Damn Vulnerable Android Application by Security Compass - Lab 6 Advanced Encryption

Lab 6 Advanced Encryption

 Today we are going to see the solution of basic encryption post in that no encryption was used for sensitive info. The solution is implementing the encryption and that we will try to bypass the encryption implementation as some times the developers store the hardcoded encryption key in the app itself.

For this you need to install the BasicEncryptionSolution.apk.

Now start this app and configure the credentials.

 

Now app is configured and credentials are also stored as per design in preferences.xml but I am expecting some sort of encryption now as we have installed solution for this flaw.

Browse to the

/data/data/com.securitycompass.androidlabs.basicencryptionsolution/shared_prefs

as you can see that all the credentials are encrypted.

So now we go and disassemble the app and try to figure out is there any key hardcoded key in the app.

You can disassemble the app by using EasyApkDisassembler tool as i did

or else you can use apktool for disassembling the apk file by using below commands

apktool d BasicEncryptionSolution.apk export

for more information on apktool click here.

 I am interested in smali files which will be in the disassembled app folder.

I browsed through the smali files and found something relevant to encryption, its CryptoTool.smali file

I opened it in notepad

and found this hardcoded encryption key.

Solution:

Developers should not keep the encryption keys in the app binary, it should be on server side.