CBS411 Endsem Rapid Revision — Mobile Forensics & Security

1. QuickBudget / DIVA App Vulnerabilities (2-4-3-3 Matrix)

20 Marks

Insecure Logging (Slide 10–14): Leaks info via android.util.Log (Log.e, Log.v). View via PC: adb shell ps -A | grep diva → adb logcat | grep <PID>.

I. Hardcoding Issues (2 Sub-types)

1. Java Source / strings.xml: Hardcoded strings/keys in APK.
Exploit: jadx-gui app.apk → check classes & res/values/strings.xml.
2. Native Library via JNI: C/C++ library libdivajni.so in /data/data/<pkg>/lib/.
Exploit: strings libdivajni.so | less.
Fix: Fetch dynamic tokens from server; store in Android Keystore (TEE).

II. Insecure Storage (4 Sub-types)

1. Shared Preferences: XML in /data/data/<pkg>/shared_prefs/*.xml.
Exploit: cat /data/data/<pkg>/shared_prefs/*.xml
2. SQLite DB: /data/data/<pkg>/databases/*.db.
Exploit: sqlite3 ids2 → SELECT * FROM myuser;
3. Temp Files: /data/data/<pkg>/ or cache/.
4. External Storage (SD Card): /mnt/sdcard/.uinfo.txt (readable without root!).
Fix: MODE_PRIVATE + SQLCipher + Android Keystore (TEE).

III. Input Validation (3 Sub-types)

1. SQL Injection: Raw string concat in DB queries.
Payload: ' OR '1'='1 → dumps entire table. Fix: PreparedStatement.
2. WebView Abuse: Loading unvalidated URL.
Payload: file:///mnt/sdcard/Download/test.txt reads local files. Fix: setAllowFileAccess(false).
3. DoS / Buffer Overflow: Native buffer overflow → SIGSEGV crash. Check: adb logcat.

IV. Access Control (3 Sub-types)

1. Exported Activity: Bypass login via intent:
adb shell am start -a com.app.action.VIEW_CREDS
2. Parameter Spoofing (Intent Extra): Bypass PIN prompt:
adb shell am start -a com.app.action.VIEW_CREDS2 --ez "check_pin" false
3. Leaking Content Provider: Unprotected URI:
adb shell content query --uri content://com.app.provider.notes/notes
Fix: android:exported="false" or signature permissions.

2. Android Architecture & Camera Filter Trace

12 Marks

Layer (Top → Down)	Key Components	Role in Camera Filter / Crash
1. Apps	System + 3rd-party APK	UI where user clicks capture/filter.
2. Java Framework	Activity, Location, Resource, Notification Managers	Manages lifecycle, exposes `Camera2` API.
3. Native Libs & ART	`OpenGL ES`, `Media Framework`, `libc`, ART/DVM	Applies graphic filter via JNI. ART executes bytecode.
4. HAL	Camera HAL modules	Standard C/C++ vendor hardware interfaces.
5. Linux Kernel	Camera Driver, Display Driver, Binder IPC	Sends direct commands to CMOS sensor & screen.

DVM vs. ART

DVM (Pre-5.0): JIT compilation (at runtime). dx tool compiles to single .dex (cached as .odex).
ART (5.0+): AOT compilation via dex2oat at install time into native ELF/OAT. Lower CPU/battery drain.

Camera Filter Crash (3m + 1m)

2 Broken Layers: Native Libs (missing .so / OpenGL ABI broken) and HAL (mismatched buffer format).
Forensic Check: adb logcat: check for UnsatisfiedLinkError/SIGSEGV vs CameraHal error.

