Mishaal:
00:00:02
Hello, and welcome to Android bys powered by Esper, the podcast that
Mishaal:
00:00:05
dives deep into the world of Android.
Mishaal:
00:00:07
I'm Michelle Ramon.
Mishaal:
00:00:08
And while I'd normally be joined by my co-host David Ruddock, he unfortunately
Mishaal:
00:00:11
couldn't make it to this one.
Mishaal:
00:00:13
Still.
Mishaal:
00:00:13
We've got a great topic and guest lined up on the show this week,
Mishaal:
00:00:16
we'll be talking about security, specifically mobile app security.
Mishaal:
00:00:19
So if you listen to our podcast before, you know, we've talked about Android
Mishaal:
00:00:23
security model, at least when it comes to applications, as well as our
Mishaal:
00:00:26
permissions work in the previous episode.
Mishaal:
00:00:28
But this time, we want to focus more specifically on how Google app
Mishaal:
00:00:31
developers and outside firms team up to protect you and your Android device.
Mishaal:
00:00:35
So today we've invited Brian Reed, chief mobility officer at now secure
Mishaal:
00:00:40
to talk about mobile app security.
Mishaal:
00:00:41
Welcome to the show,
Brian:
00:00:42
Brian.
Brian:
00:00:43
Thanks, Michelle.
Brian:
00:00:44
It's great to be here and part of your community.
Brian:
00:00:45
Thanks for having me.
Brian:
00:00:46
Thanks for joining us.
Brian:
00:00:47
So
Mishaal:
00:00:48
this is the topic that in my now seven years of covering Android, you know,
Mishaal:
00:00:52
I've kind of delved into the security side a bit here and there, even though, while
Mishaal:
00:00:57
it's been up in my primary focus, just covering the Android platform ecosystem,
Mishaal:
00:01:00
these security issues come up and tend to cover them pretty much every week.
Mishaal:
00:01:05
You'll hear from some mobile security threat firm that there's
Mishaal:
00:01:07
some new malware strain out in the wild, and that is wing havoc.
Mishaal:
00:01:11
And then when you dive into the details you discover, oh, they're mostly misusing
Mishaal:
00:01:15
some Android API or application some permission or they're tricking users
Mishaal:
00:01:19
into enabling some sensitive permiss.
Mishaal:
00:01:22
And so like, this is a topic that is ever pervasive in our lives, because
Mishaal:
00:01:25
you probably know people in your lives who could be tricked into enabling
Mishaal:
00:01:31
something they shouldn't have when songs something they shouldn't have.
Mishaal:
00:01:33
And even if you think that you wouldn't do that, there's a very high
Mishaal:
00:01:37
chance that you could be tricked to.
Mishaal:
00:01:39
No one is ever completely foolproof from fishing or any other malware attacks.
Mishaal:
00:01:45
There are many things you can do to prevent yourself from
Mishaal:
00:01:47
being taken advantage of.
Mishaal:
00:01:48
But on the ecosystem side, there are also many things that Android
Mishaal:
00:01:51
does and that Google does and that outside firms can do to proactively
Mishaal:
00:01:56
protect you from harming yourself.
Mishaal:
00:01:59
So just so we're all on the same page, I kind of wanna just touch upon
Mishaal:
00:02:02
the background of Android security model and how Android actually
Mishaal:
00:02:06
protects you at a platform level.
Mishaal:
00:02:08
So we talked about this before, but every time you install
Mishaal:
00:02:10
an app, it comes an APK file.
Mishaal:
00:02:12
And within that APK file.
Mishaal:
00:02:14
There's all the assets, the code, the resources, et cetera, but there's also
Mishaal:
00:02:17
a digital signature that is generated whenever the developer signs a package.
Mishaal:
00:02:21
And whenever that app installs on your device, it's given a unique package name.
Mishaal:
00:02:26
And whenever you try to install an app that has a package name matching an
Mishaal:
00:02:31
existing app, it installed on the device.
Mishaal:
00:02:32
If that signature doesn't match the signature, that was with the previous.
Mishaal:
00:02:37
Then Android will object the installation.
Mishaal:
00:02:39
And because it's assumed that the signing key, the developer used to sign that
Mishaal:
00:02:42
app is generally kept somewhere safe and secure within their own repository on
Mishaal:
00:02:46
their computer, or upload it to Google.
Mishaal:
00:02:48
Then you can assume that some third party didn't just modify
Mishaal:
00:02:52
the app and then upload it.
Mishaal:
00:02:53
And then you installed it onto your device.
Mishaal:
00:02:55
So that's how Android generally secures updating applications.
Mishaal:
00:02:59
The one challenge with that is while it ensures that some outside developer
Mishaal:
00:03:03
didn't modify and push an app onto your device, it doesn't guarantee that the
Mishaal:
00:03:07
update hasn't been tampered with hasn't had in any malicious or potentially
Mishaal:
00:03:11
harmful code within the update.
Mishaal:
00:03:13
Like it could still be signed by the original developer, but how do you.
Mishaal:
00:03:17
If that update is still safe to use.
Mishaal:
00:03:19
And that's generally where firms like now secure come in.
Mishaal:
00:03:23
So I wanted to ask you, Brian, can you tell us a bit about the company?
Mishaal:
00:03:26
Sure.
Brian:
00:03:26
So now secure actually got started as a forensics company in 2008 and 2009.
Brian:
00:03:31
So the birth of Android that was around the same time as iOS.
Brian:
00:03:36
Our founder got interested in these cool little devices that seemed to
Brian:
00:03:39
have a whole lot of computing power and a lot of forensic data on him.
Brian:
00:03:42
And while he wasn't a forensic specialist, he actually became the world's expert
Brian:
00:03:46
in mobile forensics and ultimately build a business that is now secure today.
Brian:
00:03:49
We're kind of an all in one solution provider we have for
Brian:
00:03:53
mobile application securities.
Brian:
00:03:54
So we have testing tools, developing tools, pen testing
Brian:
00:03:57
services, open source tools.
Brian:
00:03:59
Training all of those kinds of things and partner with lots of organizations
Brian:
00:04:02
to make sure they're able to deliver those secure applications on whatever
Brian:
00:04:06
mobile operating system they want.
Brian:
00:04:07
So our roots are in Android, cuz that's really where he started and we
Brian:
00:04:10
continue to do a lot with Google and the entire ecosystem community today.
Mishaal:
00:04:15
Thanks Brian.
Mishaal:
00:04:15
And just to follow up on the Android aspect, one other thing that Android
Mishaal:
00:04:19
does at the platform level to protect you is that it has a very secure
Mishaal:
00:04:23
model of protecting applications from interacting with other applications.
Mishaal:
00:04:27
So you may have heard the term sandbox before.
Mishaal:
00:04:29
So whenever you install an app on Android, every app that has a unique
Mishaal:
00:04:33
package name, you know, every app has to have a unique package name.
Mishaal:
00:04:36
You can't have two apps with the same package name solved on a.
Mishaal:
00:04:39
So what happens is that that package is assigned a, a unique identifier.
Mishaal:
00:04:43
And when you run that app, Android runs it in a container
Mishaal:
00:04:46
and it's called the process.
Mishaal:
00:04:47
And then that identifier is called the P I D for that process.
Mishaal:
00:04:50
So by putting processes in containers, Android ensures
Mishaal:
00:04:53
that apps can only interact with other apps through a well-defined
Mishaal:
00:04:58
process called the binder IPC.
Mishaal:
00:05:00
So this way apps can only interact and only execute only like send a
Mishaal:
00:05:04
request to get data from another app.
Mishaal:
00:05:06
Through well defined permissions through well defined, intense and whatnot.
Mishaal:
00:05:12
So like you can't just have one app poking around the data of another app
Mishaal:
00:05:14
without break the sandbox, which is just not something that is very easily
Mishaal:
00:05:18
achievable without some very serious exploit in the Android platform.
Mishaal:
00:05:22
I wanted to ask you, Brian, how does this in your experience,
Mishaal:
00:05:25
how does Android security model compare to other operating systems?
Mishaal:
00:05:29
Would you say it's more or less secure?
Brian:
00:05:31
Yeah, that's always a loaded question.
Brian:
00:05:33
What I would say is that the Linux kernel underneath the Android in and
Brian:
00:05:36
of itself with its advanced security capabilities, gives it a strength.
Brian:
00:05:40
Apple has a more closed system on iOS, just in terms of how they operate.
Brian:
00:05:44
Uh, the sandboxing model is very strong.
Brian:
00:05:46
You know, the containerization of applications, the
Brian:
00:05:48
control of the IPC channel.
Brian:
00:05:50
All of those things are good strengths for Android.
Brian:
00:05:53
What's been really interesting to watch is that Android kind of was very heavy.
Brian:
00:05:57
I've been around this since Blackberry, just to be my background.
Brian:
00:06:00
I was with the original mobile security company called Blackberry.
Brian:
00:06:03
So I've seen a lot over the years and Blackberry was completely locked down
Brian:
00:06:06
and completely impossible to innovate.
Brian:
00:06:08
Just about it all, but it was really secure, right?
Brian:
00:06:10
And that's an example of a niche user experience with high security,
Brian:
00:06:14
but it was really inflexible when you wanted to write applications.
Brian:
00:06:17
The Android world kind of has two communities.
Brian:
00:06:19
You have the, I just wanna get stuff done.
Brian:
00:06:21
And then you have kind of the fanboy world I wanna customize
Brian:
00:06:24
and do really interesting things and, you know, so on and so forth,
Brian:
00:06:26
which leads to rooting and more customizations in the operating system.
Brian:
00:06:30
What has been really interesting to watch is that Android has become incredibly.
Brian:
00:06:34
If you look at the number of CVEs and cess listed for Android operating system
Brian:
00:06:39
or for device hardware for at least the tier one manufacturers, they have gone
Brian:
00:06:43
down as a rate over time, apple hasn't.
Brian:
00:06:46
Now apple may have been a little bit ahead.
Brian:
00:06:48
So there sort of is this, it depends.
Brian:
00:06:51
On who your hardware manufacturer is, how they are properly or improperly
Brian:
00:06:55
using the operating system and the licensing that they're doing around the
Brian:
00:06:58
play store and the tooling around that.
Brian:
00:07:00
But Android today is a very safe environment.
Brian:
00:07:02
And so I live in a blended world.
Brian:
00:07:04
So I have yes, one of everything because I'm in a mobile business.
Brian:
00:07:07
I have no qualms about saying which device or which operating system is better.
Brian:
00:07:11
Android and iOS are both better than windows, frankly.
Brian:
00:07:13
And so from that perspective, there's lots of different places we can go
Brian:
00:07:17
in terms of talking about, well, how do I make sure I'm safe and secure?
Brian:
00:07:19
And how do I make sure I do the right things?
Brian:
00:07:21
You mentioned
Mishaal:
00:07:22
something that I wanna kind of wanted to follow up on power users.
Mishaal:
00:07:24
You know, there are people who like the brute and tinker their devices.
Mishaal:
00:07:27
That's something that wasn't really possible with the older,
Mishaal:
00:07:29
more lockdown operating systems and current ones like iOS.
Mishaal:
00:07:33
So on Android, you are allowed.
Mishaal:
00:07:35
Side load applications.
Mishaal:
00:07:36
This term side loading.
Mishaal:
00:07:37
Isn't really much of a thing in the windows world, but it is
Mishaal:
00:07:40
something that exists in Android.
Mishaal:
00:07:42
And in order to side load, an application from outside of the official
Mishaal:
00:07:45
Google play store, you have to opt in, you have to enable permission.
Mishaal:
00:07:49
You have to do it on a per application basis.
Mishaal:
00:07:51
And there are also other security features that kind of irk power users.
Mishaal:
00:07:56
And I wanted to ask you your thoughts first on side loading.
Mishaal:
00:07:59
Like how does Google balance.
Mishaal:
00:08:01
Ability to allow users to side load applications with actually protecting
Mishaal:
00:08:05
them from installing something that's potentially untrusted.
Brian:
00:08:08
Yeah.
Brian:
00:08:08
I think there's kind of two ways to look at it.
Brian:
00:08:10
So I'm gonna take a macro view and then kind of a micro view.
Brian:
00:08:12
So the macro view is there are three or 4 billion users of Android, and
Brian:
00:08:18
that means everybody of every kind everywhere in the world, trying
Brian:
00:08:21
to do everything you can imagine.
Brian:
00:08:22
Right.
Brian:
00:08:23
And so there's lots of different segments of people that wanna
Brian:
00:08:26
use it in certain behavior.
