CNIT 128: Hacking Mobile Devices

Spring 2024 Sam Bowne

35292 Wed 6:10 - 9:00 pm, Science 37

Schedule · Slides · Projects · Links · Grading

Use Twitch


To attend class:
https://twitch.tv/sambowne


Free Textbook Access

  • Go here
  • Click "Institution not listed"
  • Enter your CCSF email address
  • Enter the book's title the "Find a Solution..." field

Catalog Description

Mobile devices such as smartphones and tablets are now used for making purchases, emails, social networking, and many other risky activities. These devices run specialized operating systems have many security problems. This class will cover how mobile operating systems and apps work, how to find and exploit vulnerabilities in them, and how to defend them. Topics will include phone call, voicemail, and SMS intrusion, jailbreaking, rooting, NFC attacks, malware, browser exploitation, and application vulnerabilities. Hands-on projects will include as many of these activities as are practical and legal.

Advisory: CNIT 113 and 123, or equivalent familiarity with hacking computers and operating mobile devices

Upon successful completion of this course, the student will be able to:
  • Assess the risks of using mobile devices for common activities such as making phone calls, emailing, and shopping
  • Perform jailbreaks for iOS devices and analyze the Android security model and rooting
  • Differentiate and describe types of mobile malware and anti-mal ware options
  • Evaluate Web browser services and attacks on mobile platforms and recommend countermeasures
  • Configure, deploy, and defeat locking, remote location and wiping services. Outcome 6: Prioritize common mobile app risks and determine how and when to appropriately install and use them.

Textbook

"The Mobile Application Hacker's Handbook 1st Edition", by Dominic Chell, Wiley; 1 edition (February 24, 2015), ISBN-10: 1118958500 ISBN-13: 978-1118958506

Buy from Amazon ($49)

Quizzes

The quizzes are multiple-choice, online, and open-book. However, you may not ask other people to help you during the quizzes. You will need to study the textbook chapter before the lecture covering it, and take the quiz before that class. Each quiz is due 30 min. before class. Each quiz has 5 questions, you have ten minutes to take it, and you can make two attempts. If you take the quiz twice, the higher score counts.

Don't use CCSF's Canvas system for this class. Instead, all students should use this Canvas server:

Enroll Here · View Course · Reset password

Discussion Board

Each CCSF student must contribute to the Discussion Board in Canvas. There are dates listed in the schedule with Discussion assignment due.

For the topics and requirements, see the Discussion board in Canvas.

Non-CCSF students don't have a Discussion Board in Canvas, but are encouraged to join Twitter and engage in the public discussions there.

Email

For class-related questions, please email
cnit.128sam@gmail.com

Schedule (may be revised)

DateQuiz & ProjTopic
Wed 1-17 The Worst Mobile Apps
Demos: M 140 and M 141

Wed 1-24Quiz Ch 1 & Ch 6a due *
(M 140 & M141) or
(M 101 & M103) or
(M 104 & M 106) due *		 1. Mobile Application (In)security &
6. Analyzing Android Applications (Part 1)
Demo: M 105

Wed 1-31Quiz Ch 6b
M 105 due
Discussion 1 		6. Analyzing Android Applications (Part 2)
Demo: M 107 and M 111

Wed 2-7Quiz Ch 6c
M 107 & M 111 due
Discussion 2 		6. Analyzing Android Applications (Part 3)
Demo: M 200 and M 207

Wed 2-14Quiz Ch 7a
M 200 (or M 201 or M 203) due
Discussion 3		 7. Attacking Android Applications (Part 1)

Wed 2-21Quiz Ch 7b
M 207 due
Discussion 4		 7. Attacking Android Applications (Part 2)

Wed 2-28Quiz Ch 7c
M 302 due
Discussion 5		 7. Attacking Android Applications (Part 3)
Demo: M 511 and M 401

Wed 3-6Quiz Ch 8a
M 401 due
Discussion 6		 8. Android Implementation Issues (Part 1)
Demos: M 304 and M 402 and M 503

Wed 3-13Quiz Ch 8b
M 511 due
Discussion 7		 8. Android Implementation Issues (Part 2)
Demos: M 305 and M 412

Wed 3-20Quiz Ch 8c
M 402 due
Discussion 8		 8. Android Implementation Issues (Part 3)
Demo: M 513

Wed 3-27Quiz Ch 9
M 503 due
Discussion 9		 9. Writing Secure Android Applications

Wed 4-3Quiz Ch 2a
M 412 due
Discussion 10		 2. Analyzing iOS Applications (Part 1)

Wed 4-10 Holiday -- No Class
Wed 4-17 Risks for ML, AI, and Copilot KEY · PDF
Demos: M 414 and M 521

Wed 4-24Quiz Ch 2b
M 513 due
Discussion 11		 2. Analyzing iOS Applications (Part 2)
Demo: M 410

Wed 5-1Quiz Ch 3a (extra credit)
M 521 due
 3. Attacking iOS Applications (Part 1)
Demo: M 512

Wed 5-8Quiz Ch 3b (extra credit)
All Extra Credit Projects Due 		Last class: 3. Attacking iOS Applications (Part 2)

