From a81cbd011dda29d9e226836745bd79f2d27dc435 Mon Sep 17 00:00:00 2001 From: dschuermann Date: Fri, 10 Oct 2014 03:45:45 -0700 Subject: [PATCH] Updated App Security (markdown) --- App-Security.md | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/App-Security.md b/App-Security.md index c3302c2..67e0da6 100644 --- a/App-Security.md +++ b/App-Security.md @@ -33,12 +33,12 @@ TODO, also: https://github.com/open-keychain/open-keychain/issues/894 1. Start OpenKeychain 2. Sign something, caching the passphrase 3. - ``` - someuser@somehost platform-tools> ./adb shell - $ su - # chmod 777 /data/misc - # ps - USER PID PPID VSIZE RSS WCHAN PC NAME +``` +someuser@somehost platform-tools> ./adb shell +$ su +# chmod 777 /data/misc +# ps +USER PID PPID VSIZE RSS WCHAN PC NAME [...snip...] app_110 17973 2381 217088 24612 ffffffff afd0ee48 S org.thialfihar.android.apg shell 18061 2390 648 336 c031b39c afd0eafc S /system/bin/sh @@ -51,18 +51,19 @@ bluetoothd bluetooth keystore vpn - systemkeys - radio - wifi - dhcp - heap-dump-tm1313820900-pid16096.hprof - heap-dump-tm1313854763-pid17973.hprof - # cp /data/misc/heap-dump-tm1313854763-pid17973.hprof /sdcard/ - # $ someuser@somehost platform-tools> ./adb pull /sdcard/heap-dump-tm1313854763-pid17973.hprof . - 2666 KB/s (4361160 bytes in 1.597s) - someuser@somehost platform-tools> ../tools/hprof-conv heap-dump-tm1313854763-pid17973.hprof apg.hprof - someuser@somehost platform-tools> jhat apg.hprof - ``` +systemkeys +radio +wifi +dhcp +heap-dump-tm1313820900-pid16096.hprof +heap-dump-tm1313854763-pid17973.hprof +# cp /data/misc/heap-dump-tm1313854763-pid17973.hprof /sdcard/ +# $ someuser@somehost platform-tools> ./adb pull /sdcard/heap-dump-tm1313854763-pid17973.hprof . +2666 KB/s (4361160 bytes in 1.597s) +someuser@somehost platform-tools> ../tools/hprof-conv heap-dump-tm1313854763-pid17973.hprof apg.hprof +someuser@somehost platform-tools> jhat apg.hprof +``` + 4. Open a browser with ``http://localhost:7000`` and find ``CachedPassphrase`` class, see [PassphraseCacheService.java#L517](https://github.com/open-keychain/open-keychain/blob/development/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/service/PassphraseCacheService.java#L517) ### Attacking passphrase cache with root access