Brian:
00:08:27
I do a lot of work with companies that use lockdown, Android tablets that are
Brian:
00:08:30
purpose designed for a specific use.
Brian:
00:08:32
They may have one application on them.
Brian:
00:08:35
I do work in automotives.
Brian:
00:08:36
I do work in healthcare, right?
Brian:
00:08:38
And so there's that class financial services where regulatory matters control
Brian:
00:08:42
matters, sensitive data matters you as a patient, don't want that data lost.
Brian:
00:08:47
If it's your car, you don't want that car broken into.
Brian:
00:08:50
Right.
Brian:
00:08:50
So there's that category.
Brian:
00:08:52
And then you kind of move into the more general maybe business user.
Brian:
00:08:55
Then you move into the more generalized consumer and then you move into the
Brian:
00:08:58
tinkerer category, like the fanboy and you know, and what I think
Brian:
00:09:02
Google's done a pretty good job of is trying to balance all of them, right.
Brian:
00:09:05
From that perspective.
Brian:
00:09:05
And so they've set up the guardrails.
Brian:
00:09:08
They've continued to improve the guardrails and gates to
Brian:
00:09:11
make it hard to be malicious.
Brian:
00:09:14
So you've got the containerized model.
Brian:
00:09:16
We just talked about side loading to me is an enabler for the category
Brian:
00:09:20
of people who want it, but most people should stay away from it.
Brian:
00:09:23
If you were to ask me how do regular people, consumers, not more technical,
Brian:
00:09:27
advanced customizer, stay safe.
Brian:
00:09:29
Don't side.
Brian:
00:09:31
Because Google play with play protect data, safety labels, and all of the system
Brian:
00:09:36
services that are built into the premium level are designed to keep you safe.
Brian:
00:09:40
And it's really easy to stay safe when you're leveraging those things.
Brian:
00:09:43
Side loading is one of the top malware paths.
Brian:
00:09:45
The other biggest breach vector actually is SMS fishing, and that's not Google
Brian:
00:09:50
or apple or anybody else's fault.
Brian:
00:09:52
That's the nature of the way SMS behaves.
Brian:
00:09:54
And that's a whole different security conversation.
Brian:
00:09:56
And the fact that people click on that stuff just in the same way,
Brian:
00:09:58
they sometimes click on spam email.
Brian:
00:10:00
Right.
Brian:
00:10:01
So side loading, isn't a bad thing, but side loading can get you in trouble.
Brian:
00:10:05
So you really should focus on brand name apps from brand name companies,
Brian:
00:10:08
you know, that have attestation in them with data safety program.
Brian:
00:10:13
That have four or more stars have millions of downloads, right?
Brian:
00:10:17
That's just the collective being safe, doing the smart thing, which
Brian:
00:10:20
is probably 80% of the world really.
Mishaal:
00:10:23
Right.
Mishaal:
00:10:23
I kind of like in side loading to deciding where to purchase something online.
Mishaal:
00:10:27
So if you're a side loader, you're kind of bypassing all the.
Mishaal:
00:10:31
Extra scrutiny that is placed on those applications by Google play and by
Mishaal:
00:10:36
play protect and all the stuff that's that developers have to go through
Mishaal:
00:10:39
to even get their apps on there.
Mishaal:
00:10:40
So like if you were to shop online, sure.
Mishaal:
00:10:43
You could go to all express.
Mishaal:
00:10:44
You could find literally anything you want at any time, but you're
Mishaal:
00:10:47
kind of putting yourself at risk by, you know, are you actually gonna
Mishaal:
00:10:50
get what you're trying to order?
Mishaal:
00:10:52
Is the seller actually legitimate is the product actually as described.
Mishaal:
00:10:56
Or could you just do the easy thing and go to like Amazon, you know?
Mishaal:
00:11:00
Sure.
Mishaal:
00:11:00
There are going to be some fakes.
Mishaal:
00:11:02
There are going to pieces of product issues, but generally those are
Mishaal:
00:11:04
more vetted because there's more barriers to entry to get on there.
Brian:
00:11:08
Right.
Brian:
00:11:08
You know, a lot of this is risk and reward for the bad guys.
Brian:
00:11:10
Right?
Brian:
00:11:11
So those barriers of entry, the friction that's put in the system make it harder
Brian:
00:11:14
for the people who wanna be malicious to behave malicious and the cost of being M.
Brian:
00:11:18
Becomes so high, it's not worth it.
Brian:
00:11:20
So from that perspective, take advantage of everything.
Brian:
00:11:23
You can buy a first class device from a first class vendor, make sure they're
Brian:
00:11:27
using they're licensing, Google correctly, and leveraging that technology and so
Brian:
00:11:30
on and so forth and you can be safe.
Brian:
00:11:32
And when we look at what Google has done for the two primary safety systems, we
Brian:
00:11:35
have the play protect side of the house.
Brian:
00:11:38
We have the data safety label side of the house and data safety labels just
Brian:
00:11:41
became mandatory in the last week.
Brian:
00:11:44
And so between those two things, if I can play protect is basically
Brian:
00:11:48
Google's giant malware engine.
Brian:
00:11:50
Google is continuously scanning for malware.
Brian:
00:11:53
Google has a lot of partners that are in security and endpoint management that are
Brian:
00:11:57
contributing to the malware signature.
Brian:
00:12:00
While you sometimes see it.
Brian:
00:12:01
And I'm not saying they're in any it's way better now than it used to be.
Brian:
00:12:04
And that database allow our signatures and the sophistication of the testing
Brian:
00:12:07
between Google and Google's partners continues to get better and better and
Brian:
00:12:10
better take advantage of play protect.
Brian:
00:12:12
You can run it on your own device.
Brian:
00:12:14
It's being scanned when it's going into the app store.
Brian:
00:12:16
If you find something reported and kind of help the community, the data
Brian:
00:12:20
safety label is really interesting.
Brian:
00:12:22
So I'll show my age.
Brian:
00:12:24
I remember when my parents would only buy electronics if they had the
Brian:
00:12:27
underwriter's laboratory safety label on it, which meant some third party
Brian:
00:12:32
company tested that piece of electronics.
Brian:
00:12:35
So it wouldn't like burn you or blow up your house or, you
Brian:
00:12:38
know, something else like that.
Brian:
00:12:39
And for the first time, anywhere in software that I have ever seen, Google's
Brian:
00:12:43
actually added labeling that this thing's.
Brian:
00:12:46
It's called a data safety label.
Brian:
00:12:48
And so one half of a label is the software developer is going to attest and say,
Brian:
00:12:53
here is what my app does with your data.
Brian:
00:12:56
I transmit it.
Brian:
00:12:57
I collect it.
Brian:
00:12:57
I send it.
Brian:
00:12:58
What have you, the other half is you can get an independent security verification
Brian:
00:13:03
done by an accredited third party.
Brian:
00:13:05
And that accredited third party now secures one of them will actually
Brian:
00:13:08
test it sufficiently to say, yeah, this app is safe based on
Brian:
00:13:11
this industry standard benchmark.
Brian:
00:13:13
That's like a good housekeeping seal of approval or underwriter's
Brian:
00:13:16
lab label on it now.
Brian:
00:13:18
So now with play protect, I'm protecting myself from malware
Brian:
00:13:21
with data safety labels.
Brian:
00:13:23
I'm also ensuring that the app manufacturer is doing the right thing.
Brian:
00:13:27
And that's really great for users.
Brian:
00:13:28
So
Mishaal:
00:13:28
just to take a step back, because on this show, we love to
Mishaal:
00:13:31
talk about a O S P and GMs, and try to differentiate between them.
Mishaal:
00:13:35
Google play protect, as Brian had mentioned is part
Mishaal:
00:13:38
of Google mobile services.
Mishaal:
00:13:39
So it's something that is available on devices with GMs, Android.
Mishaal:
00:13:43
So, if you were to compile a S P from Google ski repositories, you would
Mishaal:
00:13:48
not have play protect available to you because it is part of, I believe Google
Mishaal:
00:13:51
play store app itself, or Google play services, either one of those two.
Mishaal:
00:13:56
And as Brian mentioned, it is a massive database of malware signatures.
Mishaal:
00:14:00
And I kind of wanted to talk about now, like I wanted to ask you how exactly.
Mishaal:
00:14:04
Is that malware signature database actually built.
Mishaal:
00:14:07
How does Google go out and decide to add something to its database?
Mishaal:
00:14:12
So for the two who looked up anything related to this before you might have
Mishaal:
00:14:15
heard terms like static and dynamic analysis, can you walk us through what
Brian:
00:14:18
those mean?
Brian:
00:14:19
Sure.
Brian:
00:14:19
So there is something called the app defense Alliance.
Brian:
00:14:22
So I'm just gonna introduce the, how does the data get collected?
Brian:
00:14:25
So the app defense Alliance was created.
Brian:
00:14:28
Five six years ago.
Brian:
00:14:29
And it's a group of folks who do malware.
Brian:
00:14:32
They do endpoint management, they do antivirus a lot of the subjects
Brian:
00:14:36
you might expect in this world.
Brian:
00:14:38
And so Google said, Hey, we wanna crowdsource this stuff.
Brian:
00:14:41
We've got a whole bunch.
Brian:
00:14:42
We know you have more.
Brian:
00:14:42
So let's start collecting them.
Brian:
00:14:44
So through all of the different vendors who participate in that, when
Brian:
00:14:47
they find something, they submit it through a special channel to Google.
Brian:
00:14:49
Google adds it to their database, verifies that the giant database gets bigger.
Brian:
00:14:53
And it's because there's multiple vendors scanning billions of device.
Brian:
00:14:57
You get a pretty good signature database as a result of that.
Brian:
00:14:59
Now, what we're all doing under the hood is we're basically doing
Brian:
00:15:03
some combination of static and dynamic analysis or SAST and DAS.
Brian:
00:15:07
And so SAST is basically scanning code either the source code or binary image
Brian:
00:15:13
of the app to statically identify coding failures in the application.
Brian:
00:15:18
So with SAST, you might find things like say hard coded secrets embedded
Brian:
00:15:24
in the application or debugging code that made it into production
Brian:
00:15:28
in the app store submission or hard coded URLs or stuff like that.
Brian:
00:15:32
Those are vulnerabilities.
Brian:
00:15:33
You could.
Brian:
00:15:34
You can also find malicious behavior, like, Hey, it's scooping up this data
Brian:
00:15:37
and transmitting it to this IP address.
Brian:
00:15:39
And then dat, which is dynamic analysis is actually running the app.
Brian:
00:15:43
Most of us who participate in the program have some sort of dynamic
Brian:
00:15:47
analysis, which we observe the app running on a real device, whether it's
Brian:
00:15:50
in a lab or it's on some customer's device that has an agent running on it.
Brian:
00:15:54
And we see the malicious behavior, we capture it.
Brian:
00:15:56
So dynamic finds things like permissions, escalation,
Brian:
00:16:00
because something changes over.
Brian:
00:16:02
It finds transmission of sensitive data that maybe shouldn't be there.
Brian:
00:16:05
Is that data properly encrypted?
Brian:
00:16:06
Does it go to a bad end point?
Brian:
00:16:08
That's a known malware harvester endpoint from the endpoint databases on the.
Brian:
00:16:13
Things like that.
Brian:
00:16:14
So what's interesting about it is the collective is kinda looking for
Brian:
00:16:18
malware through bad behaviors, but also looking for vulnerabilities.
Brian:
00:16:21
Some of the more recent issues we found in the market weren't actually malware.
Brian:
00:16:25
They were vulnerable commercial applications used by millions of
Brian:
00:16:28
people where the bad guys figured out how to exploit weakness in them.
Brian:
00:16:31
There was a security weakness that their developers had introduced to.
Brian:
00:16:35
So that's a little bit about how that works.
Brian:
00:16:36
Now, the app defense Alliance recently added the MAs specification,
Brian:
00:16:41
which is that independent security verification strategy.
Brian:
00:16:44
So this is how to use SAS and dat to analyze the app for vulnerabilities that
Brian:
00:16:48
could be exploited work with the vendor to fix them, and then give them that good
Brian:
00:16:52
housekeeping label of approval, which is the independent security review stamp.
Brian:
00:16:57
So that when you go their data safety label, In the Google play store.
Brian:
00:17:00
You see, it says independent security review has been completed
Brian:
00:17:04
by an attested third party.
Brian:
00:17:05
This is deep save for use in these categories.
Brian:
00:17:08
And now you have that attestation, which is great from the third party.
