COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-661

Root/Jailbreak Detection Evasion via Debugging

An adversary inserts a debugger into the program entry point of a mobile application to modify the application binary, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Rooting/Jailbreaking a mobile device also provides users with access to system debuggers and disassemblers, which can be leveraged to exploit applications by dumping the application's memory at runtime in order to remove or bypass signature verification methods. This further allows the adversary to evade Root/Jailbreak detection mechanisms, which can result in execution of administrative commands, obtaining confidential data, impersonating legitimate users of the application, and more.

Soyutlama

Detailed

Tipik ciddiyet

Very High

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary inserts a debugger into the program entry point of a mobile application to modify the application binary, with the goal of evading Root/Jailbreak detection. Mobile device users often Root/Jailbreak their devices in order to gain administrative control over the mobile operating system and/or to install third-party mobile applications that are not provided by authorized application stores (e.g. Google Play Store and Apple App Store). Rooting/Jailbreaking a mobile device also provides users with access to system debuggers and disassemblers, which can be leveraged to exploit applications by dumping the application's memory at runtime in order to remove or bypass signature verification methods. This further allows the adversary to evade Root/Jailbreak detection mechanisms, which can result in execution of administrative commands, obtaining confidential data, impersonating legitimate users of the application, and more.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Identify application with attack potential

The adversary searches for and identifies a mobile application that could be exploited for malicious purposes (e.g. banking, voting, or medical applications).

Kullanılan teknikler

  • Search application stores for mobile applications worth exploiting
2

Experiment

Debug the target application

The adversary inserts the debugger into the program entry point of the mobile application, after the application's signature has been identified, to dump its memory contents.

Kullanılan teknikler

  • Insert the debugger at the mobile application's program entry point, after the application's signature has been identified.
  • Dump the memory region containing the now decrypted code from the address space of the binary.

Remove application signature verification methods

Remove signature verification methods from the decrypted code and resign the application with a self-signed certificate.
3

Exploit

Execute the application and evade Root/Jailbreak detection methods

The application executes with the self-signed certificate, while believing it contains a trusted certificate. This now allows the adversary to evade Root/Jailbreak detection via code hooking or other methods.

Kullanılan teknikler

  • Optional: Hook code into the target application.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • A debugger must be able to be inserted into the targeted application.

Gerekli beceri

  • High: Knowledge about Root/Jailbreak detection and evasion techniques.
  • Medium: Knowledge about runtime debugging.

Gerekli kaynak

  • The adversary must have a Rooted/Jailbroken mobile device with debugging capabilities.

Etki

Başarılı saldırı neye yol açar?

Execute Unauthorized Commands

Etkilenen alanlar: Integrity, Authorization

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authorization

Read Data

Etkilenen alanlar: Confidentiality, Access Control

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Instantiate checks within the application code that ensures debuggers are not attached.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
An adversary targets an iOS banking application in an attempt to compromise sensitive user data. The adversary launches the application with the iOS debugger and sets a breakpoint at the program entry point, after the application's signature has been verified. Next, the adversary dumps the memory region that contains the decrypted code from the address space of the binary. The 'Restrict' flag is then stripped from the application and the adversary resigns the application with a self-signed certificate. The application is now executed without the 'Restrict' flag, while trusting the self-signed certificate to be legitimate. However, the adversary is now able to evaded Jailbreak detection via code hooking or other methods and can glean user credentials and/or transaction details.
CAPEC-661: Root/Jailbreak Detection Evasion via Debugging — DayBreach Saldırı Sözlüğü · DayBreach