Android Security Lab

Type:

Bachelor/Master Praktikum (Lab)

Semester:

Winter Semester 2017/18

Language:

English

Preliminary Meeting:

Friday 14.07.2017, 14:00 (Konrad Zuse, 01.11.018) Slides

Lecturer:

Prof. Dr. Alexander Pretschner

Alei Salem

SWS:

6

ECTS:

10

LvNr:

Links:

TumOnline, Moodle

Prerequisites:

Good Java programming skills

Recommended:
  • Good Java programming skills.
  • Good understanding of security concepts.
  • Knowledge in reverse engineering is highly recommended.
  • Previous experience in using machine learning toolkits is recommended (but not necessary).

Max. Number of participants:

15

Overview

The course material will focus on categories of vulnerabilities that have recently been jeopardizing the security of the Android platform e.g. app reverse engineering and repackaging, traffic analysis, authentication bypassing, client-side injection, repackaged malware, et cetera. The material will also have a glimpse of utilizing artificial intelligence techniques e.g. machine learning within this domain.

The topics to be covered in this practical course include (but not limited to):

  • Android app components and permissions
  • Android security architecture
  • App vulnerabilities (e.g., leaking content providers, input validation issues, hardcoding, etc.)
  • Tapjacking
  • App pen-testing using Drozer
  • Client-side Injection
  • App monitoring and hooking
  • Dex file analysis and app reverse engineering
  • Android app analysis and testing e.g. using concolic execution
  • Malware analysis and detection (using machine learning)

Course material is available for registered students on moodle.

Organization

The lab is divided into two phases. The purpose of the former phase is to introduce the students to common attacks that can be launched against Android, and to give them hands-on experience implementing those attacks. This not only includes exploiting the vulnerabilities, but also crash courses in using some tools and techniques for reverse engineering, pentesting tools like Drozer, behavior stimulation tools such including AndroidViewClient, reverse tools such as Jadx, et cetera. Armed with such knowledge, the second phase is a research-oriented phase in which the students are required to research a topic and implement a tool/approach that (1) implements an attack relevant to the ones discussed during the lab (2) defends again a an attack, or (3) analyzes and detects Android (repackaged) malware.

Recommended Reading

  • Android Security Internals: An In-Depth Guide to Android’s Security Architecture by Nikolay Elenkov.
  • Android Hacker’s Handbook by Collin Mulliner, Georg Wicherski, Joshua J. Drake, Pau Oliva Fora, Stephen A. Ridley, and Zach Lanier.
  • Android Malware and Analysis by Jose Andre Morales, Ken Dunham, Manu Quintans, Shane Hartman, and Tim Strazzere.