Brian:
00:17:12
So you mentioned
Mishaal:
00:17:12
before that, you know, you typically look at either the source
Mishaal:
00:17:15
code or the compiled code of an application, and I'm guessing like 99%
Mishaal:
00:17:19
of the time you don't have access to the source code of the application.
Mishaal:
00:17:22
You're looking for most of the time, you're looking at the binary, the
Mishaal:
00:17:25
compiled binary, and you'd have to use some kind of de compilation.
Mishaal:
00:17:28
Or some kind of analyzer to analyze behavior while it's on device.
Mishaal:
00:17:32
Can you tell us about like some of the tools that you might use?
Mishaal:
00:17:34
Are they like all inhouse?
Mishaal:
00:17:36
We use any
Brian:
00:17:36
commercial for those who are into reversing, you may have heard of Frida
Brian:
00:17:40
and rod Aari are the top two reversing disassembly tools in the market.
Brian:
00:17:45
Frida and red were created by researchers on our now secure.
Brian:
00:17:49
And pancake are their handles.
Brian:
00:17:51
And so those are used by a lot of security researchers.
Brian:
00:17:54
They're also used in some other tooling by other folks, and
Brian:
00:17:57
those are embedded in our tools.
Brian:
00:17:58
So we can reverse and disassemble an iOS or an Android app, whether it's DRM
Brian:
00:18:02
or not with it, you can break most of the obfuscation tools and hook the app.
Brian:
00:18:07
Even the ones that have anti Frita capabilities in it, it's
Brian:
00:18:10
like a cat and mouse game.
Brian:
00:18:11
They try to block and then you find new ways around it.
Brian:
00:18:14
But in reversing it, you can get down to bite code or Java code or some
Brian:
00:18:17
intermediate language that you can then scan to get a sense from a static
Brian:
00:18:20
perspective about what's going on.
Brian:
00:18:23
What I will say is that freedom and Dari are great tools.
Brian:
00:18:25
Have a look at them.
Brian:
00:18:26
If you really wanna kinda learn your way through what this world looks.
Brian:
00:18:30
There's some free training on how to use freedom, Ary and participate in the
Brian:
00:18:33
community on our academy.now secure.com or you can just find them on the internet.
Brian:
00:18:38
They're great tools.
Brian:
00:18:39
There's some other tools out there.
Brian:
00:18:40
There are various other tools that might go into kit.
Brian:
00:18:42
You might use perp suite to do network sniffing and some things like that
Brian:
00:18:45
when you kind of build out a tool kit.
Brian:
00:18:47
So we leverage those and other advance.
Brian:
00:18:49
IP that we built.
Brian:
00:18:50
So do the other vendors have all built something that involves some combination
Brian:
00:18:53
of static and dynamic analysis?
Mishaal:
00:18:55
Speaking of static and dynamic analysis, there is one thing
Mishaal:
00:18:57
I wanted to follow up with you on.
Mishaal:
00:18:59
And it's something that I think requires some clarification for
Mishaal:
00:19:01
listeners who may not be familiar.
Mishaal:
00:19:03
And it's that why is dynamic analysis actually important to do?
Mishaal:
00:19:07
Why do you have to test on a real device versus why can't you just statically
Mishaal:
00:19:11
analyze the code and look for some, say potentially malicious thing happening.
Brian:
00:19:15
We talked earlier about containers in IPC and data transmission between
Brian:
00:19:21
say two containers or two processes.
Brian:
00:19:22
Right?
Brian:
00:19:23
Well, that's why you need dynamic analysis, static analysis.
Brian:
00:19:26
We'll never see if data was improperly transmitted to the IPC
Brian:
00:19:30
found from one process to another.
Brian:
00:19:32
You need dynamic analysis to understand what's being written to the device in
Brian:
00:19:37
log files, or being stored on the device.
Brian:
00:19:40
We find key material, forensic data.
Brian:
00:19:43
IP.
Brian:
00:19:44
We actually found a, uh, coupon code generator.
Brian:
00:19:47
The actual IP generation of that was spewed out and log
Brian:
00:19:51
files under error conditions.
Brian:
00:19:53
Now static source code scanning.
Brian:
00:19:55
Won't find that you only find that when you run it dynamically.
Brian:
00:19:58
So it's a general rule.
Brian:
00:19:59
Dynamic is about testing the crypto.
Brian:
00:20:02
Is the crypto working correctly.
Brian:
00:20:04
And then it's testing storage, which is what is being written
Brian:
00:20:07
and what can I forensically find?
Brian:
00:20:09
And what's being written into my own address, space, my own storage,
Brian:
00:20:12
other storage file system log files, and then network transmission.
Brian:
00:20:16
So what is getting transmitted over the air?
Brian:
00:20:18
Is it intercept?
Brian:
00:20:20
Am I doing proper certificate pinning?
Brian:
00:20:21
Am I using the TLS channel?
Brian:
00:20:23
Correct.
Brian:
00:20:24
What endpoints am I talking to?
Brian:
00:20:26
Are those endpoints safe?
Brian:
00:20:28
There's a whole bunch of things you can test around authentication
Brian:
00:20:30
and authorization that you'll pick out through testing dynamically.
Brian:
00:20:33
So I'll give you wild data.
Brian:
00:20:35
We scan all the apps in the app store.
Brian:
00:20:37
So there are 6 million app and Google play store apps.
Brian:
00:20:39
Approximately we scan almost all of them on a regular basis.
Brian:
00:20:42
And what I can tell you is that 80% of them have security vulnerability.
Brian:
00:20:47
The good news is 20%.
Brian:
00:20:48
Don't have really bad security vulnerabilities in 'em, but 80% do.
Brian:
00:20:51
And that number's been the same for five or six years since
Brian:
00:20:54
we've been benchmarking them.
Brian:
00:20:56
What's also interesting is that when you carve into that static
Brian:
00:21:00
versus dynamic, almost everything we're finding is dynamically found.
Brian:
00:21:05
It's really hard to do dynamic analysis and dynamic testing
Brian:
00:21:08
at scale in a development.
Brian:
00:21:10
So a lot of 'em just don't do it.
Brian:
00:21:12
So they run a static analyzer until we find a very low proportion
Brian:
00:21:15
of static vulnerabilities in production apps, because most
Brian:
00:21:18
people are using static tools.
Brian:
00:21:20
Dynamic is really hard to do.
Brian:
00:21:22
It's expensive if you pay somebody to do it, not a lot of people do it.
Brian:
00:21:25
And that's why we find that's where most of the vulnerabilities
Brian:
00:21:27
are in storage in crypto, in network and backend APIs by far.
Mishaal:
00:21:32
Yeah, I'm not surprised because you know, they want to avoid detection.
Mishaal:
00:21:35
So if you just have all your malicious code statically, it's in the application
Mishaal:
00:21:39
itself and it's easy to find, then there's nothing in it for them.
Mishaal:
00:21:42
It's, it's gonna be detected and, you know, added to the database
Mishaal:
00:21:44
and then detected in the future again and over and over again.
Mishaal:
00:21:47
And I've heard stories of like these malicious applications
Mishaal:
00:21:50
that behave differently or.
Mishaal:
00:21:52
Different parts of code differently, depending on your location or
Mishaal:
00:21:55
what device you're running or a combination of those factors.
Mishaal:
00:21:58
So like you need to be able to test, and that
Brian:
00:22:00
can be hard to find exactly.
Brian:
00:22:01
It can be hard to find two dynamics.
Brian:
00:22:03
So, uh, screw an ator.
Brian:
00:22:04
You're not necessarily gonna see all the IC conversation to the ator.
Brian:
00:22:07
You're not necessarily gonna see the interaction with the OS layer all the
Brian:
00:22:10
way down through the hardware or the wifi chip before the carrier chip.
Brian:
00:22:13
Right.
Brian:
00:22:13
So what we have found.
Brian:
00:22:16
For a number of clients who have done emulator based
Brian:
00:22:18
testing, they bring it to us.
Brian:
00:22:19
We find stuff.
Brian:
00:22:20
I mean, you can't truly emulate the environment to get full coverage.
Brian:
00:22:24
And again, sometimes it's malware.
Brian:
00:22:26
A lot of it's just vulnerabilities.
Brian:
00:22:27
I mean, last year, Walgreens slack, they had vulnerabilities that were exploited.
Brian:
00:22:33
People stole prescription data to the Walgreens mobile app
Brian:
00:22:36
because of a vulnerability in it.
Brian:
00:22:38
Slack had a zero day.
Brian:
00:22:40
So even what you would think would be really great companies.
Brian:
00:22:43
They can make mistakes, their developers can make mistakes, it might be code.
Brian:
00:22:46
They write party libraries that put in it.
Brian:
00:22:48
But what we're actually seeing is the nation state actors and
Brian:
00:22:51
the criminals are finding these zero days in these applications.
Brian:
00:22:54
And they're exploiting them as bad or worse as they are the malware,
Brian:
00:22:57
the price of building malware and getting it into the app store
Brian:
00:23:00
is getting higher and higher.
Brian:
00:23:01
Cuz it's harder and harder cuz of everything we just talked about today.
Brian:
00:23:04
But you know what, if I can find a zero.
Brian:
00:23:07
In slack and go steal a bunch of corporate data or, you know, shopping cart X and
Brian:
00:23:12
there's numerous applications like that.
Brian:
00:23:14
Well, then I can harvest information off of that and use that, you know, there, uh,
Brian:
00:23:18
if I can diverge for a second, a couple years ago, British airway was preached.
Brian:
00:23:22
They found a weakness in the way British airways mobile app
Brian:
00:23:25
was talking to its back backend.
Brian:
00:23:26
So they learned how to attack the backend by the mobile app.
Brian:
00:23:29
Then they attacked the backend 380,000 records were stolen, including passport
Brian:
00:23:34
information, travel history, credit cards.
Brian:
00:23:36
They were fine.
Brian:
00:23:37
Bridge share was fined 158 million pounds by the EU as the first GDPR.
Brian:
00:23:41
Fine.
Brian:
00:23:42
Now all of that had to do with the fact of a poorly written mobile application.
Brian:
00:23:46
That was exploitable.
Brian:
00:23:48
There was no malware involved.
Brian:
00:23:49
It was just straight up good scientific research that discovered it.
Brian:
00:23:52
And then they used it to go after the back end.
Brian:
00:23:54
And that's what we need to think about is mobile's just part of the overall chain of
Brian:
00:23:58
all the it systems that some company has.
Brian:
00:24:00
Then you make sure the mobile app and what it talks to is secure, whether it's
Brian:
00:24:03
malware or whether it's a commercial app.
Brian:
00:24:06
So this
Mishaal:
00:24:06
whole time we've been talking mostly about malware
Mishaal:
00:24:08
and like malicious applications.
Mishaal:
00:24:09
But if you read online about like what Google pay, protect actually
Mishaal:
00:24:14
identifies it, doesn't usually.
Mishaal:
00:24:16
Positively identify actual malicious behavior.
Mishaal:
00:24:19
It identifies potentially harmful applications.
Mishaal:
00:24:23
Can you describe what exactly qualifies to potentially harmful application?
Brian:
00:24:27
Yeah, so potentially harmful application is the app is collecting and
Brian:
00:24:31
maybe transmitting over the error data.
Brian:
00:24:33
It shouldn't be the app is trying to execute system level commands.
Brian:
00:24:37
It shouldn't have rights to execute.
Brian:
00:24:40
It could be spyware.
Brian:
00:24:41
It could be fishing.
Brian:
00:24:43
You know, more common things.
Brian:
00:24:44
We know it could be ransomware in terms of its behavior.
Brian:
00:24:47
I haven't heard a lot of production ransomware on mobile, but we've seen some
Brian:
00:24:50
academic experiments along those lines.
Brian:
00:24:52
Uh, there's a lot of system logging going on, data harvesting going on.
Brian:
00:24:58
And so what kind of comes back is, Hey, this has some unusual beha,
Brian:
00:25:01
it's a camera app and it's great.
Brian:
00:25:03
The entire contact database and shipped it to the cloud.
Brian:
00:25:05
Right.
Brian:
00:25:06
And that's gonna get a flag.
Brian:
00:25:08
If it's picked up, right?
Brian:
00:25:09
Cause it doesn't make sense that someone who's taking photos is scraping the
Brian:
00:25:12
entire address book off the device or the history of all the wifi nodes that this
Brian:
00:25:17
device ever connected to with the S S I D and whatever passwords hashed or not.
Brian:
00:25:22
Right.
Brian:
00:25:22
So that's part of what it's looking for is it doesn't make sense that this app
Brian:
00:25:26
would be doing that thing, whether it's obviously malicious or possibly malicious.
