Discovering Authentication Credentials in Volatile Memory of Android Mobile Devices

Apostolopoulos, Dimitris; Marinakis, Giannis; Ntantogian, Christoforos; Xenakis, Christos

doi:10.1007/978-3-642-37437-1_15

Cited by 23 publications

(20 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…There have been several studies on Android, comparably dumping memory to look for sensitive data [2], [17], [1], [20], [37]. However, all of these approaches required a manual approach to capture and search the relevant memory images.…”

Section: B Test Frameworkmentioning

confidence: 99%

“…Apostolopoulos et al [2] showed that login credentials could be recovered from memory images using simple pattern matching. Hilgers et al [14] identified a variety of data structures in memory images (e.g., GPS coordinates within photo metadata).…”

Section: A Memory Forensicsmentioning

confidence: 99%

“…The problem with manual approaches is that they don't easily scale to examining hundreds of application runs. For example, Apostolopoulos et al [2] spent six months examining thirty Android applications. Furthermore, if the effects being measures are probabilistic in nature, multiple runs will be necessary, further burdening the data collection and analysis process.…”

Section: B Test Frameworkmentioning

confidence: 99%

See 2 more Smart Citations

Removing Secrets from Android's TLS

Lee¹,

Wallach

2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-Cryptographic libraries that implement Transport Layer Security (TLS) have a responsibility to delete cryptographic keys once they're no longer in use. Any key that's left in memory can potentially be recovered through the actions of an attacker, up to and including the physical capture and forensic analysis of a device's memory. This paper describes an analysis of the TLS library stack used in recent Android distributions, combining a C language core (BoringSSL) with multiple layers of Java code (Conscrypt, OkHttp, and Java Secure Sockets). We first conducted a black-box analysis of virtual machine images, allowing us to discover keys that might remain recoverable. After identifying several such keys, we subsequently pinpointed undesirable interactions across these layers, where the higherlevel use of BoringSSL's reference counting features, from Java code, prevented BoringSSL from cleaning up its keys. This interaction poses a threat to all Android applications built on standard HTTPS libraries, exposing master secrets to memory disclosure attacks. We found all versions we investigated from Android 4 to the latest Android 8 are vulnerable, showing that this problem has been long overlooked. The Android Chrome application is proven to be particularly problematic. We suggest modest changes to the Android codebase to mitigate these issues, and have reported these to Google to help them patch the vulnerability in future Android systems.

show abstract

Section: B Test Frameworkmentioning

confidence: 99%

Section: A Memory Forensicsmentioning

confidence: 99%

Section: B Test Frameworkmentioning

confidence: 99%

See 1 more Smart Citation

Removing Secrets from Android's TLS

Lee¹,

Wallach

2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Apart from personal computers, sensitive information was also recovered from the volatile memory of Android devices using two different methods. More specifically, in the first method [12] the authors used the Linux Memory Extractor (LiME) kernel module [13] and a physical Samsung i9000 phone to dump the Android memory, whereas in the second technique [14] the Android emulator was used alongside with Dalvik Debug Monitor Server (DDMS) to acquire the memory data. In both cases, critical and secure applications, such as mobile banking and password managers, were examined and authentication credentials were recovered in plain text from the dumped memory.…”

Section: Related Workmentioning

confidence: 99%

Protecting Sensitive Information in the Volatile Memory from Disclosure Attacks

Malliaros

Ntantogian

Xenakis

2016

2016 11th International Conference on Availability, Reliability and Security (ARES)

Self Cite

View full text Add to dashboard Cite

Abstract-The protection of the volatile memory data is an issue of crucial importance, since authentication credentials and cryptographic keys remain in the volatile memory. For this reason, the volatile memory has become a prime target for memory scrapers, which specifically target the volatile memory, in order to steal sensitive information, such as credit card numbers. This paper investigates security measures, to protect sensitive information in the volatile memory from disclosure attacks. Experimental analysis is performed to investigate whether the operating systems (Windows or Linux) perform data zeroization in the volatile memory. Results show that Windows kernel zeroize data after a process termination, while the Linux kernel does not. Next, we examine functions and software techniques in C/C++ programming language that can be used by developers to modify at process runtime the contents of the allocated blocks in the volatile memory. We have identified that only the Windows operating system provide a specific function named SecureZeroMemory that can reliably zeroize data. Finally, driven by the fact that malware scrapers primarily target web browsers, we examine whether it is feasible to extract authentication credentials from the volatile memory allocated by web browsers. The presented results show that in most cases we can successfully recover user authentication credentials from all the web browsers except when the user has closed the tab that used to access the website.

show abstract

“…In [2,20], Apostolopoulos et al search for authentication credentials in the process memory of applications. They use the Dalvik Debugging Monitor Server (DDMS) tool [20] and the LiME kernel module [12].…”

Section: Related Workmentioning

confidence: 99%

A flexible framework for mobile device forensics based on cold boot attacks

Huber

Taubmann

Wessel

et al. 2016

EURASIP J. on Info. Security

View full text Add to dashboard Cite

Mobile devices, like tablets and smartphones, are common place in everyday life. Thus, the degree of security these devices can provide against digital forensics is of particular interest. A common method to access arbitrary data in main memory is the cold boot attack. The cold boot attack exploits the remanence effect that causes data in DRAM modules not to lose the content immediately in case of a power cut-off. This makes it possible to restart a device and extract the data in main memory. In this paper, we present a novel framework for cold boot-based data acquisition with a minimal bare metal application on a mobile device. In contrast to other cold boot approaches, our forensics tool overwrites only a minimal amount of data in main memory. This tool requires no more than three kilobytes of constant data in the kernel code section. We hence sustain all of the data relevant for the analysis of the previously running system. This makes it possible to analyze the memory with data acquisition tools. For this purpose, we extend the memory forensics tool Volatility in order to request parts of the main memory dynamically from our bare metal application. We show the feasibility of our approach on the Samsung Galaxy S4 and Nexus 5 mobile devices along with an extensive evaluation. First, we compare our framework to a traditional memory dump-based analysis. In the next step, we show the potential of our framework by acquiring sensitive user data.

show abstract

Discovering Authentication Credentials in Volatile Memory of Android Mobile Devices

Cited by 23 publications

References 3 publications

Removing Secrets from Android's TLS

Removing Secrets from Android's TLS

Protecting Sensitive Information in the Volatile Memory from Disclosure Attacks

A flexible framework for mobile device forensics based on cold boot attacks

Contact Info

Product

Resources

About