>> Okay. Without any further adieu, we have a short talk, a 20 minute talk, Jaime Sanchez
talking about building an Android IDS on the network level. Jaime, take it away.
>> JAIME SANCHEZ: Hello. My name is Jaime Sanchez. I'm going to talk about building
Android IDS on a network level. I work for security for about ten years. I work for international
companies, especially as an advisor. In my free time, I enjoy doing research on security.
And I work as an independent consultant. I'm from Spain.
I have talked in other conference, in Spain, like, rootedCON and Nuit du Hack.
I don't know what happened. Last night it's my first time in Vegas. Today I wake up, I
was with two strippers. No, don't laugh. I know the reason of this. Just blame aliens.
I'm sure they forced me to drink. I'm from Spain. I don't like partying.
(Laughter). >> AUDIENCE MEMBER: Right!
>> JAIME SANCHEZ: You know us. We have 20 minutes before I get with my lawyers to get
divorced. So let's get ‑‑ (Laughter).
So let's get down to business. The reason of this conference is Android has
great access. Being popular is not always good. Because as it grows, do the attackers.
There are over 100 million Android devices. It was from just last year, and we have our
market share of nearly 50%, and there are several techniques that are used to detect
malware and do attacks on mobile phones. I haven't seen any open source tool to detect
and create patterns to look at these kinds of attacks.
So we have in the last years, we have seen several exploits like the USSD exploit, several
vulnerabilities from webkit and now there's a meterpreter for this.
I took my mobile and my other mobile phone and I make a VPN tunnel with my computer.
So I was trying to analyze all the traffic passing through my device. I launched this
node on my computer to detect suspicious traffic and I could also use tools like TCP RAM. I
would make all the analysis on the forensic as I could. Well, this type of IPS sucks,
man. Are I have several problems because I have to take the traffic from my ‑‑ from
my mobile phone to my computer that's a waste of bandwidth. I couldn't act like an IPS.
Could detect all the attacks. I could take all the malware, but that was just after it
happened. So that has no sense for me. There are a lot of signatures for snort. There
are signatures for other things but they are not associated with Android. What's important
is that we don't have any real notification for the user. So the user doesn't even know
if an attack is happening or is infected by malware or anything.
So I continue with my life. I made and OSfooler, it is for active fingerprinting and it takes
events of code Q and that's when I come up with an idea on how to solve it problem. With
this tool, I was able to modify in realtime all the traffic that was passing through my
computer. So I found a problem that is the packets I
want to capture, they are in kernel space. So the kernel distinction on the device, is
right inside the colonel of space and I couldn't take the pacts to modify in realtime before
the computer has it. I have to work in user space. So I have my own virtual memory and
I have no other option. So for this approach to work, let me show
you a little bit of the ‑‑ of the travel for pacts from the network card to the application.
I call it how I met your packets. (Laughter).
So the first thing, when the ‑‑ when the kernel takes a packet, put inside the
process, the first one is taking directly from the network and put inside a buffer and
then it goes with the software or hardware IRQ, it calls the CPU letting him know there's
a new packet, but the special thing here is before it gets processed, we have to pass
through the chains of IP tables. I'm sure you ‑‑ everyone knows the typical target
destination, but here ‑‑ here's the special thing I found to make my ideas in my tools.
Just after the IP tables, it gets through the IP layer and it checks the headers and
this puts into in the kernels and the corresponding circuit.
So we have several targets for IP tables. You know, you can accept packet, you can drop
the packet. You can let the remote computer know that you have dropped a packet, but there's
a special one, at queue, that's from packet space to user space.
So a little of theory, is that this queue delegates the decision from user space to
kernel space. So in user space, you must have a listener the taker of every packet.
That's because you have to issue a verdict for etch each packet. You have to accept it.
You can drop it, but you can modify in realtime before it gets into the TCP IP stack.
You have to be very fast because if the queue gets full, all the packets that you receive
will be dropped. So for summary, I'm capable of processing
all incoming and all outgoing traffic inside of my device. I make my tool. I thought I
was able to make a tool like this. If I'm able to issue a verdict for every packet,
maybe I'm not also acting like an IDS. I'm acting too like an IPS.
So the release of my tool was and then I moved to C and then to Python and C again.
And then I get to Android IDS. This Android IDS is the first approach to create an source
software that it's a network IDS and a network IPS that has produce real traffic analysis
and look at the Internet protocol. I just say this like protocol searching, or protocol
analysis, content mapping and content searching. It was ‑‑ it would be great if you were
able to hook into the device and work at this, because you could reduce the amount of false
positive. But there is some problems finding the ‑‑ the address of the table. There
is ‑‑ there is ‑‑ there is the difference between the different versions of Android
kernel. So this is something I have to work on.
So the architectures should be a sensor and a server. The sensor is inside of our Android
mobile device and run with no human interaction. It is responsible for analysis in traffic.
It should send some push message to the mobile device of the ‑‑ the user can know if
it's ‑‑ if it's having an attack or it's malware. So I dump this with an application
you will see that's called notify my Android with the IP and realtime notifications.
So it reports through the log‑in server if you want. You can do a devices log and
you can create a VPN internal and do some custom reactive actions like dropping the
packet and adding new rules to the API tables or run a script as we will see.
And very important, it should be minimal overhead to the device.