Mishaal:
00:25:32
Right.
Mishaal:
00:25:32
And another thing is that potentially dodgy and sketchy or malicious behavior,
Mishaal:
00:25:36
isn't only limited to apps that you can install from the Google play store
Mishaal:
00:25:40
or outside of the Google play store.
Mishaal:
00:25:42
It can also be happening within pre-installed applications, which Google
Mishaal:
00:25:46
refers to as mobile bundle applications.
Mishaal:
00:25:49
This isn't really talked about much from what I can see, mostly because it's
Mishaal:
00:25:51
like a conversation Google has with O.
Mishaal:
00:25:54
They have like strict requirements about what these mobile bundle applications can.
Mishaal:
00:25:57
And can't do.
Mishaal:
00:25:58
I wanted to ask you, what do you know about the security risks
Mishaal:
00:26:01
with mobile bundle applications?
Mishaal:
00:26:03
I
Brian:
00:26:03
can't speak for all the carriers.
Brian:
00:26:04
I can't speak for all Google.
Brian:
00:26:06
I can't speak for all the device manufacturers.
Brian:
00:26:08
You need to talk to each of them.
Brian:
00:26:09
What I would say is that most manufacturers and carriers are
Brian:
00:26:11
working hard to do it the right way.
Brian:
00:26:14
So for example, we work with at and T and Google.
Brian:
00:26:18
And so the things that at and T sells are tested and certified by us.
Brian:
00:26:22
And we work with a lot of the other carriers.
Brian:
00:26:24
There are other vendors like us that work with the carriers
Brian:
00:26:26
to try to do the right thing.
Brian:
00:26:27
Google has some attestation and testing requirements that the device manufacturers
Brian:
00:26:31
and carriers must submit, especially if they're part of the Google play ecosystem.
Brian:
00:26:36
And if they're, you know, full GMs licensees.
Brian:
00:26:39
And so what they're trying to do is enable lots of people to grow
Brian:
00:26:41
vibrant businesses and enable.
Brian:
00:26:44
This very broad ecosystem that we have today that has so many users and
Brian:
00:26:48
so many kinds of applications on it.
Brian:
00:26:49
The trick is saying, Hey, here's a set of standards.
Brian:
00:26:52
We want you to align with.
Brian:
00:26:54
And we are either gonna test you or have used an independent third
Brian:
00:26:57
party or self attest that you are doing the right things here and here.
Brian:
00:27:00
And by and large, everybody's got the right idea and
Brian:
00:27:03
trying to do the right thing.
Brian:
00:27:04
You don't hear so much about really bad stuff happening.
Brian:
00:27:08
I will say that supply chain attacks like we've been hearing in the market
Brian:
00:27:12
overall on lots of different things, whether you're the colonial pipeline
Brian:
00:27:16
or what have you, those are out there, and those are hitting mobile, just like
Brian:
00:27:19
they're hitting other corporate systems.
Brian:
00:27:21
And so to no fault of their own developers may wind up with an
Brian:
00:27:24
exploitable or malicious app because of some third party library they're
Brian:
00:27:27
using or system service they're using that suddenly changed because
Brian:
00:27:30
a bad actor got in there and made a.
Brian:
00:27:32
So that will be something I think we're gonna live on in the mobile world,
Brian:
00:27:35
the web world, the network world, and every other world, until we really get
Brian:
00:27:38
supply chain management under control and, and more safe use of components.
Brian:
00:27:42
All right.
Mishaal:
00:27:42
So on that front, what can app developers do to protect their
Mishaal:
00:27:45
applications from any malicious exploits?
Brian:
00:27:48
You know, I think there's a handful of things.
Brian:
00:27:49
So when we work with organizations who are application developers,
Brian:
00:27:52
whether they're large or small, we give them a set of recommendations.
Brian:
00:27:55
First one is make sure you've got some basic security
Brian:
00:27:57
training for your developers.
Brian:
00:27:58
Make sure they understand the fundamentals.
Brian:
00:28:00
Make sure we've got like a guide.
Brian:
00:28:01
That's like here's 10 APIs.
Brian:
00:28:03
You should make sure you use and how to configure them properly.
Brian:
00:28:05
And then a guide on permissioning.
Brian:
00:28:07
A lot of it has to do with just don't collect and store it.
Brian:
00:28:09
If you don't need it, then there are things about how to handle storage,
Brian:
00:28:12
how to handle crypto, how to handle network, how to handle backend API.
Brian:
00:28:15
They're not very difficult.
Brian:
00:28:17
In many instances, it's they didn't know there was a flag they should set.
Brian:
00:28:19
They didn't know there was a configuration option they should be using.
Brian:
00:28:22
They didn't know there was an ordering of operations.
Brian:
00:28:24
They should be using, make sure devs doing the right thing.
Brian:
00:28:26
The second thing is, make sure that there are product requirements that.
Brian:
00:28:30
What kind of security, this thing should have, right?
Brian:
00:28:32
If I'm building a banking app, there should be fundamental requirements
Brian:
00:28:35
that say I'm regulated by the industry.
Brian:
00:28:37
Here's a set of requirements.
Brian:
00:28:38
Well, if I'm not building a banking app, we've been building something else.
Brian:
00:28:40
This requirements may not clear, but just like you're saying, you want a
Brian:
00:28:43
really cool augmented reality experience, make sure that you're protecting
Brian:
00:28:46
using multifactor authentication and protecting my Phi while you do it.
Brian:
00:28:50
Right test it.
Brian:
00:28:52
Whether you using SAS in the pipeline or SA and da in the pipeline, there
Brian:
00:28:56
are open source and paid commercial tools that are cheap and easy to use.
Brian:
00:29:00
They can run autonomously, they catch all the low hanging through.
Brian:
00:29:03
They make your life easier.
Brian:
00:29:04
What's really cool about a lot of the DAS tools including now secure.
Brian:
00:29:07
Now, is it also identifies app store blockers?
Brian:
00:29:09
So you may have a build version issue.
Brian:
00:29:11
You may have a third party SDK issue.
Brian:
00:29:13
You may have some other reason.
Brian:
00:29:14
Google may say, Nope, I'm not gonna accept this binary because you're
Brian:
00:29:17
not following one of my rules.
Brian:
00:29:19
You can catch that too.
Brian:
00:29:20
So that's not just security and privacy.
Brian:
00:29:21
That's finding those rules.
Brian:
00:29:23
And if you're super high end app, you're that embedded health app, that's
Brian:
00:29:26
maintaining my heartbeat to a cardiac monitor or you're my banking app or
Brian:
00:29:31
my financial account management app.
Brian:
00:29:32
You should be doing pen testing once in a while and have really smart
Brian:
00:29:35
experts, tear it down just to make sure there isn't something exploitable.
Brian:
00:29:38
So teach requirements, automate your testing everywhere you.
Brian:
00:29:43
Pen test the high risk stuff.
Brian:
00:29:45
Be serious enough that say, Hey, we wanna have a great user experience
Brian:
00:29:48
and millions or billions of downloads.
Brian:
00:29:50
And we just wanna make sure that people's data does what it's supposed to do.
Mishaal:
00:29:54
Security is essential, of course, for every application and developer
Mishaal:
00:29:58
should be top of mind, but it should be even more top of mind, especially
Mishaal:
00:30:01
if you're dealing with sensitive data.
Mishaal:
00:30:03
And as Brian mentioned, medical financial, you don't want to be slapped with, uh,
Mishaal:
00:30:07
billions of dollars in a lawsuit for mishandling or having some data breach.
Mishaal:
00:30:12
That you could have solved by protecting your application better.
Mishaal:
00:30:15
And if you are dealing with any mission critical application or you need to
Mishaal:
00:30:20
deploy mission critical applications onto fleets of dedicated devices, and
Mishaal:
00:30:23
you wanna make sure that the firmware it's running on and the data you
Mishaal:
00:30:26
depend on secured, come talk to us.
Mishaal:
00:30:28
That SPER we specialize in helping companies manage fleets of dedicated
Mishaal:
00:30:31
devices, including deploying and keeping your apps updated on them.
Mishaal:
00:30:35
If you're trying to deploy a kiosk or point of sale terminal,
Mishaal:
00:30:38
you need to lock it down.
Mishaal:
00:30:39
So potentially malicious applications, can't be side loaded onto.
Mishaal:
00:30:42
That's especially important because most of the time, these dedicated
Mishaal:
00:30:45
devices won't have GMs on them.
Mishaal:
00:30:47
So you can't count on Google, play, protect for protection.
Mishaal:
00:30:50
And if you're worried about any mobile bundle applications that are pre-installed
Mishaal:
00:30:53
on the off the shelf hardware that you've picked up for your dedicated device
Mishaal:
00:30:57
fleet, you'll need to look at deploying your own firmware based on AOS P.
Mishaal:
00:31:00
We can also help with that.
Mishaal:
00:31:02
Check us out@esper.io and Brian, thanks for joining us on
Mishaal:
00:31:05
this episode of Android bites.
Mishaal:
00:31:07
Is there anything you'd like to close us off with?
Mishaal:
00:31:09
Can you like work?
Mishaal:
00:31:09
Can people find you online and work?
Mishaal:
00:31:12
Can people work with now secure on securing their application?
Brian:
00:31:15
Yeah, so you, you can find us online.
Brian:
00:31:16
There's a bunch of great resources.
Brian:
00:31:17
I'm gonna talk out real quick.
Brian:
00:31:18
So now secure.com/nasa, M a S a that will help you understand the app defense
Brian:
00:31:24
Alliance and the independent security.
Brian:
00:31:27
If you're a user look to see that the apps you're choosing have
Brian:
00:31:30
an independent security review.
Brian:
00:31:31
If you're a developer, get your independent security review, we
Brian:
00:31:34
can help you expedite that process.
Brian:
00:31:36
That's cheap and easy to go do.
Brian:
00:31:38
If you want some training@cat.now secure.com is a free training environment.
Brian:
00:31:42
It's for development, QA, DevOps, and security teams to learn everything they
Brian:
00:31:46
needed to know about building testing and running secure apps in production.
Brian:
00:31:50
Again, that's a free resource.
Brian:
00:31:52
You can find me all over the place.
Brian:
00:31:53
I'm actually known as read on the run is my handle.
Brian:
00:31:56
So you can find me on, you know, LinkedIn, Twitter, and other kinds of fun places.
Brian:
00:31:59
Speaking to events of all kinds.
Brian:
00:32:00
The last thing I'll give you is O O is growing dramatically.
Brian:
00:32:03
The O OS mobile project is advancing.
Brian:
00:32:07
There's some really great things coming from O O this fall.
Brian:
00:32:10
And until later this year with the evolution of the
Brian:
00:32:12
mobile app security project.
Brian:
00:32:14
So if you're into the community activities, come join us at OAS, spend the
Brian:
00:32:18
mobile project and get involved because there's some really great stuff going on.
Brian:
00:32:21
It's a place you can learn a place you can contribute.
Brian:
00:32:24
And really be part of a community.
Brian:
00:32:25
Who's trying to do the right thing for mobile application
Mishaal:
00:32:27
security.
Mishaal:
00:32:28
And just to clarify, what is O OSP?
Mishaal:
00:32:30
Exactly?
Mishaal:
00:32:30
What does it stand for?
Mishaal:
00:32:31
Oh,
Brian:
00:32:31
O OSP is the open web application security project or program.
Brian:
00:32:35
It's an independent vendor, agnostic community of, uh, security professionals.
Brian:
00:32:40
Who've been building standards and specifications for how to build secure web
Brian:
00:32:44
apps, mobile apps, how to secure your APIs on the back end and things of that nature.
Brian:
00:32:49
So O O for those who are in the security.
Brian:
00:32:52
Are generally familiar with it as a non-for-profit that drives that
Brian:
00:32:56
O OSP has a number of initiatives going on in the development world.
Brian:
00:32:59
And what's really great about it is that Google has fully embraced O O
Brian:
00:33:03
so the app defense Alliance master certification program, which gets you
Brian:
00:33:07
that independent security verification actually is using the O OSP standard.
Brian:
00:33:11
And you're gonna see the O OSP standard in many other places.
Brian:
00:33:15
As a mechanism for a common industry standard for what security means, whether
Brian:
00:33:19
it's web mobile network, device or API.
Brian:
00:33:22
So there's some really great things going on at that
Mishaal:
00:33:24
standards body.
Mishaal:
00:33:25
All right.
Mishaal:
00:33:26
Thank you, Brian.
Mishaal:
00:33:26
And thank you everyone again for listening to another episode of Android bites.
