At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already figured out that the device binding can be exploited by changing the <string name="AppSetting_DevIDValue"> in the /data/data/com.rsa.securidapp/shared_prefs/DataKeySetting.xml or by changing the IMEI of the device if the device binding is bases on the IMEI.

What I am now looking for is what secrets are used to encrypt the ROOTSEED and TOKENHASH in the /data/data/com.rsa.securidapp/databases/securidDB sqlite database. I don't recognize that the app uses the android keystore for that. I already tried to clone the IMEI and MAC address, furthermore I tried do clone the keystore .masterkey file and used the same passcode on the other device which sould be responsible for the decryption of that keystore .masterkey. In 2012 SensePost published their research about the windows application of it here.

  • Have done something similar in iOS a while ago: I copied the whole application folder to a new device and wrote a substrate tweak to make the device report the device id from previous device. – Remko Mar 23 '16 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.