Authenticator Leakage Through Backup Channels on Android
summary
Finds that Android apps store session tokens and cookies in app internal storage and common backup tools leak those authenticators through ADB- and SD-card-based channels. Reverse engineering of helium shows an ADB proxy that broadcasts a one-time password allowing any same-package app to trigger signature-level commands and an open HTTP port that any app with Internet permission can call. Builds AuthSniffer and shows 80 of 117 (68.4%) top apps tested expose usable authenticators via backup, enabling full account takeover.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 0:36Applications
- 1:51Native vs Web
- 5:46Agenda
- 6:56Web Authentication
- 8:12Summary
- 8:58Types of Authenticator
- 10:47Basic Authentication
- 12:49Single SIA
- 16:31Android Account Manager
- 17:17Demo
- 18:06Protocol Security
- 19:58Infrastructure Security
- 20:29Internal Storage
- 21:00Adulation Mechanism
- 21:58Backup Function
- 22:54ADB Based Backup
- 23:13ADB Based Backup Implementation
- 24:53Backup Data
- 25:36Authentication Protocol
- 27:13Helium
- 27:50Reverse Engineering
- 29:12Helium Interface
- 30:16Broadcast Password
- 31:55Exception
- 32:26Cover
- 32:57Evaluation
- 34:17WebBased Backup
- 35:20Evolution Evaluation
- 39:33Case Study
- 43:41Mitigation
- 45:18Conclusion
related talks
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
56mModern Android Hacking
50mAttackers want your data and they're getting it from your API
53mA More Secure World for Android Apps
45mI just hacked your app!
36mRevisiting Stealthy Sensitive Information Collection from Android Apps
01h 07mHow to attack (and secure) an Android app: an introduction