00:00:02
Hello, and welcome to Android bys powered by Esper, the podcast that
Mishaal:
00:00:05
dives deep into the world of Android.
Mishaal:
00:00:07
I'm Michelle Ramon.
Mishaal:
00:00:08
And while I'd normally be joined by my co-host David Ruddock, he unfortunately
Mishaal:
00:00:11
couldn't make it to this one.
Mishaal:
00:00:13
Still.
Mishaal:
00:00:13
We've got a great topic and guest lined up on the show this week,
Mishaal:
00:00:16
we'll be talking about security, specifically mobile app security.
Mishaal:
00:00:19
So if you listen to our podcast before, you know, we've talked about Android
Mishaal:
00:00:23
security model, at least when it comes to applications, as well as our
Mishaal:
00:00:26
permissions work in the previous episode.
Mishaal:
00:00:28
But this time, we want to focus more specifically on how Google app
Mishaal:
00:00:31
developers and outside firms team up to protect you and your Android device.
Mishaal:
00:00:35
So today we've invited Brian Reed, chief mobility officer at now secure
Mishaal:
00:00:40
to talk about mobile app security.
Mishaal:
00:00:41
Welcome to the show,
Brian:
00:00:42
Brian.
Brian:
00:00:43
Thanks, Michelle.
Brian:
00:00:44
It's great to be here and part of your community.
Brian:
00:00:45
Thanks for having me.
Brian:
00:00:46
Thanks for joining us.
Brian:
00:00:47
So
Mishaal:
00:00:48
this is the topic that in my now seven years of covering Android, you know,
Mishaal:
00:00:52
I've kind of delved into the security side a bit here and there, even though, while
Mishaal:
00:00:57
it's been up in my primary focus, just covering the Android platform ecosystem,
Mishaal:
00:01:00
these security issues come up and tend to cover them pretty much every week.
Mishaal:
00:01:05
You'll hear from some mobile security threat firm that there's
Mishaal:
00:01:07
some new malware strain out in the wild, and that is wing havoc.
Mishaal:
00:01:11
And then when you dive into the details you discover, oh, they're mostly misusing
Mishaal:
00:01:15
some Android API or application some permission or they're tricking users
Mishaal:
00:01:19
into enabling some sensitive permiss.
Mishaal:
00:01:22
And so like, this is a topic that is ever pervasive in our lives, because
Mishaal:
00:01:25
you probably know people in your lives who could be tricked into enabling
Mishaal:
00:01:31
something they shouldn't have when songs something they shouldn't have.
Mishaal:
00:01:33
And even if you think that you wouldn't do that, there's a very high
Mishaal:
00:01:37
chance that you could be tricked to.
Mishaal:
00:01:39
No one is ever completely foolproof from fishing or any other malware attacks.
Mishaal:
00:01:45
There are many things you can do to prevent yourself from
Mishaal:
00:01:47
being taken advantage of.
Mishaal:
00:01:48
But on the ecosystem side, there are also many things that Android
Mishaal:
00:01:51
does and that Google does and that outside firms can do to proactively
Mishaal:
00:01:56
protect you from harming yourself.
Mishaal:
00:01:59
So just so we're all on the same page, I kind of wanna just touch upon
Mishaal:
00:02:02
the background of Android security model and how Android actually
Mishaal:
00:02:06
protects you at a platform level.
Mishaal:
00:02:08
So we talked about this before, but every time you install
Mishaal:
00:02:10
an app, it comes an APK file.
Mishaal:
00:02:12
And within that APK file.
Mishaal:
00:02:14
There's all the assets, the code, the resources, et cetera, but there's also
Mishaal:
00:02:17
a digital signature that is generated whenever the developer signs a package.
Mishaal:
00:02:21
And whenever that app installs on your device, it's given a unique package name.
Mishaal:
00:02:26
And whenever you try to install an app that has a package name matching an
Mishaal:
00:02:31
existing app, it installed on the device.
Mishaal:
00:02:32
If that signature doesn't match the signature, that was with the previous.
Mishaal:
00:02:37
Then Android will object the installation.
Mishaal:
00:02:39
And because it's assumed that the signing key, the developer used to sign that
Mishaal:
00:02:42
app is generally kept somewhere safe and secure within their own repository on
Mishaal:
00:02:46
their computer, or upload it to Google.
Mishaal:
00:02:48
Then you can assume that some third party didn't just modify
Mishaal:
00:02:52
the app and then upload it.
Mishaal:
00:02:53
And then you installed it onto your device.
Mishaal:
00:02:55
So that's how Android generally secures updating applications.
Mishaal:
00:02:59
The one challenge with that is while it ensures that some outside developer
Mishaal:
00:03:03
didn't modify and push an app onto your device, it doesn't guarantee that the
Mishaal:
00:03:07
update hasn't been tampered with hasn't had in any malicious or potentially
Mishaal:
00:03:11
harmful code within the update.
Mishaal:
00:03:13
Like it could still be signed by the original developer, but how do you.
Mishaal:
00:03:17
If that update is still safe to use.
Mishaal:
00:03:19
And that's generally where firms like now secure come in.
Mishaal:
00:03:23
So I wanted to ask you, Brian, can you tell us a bit about the company?
Mishaal:
00:03:26
Sure.
Brian:
00:03:26
So now secure actually got started as a forensics company in 2008 and 2009.
Brian:
00:03:31
So the birth of Android that was around the same time as iOS.
Brian:
00:03:36
Our founder got interested in these cool little devices that seemed to
Brian:
00:03:39
have a whole lot of computing power and a lot of forensic data on him.
Brian:
00:03:42
And while he wasn't a forensic specialist, he actually became the world's expert
Brian:
00:03:46
in mobile forensics and ultimately build a business that is now secure today.
Brian:
00:03:49
We're kind of an all in one solution provider we have for
Brian:
00:03:53
mobile application securities.
Brian:
00:03:54
So we have testing tools, developing tools, pen testing
Brian:
00:03:57
services, open source tools.
Brian:
00:03:59
Training all of those kinds of things and partner with lots of organizations
Brian:
00:04:02
to make sure they're able to deliver those secure applications on whatever
Brian:
00:04:06
mobile operating system they want.
Brian:
00:04:07
So our roots are in Android, cuz that's really where he started and we
Brian:
00:04:10
continue to do a lot with Google and the entire ecosystem community today.
Mishaal:
00:04:15
Thanks Brian.
Mishaal:
00:04:15
And just to follow up on the Android aspect, one other thing that Android
Mishaal:
00:04:19
does at the platform level to protect you is that it has a very secure
Mishaal:
00:04:23
model of protecting applications from interacting with other applications.
Mishaal:
00:04:27
So you may have heard the term sandbox before.
Mishaal:
00:04:29
So whenever you install an app on Android, every app that has a unique
Mishaal:
00:04:33
package name, you know, every app has to have a unique package name.
Mishaal:
00:04:36
You can't have two apps with the same package name solved on a.
Mishaal:
00:04:39
So what happens is that that package is assigned a, a unique identifier.
Mishaal:
00:04:43
And when you run that app, Android runs it in a container
Mishaal:
00:04:46
and it's called the process.
Mishaal:
00:04:47
And then that identifier is called the P I D for that process.
Mishaal:
00:04:50
So by putting processes in containers, Android ensures
Mishaal:
00:04:53
that apps can only interact with other apps through a well-defined
Mishaal:
00:04:58
process called the binder IPC.
Mishaal:
00:05:00
So this way apps can only interact and only execute only like send a
Mishaal:
00:05:04
request to get data from another app.
Mishaal:
00:05:06
Through well defined permissions through well defined, intense and whatnot.
Mishaal:
00:05:12
So like you can't just have one app poking around the data of another app
Mishaal:
00:05:14
without break the sandbox, which is just not something that is very easily
Mishaal:
00:05:18
achievable without some very serious exploit in the Android platform.
Mishaal:
00:05:22
I wanted to ask you, Brian, how does this in your experience,
Mishaal:
00:05:25
how does Android security model compare to other operating systems?
Mishaal:
00:05:29
Would you say it's more or less secure?
Brian:
00:05:31
Yeah, that's always a loaded question.
Brian:
00:05:33
What I would say is that the Linux kernel underneath the Android in and
Brian:
00:05:36
of itself with its advanced security capabilities, gives it a strength.
Brian:
00:05:40
Apple has a more closed system on iOS, just in terms of how they operate.
Brian:
00:05:44
Uh, the sandboxing model is very strong.
Brian:
00:05:46
You know, the containerization of applications, the
Brian:
00:05:48
control of the IPC channel.
Brian:
00:05:50
All of those things are good strengths for Android.
Brian:
00:05:53
What's been really interesting to watch is that Android kind of was very heavy.
Brian:
00:05:57
I've been around this since Blackberry, just to be my background.
Brian:
00:06:00
I was with the original mobile security company called Blackberry.
Brian:
00:06:03
So I've seen a lot over the years and Blackberry was completely locked down
Brian:
00:06:06
and completely impossible to innovate.
Brian:
00:06:08
Just about it all, but it was really secure, right?
Brian:
00:06:10
And that's an example of a niche user experience with high security,
Brian:
00:06:14
but it was really inflexible when you wanted to write applications.
Brian:
00:06:17
The Android world kind of has two communities.
Brian:
00:06:19
You have the, I just wanna get stuff done.
Brian:
00:06:21
And then you have kind of the fanboy world I wanna customize
Brian:
00:06:24
and do really interesting things and, you know, so on and so forth,
Brian:
00:06:26
which leads to rooting and more customizations in the operating system.
Brian:
00:06:30
What has been really interesting to watch is that Android has become incredibly.
Brian:
00:06:34
If you look at the number of CVEs and cess listed for Android operating system
Brian:
00:06:39
or for device hardware for at least the tier one manufacturers, they have gone
Brian:
00:06:43
down as a rate over time, apple hasn't.
Brian:
00:06:46
Now apple may have been a little bit ahead.
Brian:
00:06:48
So there sort of is this, it depends.
Brian:
00:06:51
On who your hardware manufacturer is, how they are properly or improperly
Brian:
00:06:55
using the operating system and the licensing that they're doing around the
Brian:
00:06:58
play store and the tooling around that.
Brian:
00:07:00
But Android today is a very safe environment.
Brian:
00:07:02
And so I live in a blended world.
Brian:
00:07:04
So I have yes, one of everything because I'm in a mobile business.
Brian:
00:07:07
I have no qualms about saying which device or which operating system is better.
Brian:
00:07:11
Android and iOS are both better than windows, frankly.
Brian:
00:07:13
And so from that perspective, there's lots of different places we can go
Brian:
00:07:17
in terms of talking about, well, how do I make sure I'm safe and secure?
Brian:
00:07:19
And how do I make sure I do the right things?
Brian:
00:07:21
You mentioned
Mishaal:
00:07:22
something that I wanna kind of wanted to follow up on power users.
Mishaal:
00:07:24
You know, there are people who like the brute and tinker their devices.
Mishaal:
00:07:27
That's something that wasn't really possible with the older,
Mishaal:
00:07:29
more lockdown operating systems and current ones like iOS.
Mishaal:
00:07:33
So on Android, you are allowed.
Mishaal:
00:07:35
Side load applications.
Mishaal:
00:07:36
This term side loading.
Mishaal:
00:07:37
Isn't really much of a thing in the windows world, but it is
Mishaal:
00:07:40
something that exists in Android.
Mishaal:
00:07:42
And in order to side load, an application from outside of the official
Mishaal:
00:07:45
Google play store, you have to opt in, you have to enable permission.
Mishaal:
00:07:49
You have to do it on a per application basis.
Mishaal:
00:07:51
And there are also other security features that kind of irk power users.
Mishaal:
00:07:56
And I wanted to ask you your thoughts first on side loading.
Mishaal:
00:07:59
Like how does Google balance.
Mishaal:
00:08:01
Ability to allow users to side load applications with actually protecting
Mishaal:
00:08:05
them from installing something that's potentially untrusted.
Brian:
00:08:08
Yeah.
Brian:
00:08:08
I think there's kind of two ways to look at it.
Brian:
00:08:10
So I'm gonna take a macro view and then kind of a micro view.
Brian:
00:08:12
So the macro view is there are three or 4 billion users of Android, and
Brian:
00:08:18
that means everybody of every kind everywhere in the world, trying
Brian:
00:08:21
to do everything you can imagine.
Brian:
00:08:22
Right.
Brian:
00:08:23
And so there's lots of different segments of people that wanna
Brian:
00:08:26
use it in certain behavior.
