CNIT 128: Hacking Mobile Devices

39102 Weds 06:10-09:00 pm SCIE 113

Moved to SCIE 37

Spring 2019 Sam Bowne

Schedule · Slides · Projects · Links · Home Page


Catalog Description

Mobile devices such as smartphones and tablets are now used for making purchases, emails, social networking, and many other risky activities. These devices run specialized operating systems have many security problems. This class will cover how mobile operating systems and apps work, how to find and exploit vulnerabilities in them, and how to defend them. Topics will include phone call, voicemail, and SMS intrusion, jailbreaking, rooting, NFC attacks, malware, browser exploitation, and application vulnerabilities. Hands-on projects will include as many of these activities as are practical and legal.

Advisory: CNIT 113 and 123, or equivalent familiarity with hacking computers and operating mobile devices

Upon successful completion of this course, the student will be able to:
  1. Describe the risks of using mobile devices for common activities such as making phone calls, emailing, and shopping
  2. Explain cellular network functions, attacks, anbd countermeasures for voice calls, voicemail, and SMS
  3. Perform and analyze jailbreaks for iOS devices
  4. Analyze the Android security model and rooting
  5. Recognize types of mobile malware and anti-malware options
  6. Identify Web browser services and attacks on mobile platforms and recommend countermeasures
  7. Configure and defeat locking, remote location and wiping services
  8. Explain common mobile app risks and make intelligent decisions when installing and using them
  9. Evaluate the functions and risks of mobile payment services, such as Google Wallet

Textbook

"The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell, Wiley; 1 edition (February 24, 2015), ISBN-10: 1118958500 ISBN-13: 978-1118958506

Buy from Amazon ($49)

Quizzes

The quizzes are multiple-choice, online, and open-book. Study the textbook chapter and take the quiz before that class. Each quiz is due 30 min. before class. Each quiz has 5 questions, you have ten minutes to take it, and you can make two attempts.

To access the quizzes:

  • Go to https://canvas.instructure.com/enroll/GMYGA3
  • If you've taken one of my class previously, you should already have an account on this Canvas server (it's NOT the usual CCSF Canvas system). Otherwise, create a new account.
  • You should see the quizzes, as shown below.
  • Questions? Email CNIT.128sam@gmail.com

Live Streaming

To join the livestream, use this Zoom link:

https://zoom.us/j/4108472927

Classes will also be recorded and published on YouTube for later viewing.

Email

For class-related questions, please email
cnit.128sam@gmail.com

Schedule (may be revised)


DateQuiz & ProjTopic
Wed 1-16  Is Your Mobile App Secure?


Wed 1-23Quiz Ch 1 *  
Proj 1 due *
1. Mobile Application (In)security


Wed 1-30Quiz Ch 6a *
Proj 2 & 3 due *
6. Analyzing Android Applications (Part 1)


Fri 2-3 Last Day to Add Classes

Wed 2-6Quiz Ch 6b *
Proj 4 due
6. Analyzing Android Applications (Part 2)


Wed 2-13Quiz Ch 6c *
Proj 4 due
6. Analyzing Android Applications (Part 3)

Live testing of mobile apps


Wed 2-20Quiz Ch 7a *
Proj 5 & 6 due
7. Attacking Android Applications (Part 1)
Wed 2-27Quiz Ch 7b *
Proj 7 due
7. Attacking Android Applications (Part 2)
Wed 3-6Quiz Ch 7c *
Proj 8 & 9 due
7. Attacking Android Applications (Part 3)
Wed 3-13Quiz Ch 8a *
Proj 10 due
8. Android Implementation Issues (Part 1)
Wed 3-20Quiz Ch 88 *
Proj 11 & 12 due
8. Android Implementation Issues (Part 2)
Wed 3-27 Holiday -- No Class
Wed 4-3Quiz Ch 9 *
Proj 13 due
9. Writing Secure Android Applications
Wed 4-10Quiz Ch 2a *
Proj 14 & 15 due
2. Analyzing iOS Applications (Part 1)
Wed 4-17Quiz Ch 2b *
Proj 16 due
2. Analyzing iOS Applications (Part 2)
Wed 4-24No Quiz
No Proj due
Guest: TBA
Wed 5-1Quiz Ch 3 *
Proj 17 & 18 due
3. Attacking iOS Applications
Wed 5-8Quiz Ch 4-5 *
No Proj due
4. Identifying iOS Implementation Insecurities &
5. Writing Secure iOS Applications
Wed 5-15No Quiz
All Extra Credit Projects Due
Last class
TBA
Thu 5-16 -
Wed 5-22
Final Exam available online throughout the week.
You can only take it once.
* Quizzes due 30 min. before class
  Nothing is consided late until 2-6