On the other side, we'll find the ‑‑ we'll find the server. The server is the only
responsible for taking all the traffic. It should send the signatures, the updates signatures
to the device and store the events in the database. Another feature is that we can do
the statistical analysis of the packets in the server instead in the mobile device, because
of the power of the computer, and we could use any CM or whatever you want to add, IP
replication and correlation for the attacks. So the first thing I have to do is protocol
analysis. As my day by day. So the packets, you know that packets don't conform to standards
and some will almost rob them. These kinds of packets
you can find in the service attacks in worms and virus and several of them have several
anomalies because of programming with raw circuits.
So as an example, you can see now that there is TCP IP packet. It has several flags activated
and this kind of packet belongs to a network scanner and should be dropped and it should
be reported to the ‑‑ to the server. So, as I told you, I have a tool, it was called
OSfooler. It was for active and inactive fingerprinting. So I have to port all of my code because my
tool was working okay. So I was trying to detect on drop packets from well‑known tools.
In this case, the Nmap is 16 proofs, TCP IP and ICMP.
And also you have how it get ‑‑ how it detects the attack. In this case, you are
seeing that we are connected through ‑‑ to the mobile. We have to have the ‑‑
the device rooted because we need access to the IP table since and in this case, we are
launching the IDS. It's in log‑in mode. You can see that it's log‑in almost every
packet that has come to the mobile device and as you see, when it finished, the Nmap
has detected that it has like a Linux box, 2.6 or 3.0. In this case, we have only logged
all the attacks. It has a notification. It's disabled to ‑‑ not to stop the demo,
and in this case, what we are going to do is to use the IDS to fool these kind of fingerprinting.
We have to activate it and it's in an Android mode. So every packet has been dropped and
reported to the central server and it's sending full packets to the attacker.
You have seen now it's on a telephone. It's based on Linux 2.4, but it works with any
other signature. I have to work on the ‑‑ on this release. And now you can see that
through my Android, you have the two alerts. One is for log‑in, the scan and the second
one is that we have the ideas in remote and it's in these scans.
The next thing I have to take care of is pattern matching. I don't work for NSA, so I have
to work for myself to look at the traffic and look for a sequence of bytes inside almost
every packet. This is a problem because some of the ‑‑ some of the tacks are related
to a well‑known port and if we have to inspect almost every packet, we can have some false
positives. This can be done by using a full state packet mapping. I'm still using on it
too. I want to search for a pattern through very ‑‑ through several packets and it's
the only way to make it work. So another thing I have to deal with was the
signatures. There are some signatures from emerging threats for Android, and I have to
run it on a script to convert that from Snort to our format. In this case, it's only covered
Snort rules. We can only search for a specific pattern for a specific string. We should work
with preprocessors and isolate the flow but still working on it.
Some of the things, the exploits we have seen, is the USSD code. The USSD code is a code
that is entering to your phone to perform some actions, and it's used by the network
providers to gain the users to some access like code for wording and any of those functions.
It's very simple. It links the browser to the phone application. That means that when
you get into the web application and you have this code, the phone without human interaction
will show you telephone application. So this exploit was published one year or
so ago and we have several web signatures and we can detect it. In this case, I have ‑‑
you have to detect it, our exploit, and Android browser mode crash. You can detect the payloads.
You can detect almost everything that you want.
The last thing, I wanted to deal with was the malware. There are a lot of malware for
Android. Almost every malware has a pattern. I search in this case, the MSN. You can go
from here. And when you get downloaded it connects through the command and control server.
You can clarify the string that it's using to connect to the remote server and the string
to find the pacts is the RQ.php. We could just do those proofs.
If we have the pattern the malware is using, we can detect almost every malware we have,
and not only detecting it. We can drop all of the traffic that it's sending.
On the other side, we have the meterpreter, I think you know, it's an ostensible payload
for metasploit. It has some featured like command history, and top conventions and some
channels some modes. Now there's an Android version. What I have done is creating a package
for Android, installing inside of my own system. And tried to detect all the traffic that it's
having. So the processor is the same. We have to get
inside our Android device. We have to be root and we should launch the script. In this video,
we can show how was the soft installed, but there several methods for assigning this kind
of malware and it will only have to take a listening circuit for metasploit and connect
it back from the ‑‑ from the Android device.
So now we are waiting until the circuit gets opened. And when it does, what we are going
to see is just connect and see whether we can detect all the traffic that's passing.
So just at the bottom, we have found it. We can see that there is several comments that
it sends from the meterpreter to get the system information and so and we have several comments.
We are running it one by one and when you recall, the channel is very easy to see which
comment is being executed the fun thing is I could have done a personal consult now.
You can use some kind of honeypot because you are able to modify the packet in realtime.
If you get infected, you can fool the attacker too. You can show whatever directory you want.
You can send it pictures when he's asking for the welcome list or you can send it any
audio file when it's trying to attach to the microphone. In this case, you see it's very
simple. You have ‑‑ not only are we going to log this, we are able to drop the packet
too in this case I'm not going to drop all this session. You see that it's working and
what I want to do is only drop the packets related with the web cam.
So now you can see that there is no way to access to the web cam and the ideas is blocking
all the traffic. So with this, that's the way I found to create
ideas. You don't have to depend on the Snort or the commercial appliance that costs $20,000.
You can do it by your own and the only thing you have to work is having a great signature
database to work this because the Android devices are the next target for attackers.
So that's it. (Applause).
Thank you. >> This is this is guy's first time speaking
at DEF CON. How did he do? (Applause)
>> Good job.