Brian:
00:08:27
I do a lot of work with companies that use lockdown, Android tablets that are
Brian:
00:08:30
purpose designed for a specific use.
Brian:
00:08:32
They may have one application on them.
Brian:
00:08:35
I do work in automotives.
Brian:
00:08:36
I do work in healthcare, right?
Brian:
00:08:38
And so there's that class financial services where regulatory matters control
Brian:
00:08:42
matters, sensitive data matters you as a patient, don't want that data lost.
Brian:
00:08:47
If it's your car, you don't want that car broken into.
Brian:
00:08:50
Right.
Brian:
00:08:50
So there's that category.
Brian:
00:08:52
And then you kind of move into the more general maybe business user.
Brian:
00:08:55
Then you move into the more generalized consumer and then you move into the
Brian:
00:08:58
tinkerer category, like the fanboy and you know, and what I think
Brian:
00:09:02
Google's done a pretty good job of is trying to balance all of them, right.
Brian:
00:09:05
From that perspective.
Brian:
00:09:05
And so they've set up the guardrails.
Brian:
00:09:08
They've continued to improve the guardrails and gates to
Brian:
00:09:11
make it hard to be malicious.
Brian:
00:09:14
So you've got the containerized model.
Brian:
00:09:16
We just talked about side loading to me is an enabler for the category
Brian:
00:09:20
of people who want it, but most people should stay away from it.
Brian:
00:09:23
If you were to ask me how do regular people, consumers, not more technical,
Brian:
00:09:27
advanced customizer, stay safe.
Brian:
00:09:29
Don't side.
Brian:
00:09:31
Because Google play with play protect data, safety labels, and all of the system
Brian:
00:09:36
services that are built into the premium level are designed to keep you safe.
Brian:
00:09:40
And it's really easy to stay safe when you're leveraging those things.
Brian:
00:09:43
Side loading is one of the top malware paths.
Brian:
00:09:45
The other biggest breach vector actually is SMS fishing, and that's not Google
Brian:
00:09:50
or apple or anybody else's fault.
Brian:
00:09:52
That's the nature of the way SMS behaves.
Brian:
00:09:54
And that's a whole different security conversation.
Brian:
00:09:56
And the fact that people click on that stuff just in the same way,
Brian:
00:09:58
they sometimes click on spam email.
Brian:
00:10:00
Right.
Brian:
00:10:01
So side loading, isn't a bad thing, but side loading can get you in trouble.
Brian:
00:10:05
So you really should focus on brand name apps from brand name companies,
Brian:
00:10:08
you know, that have attestation in them with data safety program.
Brian:
00:10:13
That have four or more stars have millions of downloads, right?
Brian:
00:10:17
That's just the collective being safe, doing the smart thing, which
Brian:
00:10:20
is probably 80% of the world really.
Mishaal:
00:10:23
Right.
Mishaal:
00:10:23
I kind of like in side loading to deciding where to purchase something online.
Mishaal:
00:10:27
So if you're a side loader, you're kind of bypassing all the.
Mishaal:
00:10:31
Extra scrutiny that is placed on those applications by Google play and by
Mishaal:
00:10:36
play protect and all the stuff that's that developers have to go through
Mishaal:
00:10:39
to even get their apps on there.
Mishaal:
00:10:40
So like if you were to shop online, sure.
Mishaal:
00:10:43
You could go to all express.
Mishaal:
00:10:44
You could find literally anything you want at any time, but you're
Mishaal:
00:10:47
kind of putting yourself at risk by, you know, are you actually gonna
Mishaal:
00:10:50
get what you're trying to order?
Mishaal:
00:10:52
Is the seller actually legitimate is the product actually as described.
Mishaal:
00:10:56
Or could you just do the easy thing and go to like Amazon, you know?
Mishaal:
00:11:00
Sure.
Mishaal:
00:11:00
There are going to be some fakes.
Mishaal:
00:11:02
There are going to pieces of product issues, but generally those are
Mishaal:
00:11:04
more vetted because there's more barriers to entry to get on there.
Brian:
00:11:08
Right.
Brian:
00:11:08
You know, a lot of this is risk and reward for the bad guys.
Brian:
00:11:10
Right?
Brian:
00:11:11
So those barriers of entry, the friction that's put in the system make it harder
Brian:
00:11:14
for the people who wanna be malicious to behave malicious and the cost of being M.
Brian:
00:11:18
Becomes so high, it's not worth it.
Brian:
00:11:20
So from that perspective, take advantage of everything.
Brian:
00:11:23
You can buy a first class device from a first class vendor, make sure they're
Brian:
00:11:27
using they're licensing, Google correctly, and leveraging that technology and so
Brian:
00:11:30
on and so forth and you can be safe.
Brian:
00:11:32
And when we look at what Google has done for the two primary safety systems, we
Brian:
00:11:35
have the play protect side of the house.
Brian:
00:11:38
We have the data safety label side of the house and data safety labels just
Brian:
00:11:41
became mandatory in the last week.
Brian:
00:11:44
And so between those two things, if I can play protect is basically
Brian:
00:11:48
Google's giant malware engine.
Brian:
00:11:50
Google is continuously scanning for malware.
Brian:
00:11:53
Google has a lot of partners that are in security and endpoint management that are
Brian:
00:11:57
contributing to the malware signature.
Brian:
00:12:00
While you sometimes see it.
Brian:
00:12:01
And I'm not saying they're in any it's way better now than it used to be.
Brian:
00:12:04
And that database allow our signatures and the sophistication of the testing
Brian:
00:12:07
between Google and Google's partners continues to get better and better and
Brian:
00:12:10
better take advantage of play protect.
Brian:
00:12:12
You can run it on your own device.
Brian:
00:12:14
It's being scanned when it's going into the app store.
Brian:
00:12:16
If you find something reported and kind of help the community, the data
Brian:
00:12:20
safety label is really interesting.
Brian:
00:12:22
So I'll show my age.
Brian:
00:12:24
I remember when my parents would only buy electronics if they had the
Brian:
00:12:27
underwriter's laboratory safety label on it, which meant some third party
Brian:
00:12:32
company tested that piece of electronics.
Brian:
00:12:35
So it wouldn't like burn you or blow up your house or, you
Brian:
00:12:38
know, something else like that.
Brian:
00:12:39
And for the first time, anywhere in software that I have ever seen, Google's
Brian:
00:12:43
actually added labeling that this thing's.
Brian:
00:12:46
It's called a data safety label.
Brian:
00:12:48
And so one half of a label is the software developer is going to attest and say,
Brian:
00:12:53
here is what my app does with your data.
Brian:
00:12:56
I transmit it.
Brian:
00:12:57
I collect it.
Brian:
00:12:57
I send it.
Brian:
00:12:58
What have you, the other half is you can get an independent security verification
Brian:
00:13:03
done by an accredited third party.
Brian:
00:13:05
And that accredited third party now secures one of them will actually
Brian:
00:13:08
test it sufficiently to say, yeah, this app is safe based on
Brian:
00:13:11
this industry standard benchmark.
Brian:
00:13:13
That's like a good housekeeping seal of approval or underwriter's
Brian:
00:13:16
lab label on it now.
Brian:
00:13:18
So now with play protect, I'm protecting myself from malware
Brian:
00:13:21
with data safety labels.
Brian:
00:13:23
I'm also ensuring that the app manufacturer is doing the right thing.
Brian:
00:13:27
And that's really great for users.
Brian:
00:13:28
So
Mishaal:
00:13:28
just to take a step back, because on this show, we love to
Mishaal:
00:13:31
talk about a O S P and GMs, and try to differentiate between them.
Mishaal:
00:13:35
Google play protect, as Brian had mentioned is part
Mishaal:
00:13:38
of Google mobile services.
Mishaal:
00:13:39
So it's something that is available on devices with GMs, Android.
Mishaal:
00:13:43
So, if you were to compile a S P from Google ski repositories, you would
Mishaal:
00:13:48
not have play protect available to you because it is part of, I believe Google
Mishaal:
00:13:51
play store app itself, or Google play services, either one of those two.
Mishaal:
00:13:56
And as Brian mentioned, it is a massive database of malware signatures.
Mishaal:
00:14:00
And I kind of wanted to talk about now, like I wanted to ask you how exactly.
Mishaal:
00:14:04
Is that malware signature database actually built.
Mishaal:
00:14:07
How does Google go out and decide to add something to its database?
Mishaal:
00:14:12
So for the two who looked up anything related to this before you might have
Mishaal:
00:14:15
heard terms like static and dynamic analysis, can you walk us through what
Brian:
00:14:18
those mean?
Brian:
00:14:19
Sure.
Brian:
00:14:19
So there is something called the app defense Alliance.
Brian:
00:14:22
So I'm just gonna introduce the, how does the data get collected?
Brian:
00:14:25
So the app defense Alliance was created.
Brian:
00:14:28
Five six years ago.
Brian:
00:14:29
And it's a group of folks who do malware.
Brian:
00:14:32
They do endpoint management, they do antivirus a lot of the subjects
Brian:
00:14:36
you might expect in this world.
Brian:
00:14:38
And so Google said, Hey, we wanna crowdsource this stuff.
Brian:
00:14:41
We've got a whole bunch.
Brian:
00:14:42
We know you have more.
Brian:
00:14:42
So let's start collecting them.
Brian:
00:14:44
So through all of the different vendors who participate in that, when
Brian:
00:14:47
they find something, they submit it through a special channel to Google.
Brian:
00:14:49
Google adds it to their database, verifies that the giant database gets bigger.
Brian:
00:14:53
And it's because there's multiple vendors scanning billions of device.
Brian:
00:14:57
You get a pretty good signature database as a result of that.
Brian:
00:14:59
Now, what we're all doing under the hood is we're basically doing
Brian:
00:15:03
some combination of static and dynamic analysis or SAST and DAS.
Brian:
00:15:07
And so SAST is basically scanning code either the source code or binary image
Brian:
00:15:13
of the app to statically identify coding failures in the application.
Brian:
00:15:18
So with SAST, you might find things like say hard coded secrets embedded
Brian:
00:15:24
in the application or debugging code that made it into production
Brian:
00:15:28
in the app store submission or hard coded URLs or stuff like that.
Brian:
00:15:32
Those are vulnerabilities.
Brian:
00:15:33
You could.
Brian:
00:15:34
You can also find malicious behavior, like, Hey, it's scooping up this data
Brian:
00:15:37
and transmitting it to this IP address.
Brian:
00:15:39
And then dat, which is dynamic analysis is actually running the app.
Brian:
00:15:43
Most of us who participate in the program have some sort of dynamic
Brian:
00:15:47
analysis, which we observe the app running on a real device, whether it's
Brian:
00:15:50
in a lab or it's on some customer's device that has an agent running on it.
Brian:
00:15:54
And we see the malicious behavior, we capture it.
Brian:
00:15:56
So dynamic finds things like permissions, escalation,
Brian:
00:16:00
because something changes over.
Brian:
00:16:02
It finds transmission of sensitive data that maybe shouldn't be there.
Brian:
00:16:05
Is that data properly encrypted?
Brian:
00:16:06
Does it go to a bad end point?
Brian:
00:16:08
That's a known malware harvester endpoint from the endpoint databases on the.
Brian:
00:16:13
Things like that.
Brian:
00:16:14
So what's interesting about it is the collective is kinda looking for
Brian:
00:16:18
malware through bad behaviors, but also looking for vulnerabilities.
Brian:
00:16:21
Some of the more recent issues we found in the market weren't actually malware.
Brian:
00:16:25
They were vulnerable commercial applications used by millions of
Brian:
00:16:28
people where the bad guys figured out how to exploit weakness in them.
Brian:
00:16:31
There was a security weakness that their developers had introduced to.
Brian:
00:16:35
So that's a little bit about how that works.
Brian:
00:16:36
Now, the app defense Alliance recently added the MAs specification,
Brian:
00:16:41
which is that independent security verification strategy.
Brian:
00:16:44
So this is how to use SAS and dat to analyze the app for vulnerabilities that
Brian:
00:16:48
could be exploited work with the vendor to fix them, and then give them that good
Brian:
00:16:52
housekeeping label of approval, which is the independent security review stamp.
Brian:
00:16:57
So that when you go their data safety label, In the Google play store.
Brian:
00:17:00
You see, it says independent security review has been completed
Brian:
00:17:04
by an attested third party.
Brian:
00:17:05
This is deep save for use in these categories.
Brian:
00:17:08
And now you have that attestation, which is great from the third party.