3. App Components (Train Alarm & Campus Connect)

12 Marks

Component	Core Definition	Train Alarm (5km Geofence)	Campus Connect
Activity	Single UI screen	Set/Cancel alarm UI	EventList / Detail Activity
Service	Background task without UI	GPS Service checking distance < 5km	Syncing events in background
Broadcast Receiver	Event-driven listener	Fires alarm ringtone when 5km hit	Event registration alert
Content Provider	Data manager (URI → Cursor)	Stores saved coordinates in DB	Shares events across modules
Manifest.xml	Root config declaring all parts	Declares Service, GPS permissions	Declares Activities, permissions
Resources	Static assets (layout, drawable, strings)	Layout XML, ringtone audio file	Banner drawables, string values
Intents	Explicit (internal) vs Implicit (external)	Implicit opens Maps (`geo:` URI)	Implicit shares event via WhatsApp
Dangerous Perms	User prompt required at runtime (6.0+)	`ACCESS_FINE_LOCATION`	`POST_NOTIFICATIONS`, `CAMERA`

4. Activity Lifecycle (FitTrack & Campus Connect)

7 Marks

[Launch] → onCreate() → onStart() → onResume() → [ACTIVE]
                       ↑             ↑               ↓ (Phone call / loses focus)
                 onRestart()         └─────────── onPause()
                       ↑                             ↓ (Fully hidden)
                       └──── (User returns) ───── onStop()
                                                     ↓ (Back pressed / killed)
                                                  onDestroy()

FitTrack GPS Loss Fix

Cause: Phone call triggers onPause() → onStop(). App tied GPS solely to UI, losing tracking state.
Fix: Save state in onPause()/onStop() via Bundle/SharedPreferences + delegate GPS to a Foreground Service. Restore state in onRestart() → onStart() → onResume().

Campus Connect Sequence

Open: onCreate → onStart → onResume
Event details: Old Activity onPause → onStop; New onCreate → onStart → onResume
Check another app: onPause → onStop
Return: onRestart → onStart → onResume
Back button: Detail onPause → onStop → onDestroy

5. Boot Sequence, TWRP Loop & Rooting

12–15 Marks

Boot ROM: Hardwired chip ROM; verifies Bootloader signature (Secure Boot).
Bootloader (ABOOT): Inits RAM; loads /boot kernel. Check lock: fastboot oem device-info or adb shell getprop ro.boot.flash.locked (1=locked).
Linux Kernel: Mounts rootfs; initializes drivers; spawns /init (PID 1).
init: Reads init.rc, mounts /system, /data, launches daemons & Zygote.
Zygote: Preloads Java classes; forks DVM/ART processes.
System Server: Starts Managers → sends ACTION_BOOT_COMPLETED.

TWRP Boot Loop Cause: Fails at Stage 2 → Stage 3 (Bootloader to Kernel/Recovery handoff) due to dm-verity/Secure Boot rejecting unsigned recovery, corrupted ramdisk, or mismatched kernel.
Temp vs Perm Root: Temp root lives in volatile RAM (lost on reboot, safe for forensics). Perm root modifies /boot or /system and unlocking bootloader wipes /data!

6. ADB Live Acquisition (6m) & Rooted Burglary (5m)

11 Marks

# Live Device Capture
adb devices
adb shell date -u > utc.txt
adb shell getprop > props.txt
adb shell getprop | grep crypto       # ro.crypto.state & ro.crypto.type
adb logcat -d > logcat.txt

# Dumpsys Services (Volatile Data)
adb shell dumpsys activity processes  # Active apps/PIDs
adb shell dumpsys meminfo             # RAM state
adb shell dumpsys connectivity        # Wi-Fi connections
adb shell dumpsys netstats            # Traffic per UID
adb shell dumpsys usagestats          # App usage timestamps
adb shell dumpsys location            # GPS coords
adb shell dumpsys trust               # Unlock logs

# Rooted Phone + Fitbit Alibi (22:15 - 23:00)
adb shell
su
adb pull /data/data/com.fitbit.FitbitMobile/databases/ ./ # Heart rate/steps
adb pull /data/data/com.android.providers.telephony/databases/mmssms.db ./
adb pull /data/data/com.android.providers.contacts/databases/calllog.db ./
dd if=/dev/block/bootdevice/by-name/userdata of=/sdcard/userdata.img
sha256sum /sdcard/userdata.img > hash.sha256

