysis for android platform. In order to maintain
Figure 6. Function cpLegacyRes
mobile security from the threat of hacker groups,
When the rooting process has executed, the application will install a
defenders need to make corporation to share their
malicious app that is hidden in ‘assets’. This malicious application techniques and information for the threat from
impersonates the well-known Google search application but this application botnets and malware. Furthermore, mobile carriers
Figure 3. Function updateInfo name is ‘Google SSearch’. Figure 6 shows function cpLegacyRes that installs
malicious applications in ‘assets’. and defender groups should work together and
Figure 1. Structure of Android Application
keep developing their detection technologies.