Brian:
00:17:12
So you mentioned
Mishaal:
00:17:12
before that, you know, you typically look at either the source
Mishaal:
00:17:15
code or the compiled code of an application, and I'm guessing like 99%
Mishaal:
00:17:19
of the time you don't have access to the source code of the application.
Mishaal:
00:17:22
You're looking for most of the time, you're looking at the binary, the
Mishaal:
00:17:25
compiled binary, and you'd have to use some kind of de compilation.
Mishaal:
00:17:28
Or some kind of analyzer to analyze behavior while it's on device.
Mishaal:
00:17:32
Can you tell us about like some of the tools that you might use?
Mishaal:
00:17:34
Are they like all inhouse?
Mishaal:
00:17:36
We use any
Brian:
00:17:36
commercial for those who are into reversing, you may have heard of Frida
Brian:
00:17:40
and rod Aari are the top two reversing disassembly tools in the market.
Brian:
00:17:45
Frida and red were created by researchers on our now secure.
Brian:
00:17:49
And pancake are their handles.
Brian:
00:17:51
And so those are used by a lot of security researchers.
Brian:
00:17:54
They're also used in some other tooling by other folks, and
Brian:
00:17:57
those are embedded in our tools.
Brian:
00:17:58
So we can reverse and disassemble an iOS or an Android app, whether it's DRM
Brian:
00:18:02
or not with it, you can break most of the obfuscation tools and hook the app.
Brian:
00:18:07
Even the ones that have anti Frita capabilities in it, it's
Brian:
00:18:10
like a cat and mouse game.
Brian:
00:18:11
They try to block and then you find new ways around it.
Brian:
00:18:14
But in reversing it, you can get down to bite code or Java code or some
Brian:
00:18:17
intermediate language that you can then scan to get a sense from a static
Brian:
00:18:20
perspective about what's going on.
Brian:
00:18:23
What I will say is that freedom and Dari are great tools.
Brian:
00:18:25
Have a look at them.
Brian:
00:18:26
If you really wanna kinda learn your way through what this world looks.
Brian:
00:18:30
There's some free training on how to use freedom, Ary and participate in the
Brian:
00:18:33
community on our academy.now secure.com or you can just find them on the internet.
Brian:
00:18:38
They're great tools.
Brian:
00:18:39
There's some other tools out there.
Brian:
00:18:40
There are various other tools that might go into kit.
Brian:
00:18:42
You might use perp suite to do network sniffing and some things like that
Brian:
00:18:45
when you kind of build out a tool kit.
Brian:
00:18:47
So we leverage those and other advance.
Brian:
00:18:49
IP that we built.
Brian:
00:18:50
So do the other vendors have all built something that involves some combination
Brian:
00:18:53
of static and dynamic analysis?
Mishaal:
00:18:55
Speaking of static and dynamic analysis, there is one thing
Mishaal:
00:18:57
I wanted to follow up with you on.
Mishaal:
00:18:59
And it's something that I think requires some clarification for
Mishaal:
00:19:01
listeners who may not be familiar.
Mishaal:
00:19:03
And it's that why is dynamic analysis actually important to do?
Mishaal:
00:19:07
Why do you have to test on a real device versus why can't you just statically
Mishaal:
00:19:11
analyze the code and look for some, say potentially malicious thing happening.
Brian:
00:19:15
We talked earlier about containers in IPC and data transmission between
Brian:
00:19:21
say two containers or two processes.
Brian:
00:19:22
Right?
Brian:
00:19:23
Well, that's why you need dynamic analysis, static analysis.
Brian:
00:19:26
We'll never see if data was improperly transmitted to the IPC
Brian:
00:19:30
found from one process to another.
Brian:
00:19:32
You need dynamic analysis to understand what's being written to the device in
Brian:
00:19:37
log files, or being stored on the device.
Brian:
00:19:40
We find key material, forensic data.
Brian:
00:19:43
IP.
Brian:
00:19:44
We actually found a, uh, coupon code generator.
Brian:
00:19:47
The actual IP generation of that was spewed out and log
Brian:
00:19:51
files under error conditions.
Brian:
00:19:53
Now static source code scanning.
Brian:
00:19:55
Won't find that you only find that when you run it dynamically.
Brian:
00:19:58
So it's a general rule.
Brian:
00:19:59
Dynamic is about testing the crypto.
Brian:
00:20:02
Is the crypto working correctly.
Brian:
00:20:04
And then it's testing storage, which is what is being written
Brian:
00:20:07
and what can I forensically find?
Brian:
00:20:09
And what's being written into my own address, space, my own storage,
Brian:
00:20:12
other storage file system log files, and then network transmission.
Brian:
00:20:16
So what is getting transmitted over the air?
Brian:
00:20:18
Is it intercept?
Brian:
00:20:20
Am I doing proper certificate pinning?
Brian:
00:20:21
Am I using the TLS channel?
Brian:
00:20:23
Correct.
Brian:
00:20:24
What endpoints am I talking to?
Brian:
00:20:26
Are those endpoints safe?
Brian:
00:20:28
There's a whole bunch of things you can test around authentication
Brian:
00:20:30
and authorization that you'll pick out through testing dynamically.
Brian:
00:20:33
So I'll give you wild data.
Brian:
00:20:35
We scan all the apps in the app store.
Brian:
00:20:37
So there are 6 million app and Google play store apps.
Brian:
00:20:39
Approximately we scan almost all of them on a regular basis.
Brian:
00:20:42
And what I can tell you is that 80% of them have security vulnerability.
Brian:
00:20:47
The good news is 20%.
Brian:
00:20:48
Don't have really bad security vulnerabilities in 'em, but 80% do.
Brian:
00:20:51
And that number's been the same for five or six years since
Brian:
00:20:54
we've been benchmarking them.
Brian:
00:20:56
What's also interesting is that when you carve into that static
Brian:
00:21:00
versus dynamic, almost everything we're finding is dynamically found.
Brian:
00:21:05
It's really hard to do dynamic analysis and dynamic testing
Brian:
00:21:08
at scale in a development.
Brian:
00:21:10
So a lot of 'em just don't do it.
Brian:
00:21:12
So they run a static analyzer until we find a very low proportion
Brian:
00:21:15
of static vulnerabilities in production apps, because most
Brian:
00:21:18
people are using static tools.
Brian:
00:21:20
Dynamic is really hard to do.
Brian:
00:21:22
It's expensive if you pay somebody to do it, not a lot of people do it.
Brian:
00:21:25
And that's why we find that's where most of the vulnerabilities
Brian:
00:21:27
are in storage in crypto, in network and backend APIs by far.
Mishaal:
00:21:32
Yeah, I'm not surprised because you know, they want to avoid detection.
Mishaal:
00:21:35
So if you just have all your malicious code statically, it's in the application
Mishaal:
00:21:39
itself and it's easy to find, then there's nothing in it for them.
Mishaal:
00:21:42
It's, it's gonna be detected and, you know, added to the database
Mishaal:
00:21:44
and then detected in the future again and over and over again.
Mishaal:
00:21:47
And I've heard stories of like these malicious applications
Mishaal:
00:21:50
that behave differently or.
Mishaal:
00:21:52
Different parts of code differently, depending on your location or
Mishaal:
00:21:55
what device you're running or a combination of those factors.
Mishaal:
00:21:58
So like you need to be able to test, and that
Brian:
00:22:00
can be hard to find exactly.
Brian:
00:22:01
It can be hard to find two dynamics.
Brian:
00:22:03
So, uh, screw an ator.
Brian:
00:22:04
You're not necessarily gonna see all the IC conversation to the ator.
Brian:
00:22:07
You're not necessarily gonna see the interaction with the OS layer all the
Brian:
00:22:10
way down through the hardware or the wifi chip before the carrier chip.
Brian:
00:22:13
Right.
Brian:
00:22:13
So what we have found.
Brian:
00:22:16
For a number of clients who have done emulator based
Brian:
00:22:18
testing, they bring it to us.
Brian:
00:22:19
We find stuff.
Brian:
00:22:20
I mean, you can't truly emulate the environment to get full coverage.
Brian:
00:22:24
And again, sometimes it's malware.
Brian:
00:22:26
A lot of it's just vulnerabilities.
Brian:
00:22:27
I mean, last year, Walgreens slack, they had vulnerabilities that were exploited.
Brian:
00:22:33
People stole prescription data to the Walgreens mobile app
Brian:
00:22:36
because of a vulnerability in it.
Brian:
00:22:38
Slack had a zero day.
Brian:
00:22:40
So even what you would think would be really great companies.
Brian:
00:22:43
They can make mistakes, their developers can make mistakes, it might be code.
Brian:
00:22:46
They write party libraries that put in it.
Brian:
00:22:48
But what we're actually seeing is the nation state actors and
Brian:
00:22:51
the criminals are finding these zero days in these applications.
Brian:
00:22:54
And they're exploiting them as bad or worse as they are the malware,
Brian:
00:22:57
the price of building malware and getting it into the app store
Brian:
00:23:00
is getting higher and higher.
Brian:
00:23:01
Cuz it's harder and harder cuz of everything we just talked about today.
Brian:
00:23:04
But you know what, if I can find a zero.
Brian:
00:23:07
In slack and go steal a bunch of corporate data or, you know, shopping cart X and
Brian:
00:23:12
there's numerous applications like that.
Brian:
00:23:14
Well, then I can harvest information off of that and use that, you know, there, uh,
Brian:
00:23:18
if I can diverge for a second, a couple years ago, British airway was preached.
Brian:
00:23:22
They found a weakness in the way British airways mobile app
Brian:
00:23:25
was talking to its back backend.
Brian:
00:23:26
So they learned how to attack the backend by the mobile app.
Brian:
00:23:29
Then they attacked the backend 380,000 records were stolen, including passport
Brian:
00:23:34
information, travel history, credit cards.
Brian:
00:23:36
They were fine.
Brian:
00:23:37
Bridge share was fined 158 million pounds by the EU as the first GDPR.
Brian:
00:23:41
Fine.
Brian:
00:23:42
Now all of that had to do with the fact of a poorly written mobile application.
Brian:
00:23:46
That was exploitable.
Brian:
00:23:48
There was no malware involved.
Brian:
00:23:49
It was just straight up good scientific research that discovered it.
Brian:
00:23:52
And then they used it to go after the back end.
Brian:
00:23:54
And that's what we need to think about is mobile's just part of the overall chain of
Brian:
00:23:58
all the it systems that some company has.
Brian:
00:24:00
Then you make sure the mobile app and what it talks to is secure, whether it's
Brian:
00:24:03
malware or whether it's a commercial app.
Brian:
00:24:06
So this
Mishaal:
00:24:06
whole time we've been talking mostly about malware
Mishaal:
00:24:08
and like malicious applications.
Mishaal:
00:24:09
But if you read online about like what Google pay, protect actually
Mishaal:
00:24:14
identifies it, doesn't usually.
Mishaal:
00:24:16
Positively identify actual malicious behavior.
Mishaal:
00:24:19
It identifies potentially harmful applications.
Mishaal:
00:24:23
Can you describe what exactly qualifies to potentially harmful application?
Brian:
00:24:27
Yeah, so potentially harmful application is the app is collecting and
Brian:
00:24:31
maybe transmitting over the error data.
Brian:
00:24:33
It shouldn't be the app is trying to execute system level commands.
Brian:
00:24:37
It shouldn't have rights to execute.
Brian:
00:24:40
It could be spyware.
Brian:
00:24:41
It could be fishing.
Brian:
00:24:43
You know, more common things.
Brian:
00:24:44
We know it could be ransomware in terms of its behavior.
Brian:
00:24:47
I haven't heard a lot of production ransomware on mobile, but we've seen some
Brian:
00:24:50
academic experiments along those lines.
Brian:
00:24:52
Uh, there's a lot of system logging going on, data harvesting going on.
Brian:
00:24:58
And so what kind of comes back is, Hey, this has some unusual beha,
Brian:
00:25:01
it's a camera app and it's great.
Brian:
00:25:03
The entire contact database and shipped it to the cloud.
Brian:
00:25:05
Right.
Brian:
00:25:06
And that's gonna get a flag.
Brian:
00:25:08
If it's picked up, right?
Brian:
00:25:09
Cause it doesn't make sense that someone who's taking photos is scraping the
Brian:
00:25:12
entire address book off the device or the history of all the wifi nodes that this
Brian:
00:25:17
device ever connected to with the S S I D and whatever passwords hashed or not.
Brian:
00:25:22
Right.
Brian:
00:25:22
So that's part of what it's looking for is it doesn't make sense that this app
Brian:
00:25:26
would be doing that thing, whether it's obviously malicious or possibly malicious.