7. iOS Forensics: Pol, UDID, Pairing & Photos

22 Marks

Module	Exact Artifacts, Paths & Rules
Pattern-of-Life: Usage	1. `KnowledgeC.db`: App usage, lock states, backlight (FIFO purged after few months). 2. `Biome` (`/private/var/mobile/Library/Biome`): Screen, app focus, CarPlay, Siri. 3. `PowerLog` (`CurrentPowerlog.PLSQL`): Battery usage per app.
Pattern-of-Life: Movement	4. `Cache.sqlite`: 15–60 min at rest; 1/sec active. Records speed. 5. `cache_encryptedB.db` (7-day retention): Wi-Fi networks seen + Cell towers with range (meters). 6. Significant Locations: Routine places (home/work).
iOS 16 UDID Spoofing (5m)	• Formula (A12+): `0000 + ChipID(4 hex) + "-" + ECID(16 hex)`. • Proof: `ideviceinfo -k UniqueChipID` → gets hardware ECID in decimal. Reconstruct true UDID and compare with MDM / Registry.
Pairing Record on PC (6m)	• Registry: `HKLM\SYSTEM\CurrentControlSet\Enum\USB\VID_05AC&PID_12A8\<UDID>`. • Driver: `C:\Program Files\Common Files\Apple\Mobile Device Support\Drivers`. • Path: `C:\ProgramData\Apple\Lockdown\<UDID>.plist` (2048-bit RSA keys). • Bypass: Copy `.plist` to forensic PC → bypass passcode in AFU. • Fails if: BFU/rebooted, >30 days inactive, USB Restricted Mode (>1hr), Lockdown Mode ON.
iOS Photos (3m)	• Camera Roll: `DCIM/100APPLE/IMG_XXXX.HEIC`. • Edited: `PhotoData/Mutations/.../Adjustments/` renamed to `FullSizeRender.jpg/heic`. • Deleted: Held in Recently Deleted for 30 days. Thumbnails persist.

8. FDE vs FBE & Handling / Hashing

18 Marks

FDE vs. FBE

FDE (Android 6.0): dm-crypt. Entire /data encrypted as one block with master key. BFU boots only to PIN screen (no alarms/calls).
FBE (Android 7+ / 10): Per-file FEK bound to TEE hardware secret. Direct Boot enabled:
• DE (_de): Decrypted before PIN (BFU) → alarms, calls work.
• CE (_ce): Decrypted after PIN (AFU) → user apps/data.
• Chip-off fails: Key never leaves TEE.

Handling & Write Blockers

SIM Removal: Breaks biometric unlock trust chain on GrayKey; changes lock state.
Power OFF: Evicts CE keys to BFU; kills volatile RAM/dumpsys; invalidates pairing record.
Write Blockers: Can't use hardware blockers because mobile USB uses dynamic OS protocols (ADB, AFC). Use post-acquisition SHA-256 hashing to prove image integrity.

9. Partitions & Storage Subfolders

9 Marks

/boot: Kernel + ramdisk.
/system: OS framework, apps, and build.prop.
/recovery: Alternative boot partition (TWRP).
/data/data/<pkg>/: App private storage (databases/, shared_prefs/, files/, cache/).
/data/dalvik-cache/: Compiled odex/oat bytecode.
/cache/lost+found/: Holds recovered corrupted files.
/sdcard: External storage (FAT32/EXT4).

10. Frida, Burp & Apktool / Signing

Lab Slides 9 & 11

Apktool & Signing

apktool d app.apk
apktool b app_folder -o app_mod.apk
zipalign -v 4 app_mod.apk aligned.apk
keytool -genkey -v -keystore my.keystore -alias mykey -keyalg RSA -keysize 2048
apksigner sign --ks my.keystore aligned.apk
apksigner verify aligned.apk

Frida & Burp SSL Unpinning

Burp: Listen 8080. Emulator proxy → 10.0.2.2:8080. Install ca-cert.crt (DER).
Frida: Push frida-server to /data/local/tmp/ on Google APIs image.

adb shell "/data/local/tmp/frida-server &"
frida -U -l antiroot.js -l ssl-pinning-bypass.js -f com.target.app