At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already figured out that the device binding can be exploited by changing the
<string name="AppSetting_DevIDValue"> in the
/data/data/com.rsa.securidapp/shared_prefs/DataKeySetting.xml or by changing the IMEI of the device if the device binding is bases on the IMEI.
What I am now looking for is what secrets are used to encrypt the
TOKENHASH in the
/data/data/com.rsa.securidapp/databases/securidDB sqlite database. I don't recognize that the app uses the android keystore for that.
I already tried to clone the IMEI and MAC address, furthermore I tried do clone the keystore
.masterkey file and used the same passcode on the other device which sould be responsible for the decryption of that keystore
.masterkey. In 2012 SensePost published their research about the windows application of it here.