Slides

Grading Policy

Motivation

Is Your Mobile App Secure? (DEF CON 23, 2015) · PDF · Keynote
Passwords on a Phone (DEF CON 25, 2017) · PDF · Keynote

Introduction

1. Mobile Application (In)security · PDF · Keynote

Android

6. Analyzing Android Applications Part 1 · PDF · Keynote
6. Analyzing Android Applications Part 2 · PDF · Keynote
6. Analyzing Android Applications Part 3 · PDF · Keynote

7. Attacking Android Applications
8. Identifying and Exploiting Android Implementation Issues
9. Writing Secure Android Applications

iOS

2. Analyzing iOS Applications
3. Attacking iOS Applications
4. Identifying iOS Implementation Insecurities
5. Writing Secure iOS Applications

Projects (under revision)

Mac Users

Proj 1: Genymotion (15 pts)
Proj 2: Ask A Lawyer Plaintext Login (15 pts)
Proj 3: Burp (20 pts)
Proj 4: GenieMD Broken SSL (Harvard & IBM) (15 pts)
Proj 5: Kali Virtual Machine (20 pts) *
Proj 6: Android Debug Bridge (15 pts) *
Proj 7: Observing the Delhaize Log (15 pts)
Proj 8: Menards Plaintext Password Storage (15 pts)

PC Users

Proj 4x: BlueStacks on Windows (15 pts)
Proj 7x: Plaintext Login (15 pts)
Proj 8x: Burp and Nox on Windows (20 pts)
Proj 4: GenieMD Broken SSL (Harvard & IBM) (15 pts)
Proj 5: Kali Virtual Machine (20 pts) *
Proj 9x: Android Debug Bridge with Nox (15 pts) *
Proj 7: Observing the Delhaize Log (15 pts)
Proj 8: Menards Plaintext Password Storage (15 pts)

Projects Without PC Versions Yet

Proj 9: ES Explorer Command Injection (10 pts)
Proj 10: Drozer (20 pts)
Proj 11: Qark (15 pts)
Proj 12: Trojaning the Progressive App (20 pts)
Proj 13: Home Depot Android App Broken Encryption (15 pts)
Proj 14: mAadhaar Code Modification (20 pts)
Proj 15: AndroBugs (10 pts)

Extra Credit Projects

Proj 1x: Interplanetary Overlay Network (ION‑DTN) (15 pts + 10 pts extra)
Proj 2x: Ask A Lawyer Plaintext Password Storage (10 pts)
Proj 3x: Security Audit of An Android App (40 pts)

Proj 4x: BlueStacks Android Emulator on Windows (15 pts)
Proj 4x: BlueStacks Android Emulator on Mac or Linux (15 pts)

Proj 5x: Bank of America Code Modification (25 pts)
Proj 6x: Rooting BlueStacks on Windows (10 pts)

* Project sends scores directly into Canvas

Links

Ch 1a: Mobile OS market share in the U.S. 2018
Ch 1b: Android App Vulnerablities Research
Ch 1c: How to secure, protect, and completely lock down your Android phone
Installing Burp Certificate as a System Certificate
Ch 6a: SSL broken! Hackers create rogue CA certificate using MD5 collisions (2008)
Ch 6b: Create your own MD5 collisions
Ch 6c: MD5 considered harmful today (2008)
Ch 6d: Why it's harder to forge a SHA-1 certificate than it is to find a SHA-1 collision
Ch 6e: Encryption: Android Open Source Project
Ch 6f: Android version history - Wikipedia
Ch 6g: Android Encryption Demystified | ElcomSoft blog
Stuck at 99% : noxappplayer
JustTrustMe SSL certificate UN-pinning
Android Applications Reversing 101
Android and Apple phone security: Here's an objective chart to help you decide
Android Enterprise Recommended
Ch 6h: What is LineageOS and What Happened to CyanogenMod?
Ch 6i: Paranoid Android (software) - Wikipedia

          

Links from Previous Textbook

Last Updated: 2-14-19 6:45 am