Wed 5-15
through
Wed 5-22		  Final Exam available online throughout the week.
You can only take it once.
All quizzes due 30 min. before class
* No late penalty until 2-14

Slides

Motivation

The Worst Mobile Apps (DEF CON 28, 2020) · Keynote

Introduction

1. Mobile Application (In)security · PDF · Keynote

Android

6. Analyzing Android Applications  Part 1 (pg. 173 - 205) · PDF · Keynote
Part 2 (pg. 205 - 222) · PDF · Keynote
Part 3 (pg. 222 - 246) · PDF · Keynote
 
7. Attacking Android Applications  Part 1 (pg. 247 - 271) · PDF · Keynote
Part 2 (pg. 271 - 303) · PDF · Keynote
Part 3 (pg. 303 - 350) · PDF · Keynote
 
8. Identifying and Exploiting
    Android Implementation Issues		  Part 1 (pg. 353 - 375) · PDF · Keynote
Part 2 (pg. 376 - 401) · PDF · Keynote
Part 3 (pg. 401 - 426) · PDF · Keynote
 
9. Writing Secure Android Applications · PDF · Keynote

iOS

2. Analyzing iOS Applications  Part 1 (pg. 17 - 42) · PDF · Keynote
Part 2 (pg. 42 - 67) · PDF · Keynote
 
3. Attacking iOS Applications  Part 1 (pg. 69 - 91) · PDF · Keynote
Part 2 (pg. 91 - 131) · PDF · Keynote

Links

Apple Platform Security
Apple Platform Security PDF
DVIA (Damn Vulnerable iOS App) | A vulnerable iOS app for pentesting
OWASP/owasp-masvs: The Mobile Application Security Verification Standard (MASVS) is a standard for mobile app security.
2019-12-29: Hybrid App Developers: Don't Store Your User's Passwords
Passwords are the biggest threat to GDPR compliance (Mar. 2019)
Chat app Knuddels fined 20 k Eurosunder GDPR regulation (Nov 24, 2018)
Remote logging for mobile apps (April, 2019)
From checkra1n to Frida: iOS App Pentesting Quickstart on iOS 13 -- spaceraccoon.dev
Project Zero: Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641 (Jan. 2019)
Project Zero: Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass (Jan. 2019)
Project Zero: Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution (Jan. 2019)
Reverse-Engineering-and-Tampering iOS Apps OWASP
GDB to LLDB command map -- The LLDB Debugger
Google Maps Platform--Protecting API Keys
We reverse engineered 16k apps, here's what we found
Hands On Mobile API Security: Get Rid of Client Secrets
Why OAuth API Keys and Secrets Aren't Safe in Mobile Apps
Hey Developer, Give me your API keys.!!
HOW TO EXTRACT AN API KEY FROM A MOBILE APP BY STATIC BINARY ANALYSIS
Ch 2b: Hack in the (sand)Box
Android App Reverse Engineering 101 | Learn to reverse engineer Android applications!
DJI Privacy Analysis Validation--GOOD ANDROID PROJECT
Oversecured detects dangerous vulnerabilities in the TikTok Android app--USE FOR PROJECT
AndroGoat: Vulnerable Android App
Ch 6a: Encryption  |  Android Open Source Project
Ch 6b: Android versions market share
Ch 7a: Android activity manager "am" command help
2021-02-22: Virtual iPhones with Free Trial!
pidcat: Colored logcat script which only shows log entries for a specific application package.
Ch 7b: Service vs IntentService in Android
Can I Jailbreak? - Home
Jailbreaking iOS for Mobile Security Assessments (March 2021 Edition) - SANS Institute
Ch 8a: What happens if you enter the wrong PIN for many times in an Android phone? - Quora
Ch 8b: How to reset your Android lock screen password/PIN/pattern - TechRepublic
Ch 8c: Android WebView addJavascriptInterface Code execution Vulnerability
MOBISEC - Mobile Security Course
iOS Hooking With Objection - HackTricks
ZipperDown Vulnerability--Path Traversal in iOS and Android
ANDROID PT / Path Traversal Vulnerability
Ch 6c: Android OS version market share over time | AppBrain
Drozer / needle - is it still alive?
2022-10-04: Releases · abhi-r3v0/EVABS
EVABSv4 Walkthrough
Android Studio Emulator (AVD) Rooting with Magisk using rootAVD - YouTube
EVABSv4 (Part 2) - ITZone
Troubleshooting Android Studio - Android Emulator Wifi Connected with No Internet
Registers in smali
Ch 2a: Cachegrab sttack exposes secrets from ARM TrustZone
Ch 2c Citigroup says its iPhone app puts customers at risk
Ch 2d: Citi Discloses Security Flaw in Its iPhone App - WSJ
How to Reverse Engineer and Patch an iOS Application for Beginners: Part I
Guide to Reversing and Exploiting iOS binaries Part 2: ARM64 ROP Chains
Heap Overflows on iOS ARM64: Heap Spraying, Use-After-Free (Part 3)
How to instrument system applications on Android stock images with Frida and Magisk
Security of runtime process in iOS and iPadOS - Apple Support
Xamarin | Open-source mobile app platform for .NET, with iOS -- USE FOR PROJECTS

          

Links from Previous Textbook

Last Updated: 5-8-24 7:37 pm