0

Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password.

I've decompiled it with JEB2 and obviously within huge mess of code I can see various references to the cryptographic algorithms, hashing and encoding routines (OCRA1, HMAC, SHA1, AES, base64 etc.) utilized in the classes and methods of the prototypes, related calls etc.

Now, from the experienced pentester's viewpoint would it be possible to reveal the hardcoded pass through app's heap dumps or maybe traffic interception with the BurpSuite's mitm attack via fake certificate between the client/server point? If so, how would I then discern it from the ocean of other strings?!

If that's not possible what is the proper way to proceed from then on taking into account lack of experience in reading java or reverse engineering crypto stuff?

Regards

Improve this question
0

2 Answers 2

Reset to default
1

First thing I'd try to search for uses of standard implementation of the key store, KeyStore class. This class is external for the application and should be referenced by name.

If this key store uses standard API it probably uses the the KeyStore.load function which gets the desired password as a second parameter.

final void load(InputStream stream, char[] password) : Loads this KeyStore from the given input stream.

Good luck.

Improve this answer
8
  • What about the heap dumping scenario, can that help ?
    – martin_s
    Commented Feb 22, 2017 at 7:04
  • @martin_s Only if the code and/or related strings are generated on the fly, obfuscated or encrypted. However in this case you'll probably receive a lot more strings, and the main problem of distinguishing between needed and not needed strings will remain.
    – w s
    Commented Feb 22, 2017 at 7:48
  • Do you know where is this local keystore located ? Is your code obfuscated ?
    – w s
    Commented Feb 22, 2017 at 7:49
  • @w s The challenger essentially told me that I should be able to discover all this vulnerabilites, keystore name and location with hard-coded pass by reading decompiled code.
    – martin_s
    Commented Feb 22, 2017 at 15:42
  • @w s Can you tell me the typical names and locations for the keystore file?
    – martin_s
    Commented Feb 23, 2017 at 0:55
2

With Jeb or another tool for static analysis of source code, seek out calls to the Keystore API classes and member functions.

Once you have identified a function of interest, especially if it has arguments that include the password or a hash of it, you can then move onto dynamic analysis of the code by using a hooking framework to hook the function of interest to inspect its arguments and return values.

There are several hooking frameworks available for Android, including frida and Xposed.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.