Mishaal:
00:25:32
Right.
Mishaal:
00:25:32
And another thing is that potentially dodgy and sketchy or malicious behavior,
Mishaal:
00:25:36
isn't only limited to apps that you can install from the Google play store
Mishaal:
00:25:40
or outside of the Google play store.
Mishaal:
00:25:42
It can also be happening within pre-installed applications, which Google
Mishaal:
00:25:46
refers to as mobile bundle applications.
Mishaal:
00:25:49
This isn't really talked about much from what I can see, mostly because it's
Mishaal:
00:25:51
like a conversation Google has with O.
Mishaal:
00:25:54
They have like strict requirements about what these mobile bundle applications can.
Mishaal:
00:25:57
And can't do.
Mishaal:
00:25:58
I wanted to ask you, what do you know about the security risks
Mishaal:
00:26:01
with mobile bundle applications?
Mishaal:
00:26:03
I
Brian:
00:26:03
can't speak for all the carriers.
Brian:
00:26:04
I can't speak for all Google.
Brian:
00:26:06
I can't speak for all the device manufacturers.
Brian:
00:26:08
You need to talk to each of them.
Brian:
00:26:09
What I would say is that most manufacturers and carriers are
Brian:
00:26:11
working hard to do it the right way.
Brian:
00:26:14
So for example, we work with at and T and Google.
Brian:
00:26:18
And so the things that at and T sells are tested and certified by us.
Brian:
00:26:22
And we work with a lot of the other carriers.
Brian:
00:26:24
There are other vendors like us that work with the carriers
Brian:
00:26:26
to try to do the right thing.
Brian:
00:26:27
Google has some attestation and testing requirements that the device manufacturers
Brian:
00:26:31
and carriers must submit, especially if they're part of the Google play ecosystem.
Brian:
00:26:36
And if they're, you know, full GMs licensees.
Brian:
00:26:39
And so what they're trying to do is enable lots of people to grow
Brian:
00:26:41
vibrant businesses and enable.
Brian:
00:26:44
This very broad ecosystem that we have today that has so many users and
Brian:
00:26:48
so many kinds of applications on it.
Brian:
00:26:49
The trick is saying, Hey, here's a set of standards.
Brian:
00:26:52
We want you to align with.
Brian:
00:26:54
And we are either gonna test you or have used an independent third
Brian:
00:26:57
party or self attest that you are doing the right things here and here.
Brian:
00:27:00
And by and large, everybody's got the right idea and
Brian:
00:27:03
trying to do the right thing.
Brian:
00:27:04
You don't hear so much about really bad stuff happening.
Brian:
00:27:08
I will say that supply chain attacks like we've been hearing in the market
Brian:
00:27:12
overall on lots of different things, whether you're the colonial pipeline
Brian:
00:27:16
or what have you, those are out there, and those are hitting mobile, just like
Brian:
00:27:19
they're hitting other corporate systems.
Brian:
00:27:21
And so to no fault of their own developers may wind up with an
Brian:
00:27:24
exploitable or malicious app because of some third party library they're
Brian:
00:27:27
using or system service they're using that suddenly changed because
Brian:
00:27:30
a bad actor got in there and made a.
Brian:
00:27:32
So that will be something I think we're gonna live on in the mobile world,
Brian:
00:27:35
the web world, the network world, and every other world, until we really get
Brian:
00:27:38
supply chain management under control and, and more safe use of components.
Brian:
00:27:42
All right.
Mishaal:
00:27:42
So on that front, what can app developers do to protect their
Mishaal:
00:27:45
applications from any malicious exploits?
Brian:
00:27:48
You know, I think there's a handful of things.
Brian:
00:27:49
So when we work with organizations who are application developers,
Brian:
00:27:52
whether they're large or small, we give them a set of recommendations.
Brian:
00:27:55
First one is make sure you've got some basic security
Brian:
00:27:57
training for your developers.
Brian:
00:27:58
Make sure they understand the fundamentals.
Brian:
00:28:00
Make sure we've got like a guide.
Brian:
00:28:01
That's like here's 10 APIs.
Brian:
00:28:03
You should make sure you use and how to configure them properly.
Brian:
00:28:05
And then a guide on permissioning.
Brian:
00:28:07
A lot of it has to do with just don't collect and store it.
Brian:
00:28:09
If you don't need it, then there are things about how to handle storage,
Brian:
00:28:12
how to handle crypto, how to handle network, how to handle backend API.
Brian:
00:28:15
They're not very difficult.
Brian:
00:28:17
In many instances, it's they didn't know there was a flag they should set.
Brian:
00:28:19
They didn't know there was a configuration option they should be using.
Brian:
00:28:22
They didn't know there was an ordering of operations.
Brian:
00:28:24
They should be using, make sure devs doing the right thing.
Brian:
00:28:26
The second thing is, make sure that there are product requirements that.
Brian:
00:28:30
What kind of security, this thing should have, right?
Brian:
00:28:32
If I'm building a banking app, there should be fundamental requirements
Brian:
00:28:35
that say I'm regulated by the industry.
Brian:
00:28:37
Here's a set of requirements.
Brian:
00:28:38
Well, if I'm not building a banking app, we've been building something else.
Brian:
00:28:40
This requirements may not clear, but just like you're saying, you want a
Brian:
00:28:43
really cool augmented reality experience, make sure that you're protecting
Brian:
00:28:46
using multifactor authentication and protecting my Phi while you do it.
Brian:
00:28:50
Right test it.
Brian:
00:28:52
Whether you using SAS in the pipeline or SA and da in the pipeline, there
Brian:
00:28:56
are open source and paid commercial tools that are cheap and easy to use.
Brian:
00:29:00
They can run autonomously, they catch all the low hanging through.
Brian:
00:29:03
They make your life easier.
Brian:
00:29:04
What's really cool about a lot of the DAS tools including now secure.
Brian:
00:29:07
Now, is it also identifies app store blockers?
Brian:
00:29:09
So you may have a build version issue.
Brian:
00:29:11
You may have a third party SDK issue.
Brian:
00:29:13
You may have some other reason.
Brian:
00:29:14
Google may say, Nope, I'm not gonna accept this binary because you're
Brian:
00:29:17
not following one of my rules.
Brian:
00:29:19
You can catch that too.
Brian:
00:29:20
So that's not just security and privacy.
Brian:
00:29:21
That's finding those rules.
Brian:
00:29:23
And if you're super high end app, you're that embedded health app, that's
Brian:
00:29:26
maintaining my heartbeat to a cardiac monitor or you're my banking app or
Brian:
00:29:31
my financial account management app.
Brian:
00:29:32
You should be doing pen testing once in a while and have really smart
Brian:
00:29:35
experts, tear it down just to make sure there isn't something exploitable.
Brian:
00:29:38
So teach requirements, automate your testing everywhere you.
Brian:
00:29:43
Pen test the high risk stuff.
Brian:
00:29:45
Be serious enough that say, Hey, we wanna have a great user experience
Brian:
00:29:48
and millions or billions of downloads.
Brian:
00:29:50
And we just wanna make sure that people's data does what it's supposed to do.
Mishaal:
00:29:54
Security is essential, of course, for every application and developer
Mishaal:
00:29:58
should be top of mind, but it should be even more top of mind, especially
Mishaal:
00:30:01
if you're dealing with sensitive data.
Mishaal:
00:30:03
And as Brian mentioned, medical financial, you don't want to be slapped with, uh,
Mishaal:
00:30:07
billions of dollars in a lawsuit for mishandling or having some data breach.
Mishaal:
00:30:12
That you could have solved by protecting your application better.
Mishaal:
00:30:15
And if you are dealing with any mission critical application or you need to
Mishaal:
00:30:20
deploy mission critical applications onto fleets of dedicated devices, and
Mishaal:
00:30:23
you wanna make sure that the firmware it's running on and the data you
Mishaal:
00:30:26
depend on secured, come talk to us.
Mishaal:
00:30:28
That SPER we specialize in helping companies manage fleets of dedicated
Mishaal:
00:30:31
devices, including deploying and keeping your apps updated on them.
Mishaal:
00:30:35
If you're trying to deploy a kiosk or point of sale terminal,
Mishaal:
00:30:38
you need to lock it down.
Mishaal:
00:30:39
So potentially malicious applications, can't be side loaded onto.
Mishaal:
00:30:42
That's especially important because most of the time, these dedicated
Mishaal:
00:30:45
devices won't have GMs on them.
Mishaal:
00:30:47
So you can't count on Google, play, protect for protection.
Mishaal:
00:30:50
And if you're worried about any mobile bundle applications that are pre-installed
Mishaal:
00:30:53
on the off the shelf hardware that you've picked up for your dedicated device
Mishaal:
00:30:57
fleet, you'll need to look at deploying your own firmware based on AOS P.
Mishaal:
00:31:00
We can also help with that.
Mishaal:
00:31:02
Check us out@esper.io and Brian, thanks for joining us on
Mishaal:
00:31:05
this episode of Android bites.
Mishaal:
00:31:07
Is there anything you'd like to close us off with?
Mishaal:
00:31:09
Can you like work?
Mishaal:
00:31:09
Can people find you online and work?
Mishaal:
00:31:12
Can people work with now secure on securing their application?
Brian:
00:31:15
Yeah, so you, you can find us online.
Brian:
00:31:16
There's a bunch of great resources.
Brian:
00:31:17
I'm gonna talk out real quick.
Brian:
00:31:18
So now secure.com/nasa, M a S a that will help you understand the app defense
Brian:
00:31:24
Alliance and the independent security.
Brian:
00:31:27
If you're a user look to see that the apps you're choosing have
Brian:
00:31:30
an independent security review.
Brian:
00:31:31
If you're a developer, get your independent security review, we
Brian:
00:31:34
can help you expedite that process.
Brian:
00:31:36
That's cheap and easy to go do.
Brian:
00:31:38
If you want some training@cat.now secure.com is a free training environment.
Brian:
00:31:42
It's for development, QA, DevOps, and security teams to learn everything they
Brian:
00:31:46
needed to know about building testing and running secure apps in production.
Brian:
00:31:50
Again, that's a free resource.
Brian:
00:31:52
You can find me all over the place.
Brian:
00:31:53
I'm actually known as read on the run is my handle.
Brian:
00:31:56
So you can find me on, you know, LinkedIn, Twitter, and other kinds of fun places.
Brian:
00:31:59
Speaking to events of all kinds.
Brian:
00:32:00
The last thing I'll give you is O O is growing dramatically.
Brian:
00:32:03
The O OS mobile project is advancing.
Brian:
00:32:07
There's some really great things coming from O O this fall.
Brian:
00:32:10
And until later this year with the evolution of the
Brian:
00:32:12
mobile app security project.
Brian:
00:32:14
So if you're into the community activities, come join us at OAS, spend the
Brian:
00:32:18
mobile project and get involved because there's some really great stuff going on.
Brian:
00:32:21
It's a place you can learn a place you can contribute.
Brian:
00:32:24
And really be part of a community.
Brian:
00:32:25
Who's trying to do the right thing for mobile application
Mishaal:
00:32:27
security.
Mishaal:
00:32:28
And just to clarify, what is O OSP?
Mishaal:
00:32:30
Exactly?
Mishaal:
00:32:30
What does it stand for?
Mishaal:
00:32:31
Oh,
Brian:
00:32:31
O OSP is the open web application security project or program.
Brian:
00:32:35
It's an independent vendor, agnostic community of, uh, security professionals.
Brian:
00:32:40
Who've been building standards and specifications for how to build secure web
Brian:
00:32:44
apps, mobile apps, how to secure your APIs on the back end and things of that nature.
Brian:
00:32:49
So O O for those who are in the security.
Brian:
00:32:52
Are generally familiar with it as a non-for-profit that drives that
Brian:
00:32:56
O OSP has a number of initiatives going on in the development world.
Brian:
00:32:59
And what's really great about it is that Google has fully embraced O O
Brian:
00:33:03
so the app defense Alliance master certification program, which gets you
Brian:
00:33:07
that independent security verification actually is using the O OSP standard.
Brian:
00:33:11
And you're gonna see the O OSP standard in many other places.
Brian:
00:33:15
As a mechanism for a common industry standard for what security means, whether
Brian:
00:33:19
it's web mobile network, device or API.
Brian:
00:33:22
So there's some really great things going on at that
Mishaal:
00:33:24
standards body.
Mishaal:
00:33:25
All right.
Mishaal:
00:33:26
Thank you, Brian.
Mishaal:
00:33:26
And thank you everyone again for listening to another episode of Android bites.
