Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/348 Thanks!
That said, thank you very much,
Mr. Seeable.
So if you had dunk for the first time.
So good evening.
We are trying to survive with all the
different problems with technology
and make all the demo.
There is only one demo that it will be
not possible to do, but we will put all
the technical details on the website
along with alongside with
the slide.
So I'm Erica Nepal,
where I've worked on
security or insecurity of banking
and where we are going to present
a few results, uh,
about what we have found.
So here is the agenda
of this presentation. So I will first
introduce the background.
In fact, all these studies had been
performed during the project.
I will present this project
and then Paul will explain
the different tool he has developed
to perform strategic analyzes, to
collect different, uh,
uh, APJ, uh,
and to perform dynamic analyzes.
Then we'll switch to the results.
First, I will give some
statistics about the different apps we
have analyzed, and we will
present four cases which
are rather instructive of what we have
found and what you will see that,
uh, especially for the first one, very
surprising things can be found.
And then, uh, I will conclude.
So, uh, in fact, the Duffy
project was a two
year project to develop a sovereign
and trusted eighty four
Android platform, Linux platform and
Windows,
not for Apple because the French
government was not interested in Apple
to too much Big Brother.
And, uh, it has been
funded partly by the French government.
In fact, the prime minister office, in
the context of the, uh,
detailed plan for sovereignty
that was a grand total, was
about six billion euro.
And the state is a government
that's funded only 35 percent.
So as a research lab,
we have we have produced the proof
of concept and then we have delivered
as a product and as well as intellectual
property to a society who is in charge
of the, uh, marketing.
And the name is no longer defeat
because the fee was a project and is
all Marville and for the mobile
platform and ultimately were
for Linux and
Windows.
Normally it was in the
in the the
timetable. Uh, normally free and open
versions should be released,
at least for noncommercial use.
I hope they will.
They will do it.
But at the lab we have decided
to do work on the folk
version and for Linux at
least. And normally by mid-March,
uh, we should release everything,
including the source code and the
name will be opened a few links.
But if you want more information, please
refer to the official Web page
of, uh, of the project.
So if we focus on
the, uh, platform,
in fact, we have deliver
the product when you're ahead of the
schedule.
And, uh, so in October 2013,
it was based on cyanogen and USPI
sources. In fact, from the beginning it
was clear that
implementing another
application will be a failure because
if you go deeper into the system, you can
get rid of the application.
So, in fact, we decided to build
a complete, uh, anti malware
operating system.
So we rewrite the
Android system based on these
two sources.
And we have added some additional
security features like file
TotalFina system encryption, Esme's
encryption view, IP encryption,
and especially
an application market accepting
only secure and analyzed,
certified and digitally signed,
um, applications.
Well, that's why we decided to analyze
a lot of application, including, um,
banking, navigation.
So all those apps are
analyzed, static analyzes,
dynamic analyzes.
And Paul will present the different,
uh, techniques.
And of course, we are going until the
production of a source code
by reversing step.
And we have defined, of course,
as security policy, a trust
policy I'm going to present right after.
And if it is not a malware
is the application does not contain any
malicious feature and is compliant
to the security policy, then the
application is certified and is
digitally signed and put on the market.
And for, uh, the different, uh,
feature, please refer to the official
website of Innovative Company.
So the trust policy, in
fact, if you just consider
that whether the is a malware
or not is not sufficient because
between malware and very safe
application, you can have a lot of
things, non
desirable property, and especially
regarding data confidentiality
and users privacy,
which is a big problem.
So, in fact, the malware, what
is malicious, must be
extended to something a little bit
broader than simple malware functions.
And in fact, we have we have
defined a trust policy
and application. It tries to see if,
of course, it is not a malware,
which is a minimum, but it does not
contain EDAN functionalities.
No information is collected unless it
is strictly necessary for the
application.
And every communication
between the application and a remote
server must be encrypted.
And of course, there is no known
vulnerabilities.
So why
did we focus on banking
applications, but in fact,
banks are forcing us to use
more and more, uh, the
tablets and smartphones in order to
connect to a bank account
and more and more conventional banks
will disappear.
So.
It is Almani, money, banking abscission,
give direct access to our money
and all the data about which we have
purchased and so on.
So, of course it is a critical issue.
And for you as a user, I don't want that
my bond as too
much to me, any information about
what I am doing and of course, any
external attacker.
So and the
other aspect, since banks have much
money, normally are supposed
to do a clean job, perfect
job, and they should
normally release only very secure
and safe aggregation.
So we have contacted
all the banks in order to
allow them about the problem we have
found and everything, that
we're free.
Uh, but, uh,
up to now, only a very
few of bonks are answered and ask
for more details.
Only two in France have
asked for the technical details
and are currently correcting
the part regarding civil liberties.
I'm not sure that we will do it for users
privacy, but it is a problem.
We will check everything.
So,
so
but, uh, so
I, uh, I
make, uh, three tools,
one, uh, for
antivirus and static analysis called,
uh,
uh, second one for
Wakering of uh, uh,
Web application to find
malware and, uh, someone,
uh, for dynamic, uh,
analysis, in fact, network communication,
uh, monitoring.
And, uh, I started
with, uh, one thousand
eight hundred, uh, uh,
application bossom malware and
genuine uh
and this tool are not
uh are not present, uh,
are not open source all the time.
So the goal of
that is to detect
malware based on similarity with
known malware, uh, the
main hypothesis is, um,
that there is no
common, not
necessarily common characteristic that
defines, uh, that
characterizes all malware.
Uh, it's why the traditional way
of detecting malware is to,
uh, splitting them into
families of malware.
Uh, it's, uh, these families
that share common characteristics.
So if we could,
uh, do some sort of statistics
on, uh, these families
and we compare them to,
uh, the statistics, uh,
from an application, we
could, uh, we will
these, uh, common characteristics,
um,
uh, uh,
weigh.
Uh, aged can also produced,
uh, static analysis
where I report for,
uh, manual analyzes,
I will show you it.
So there was
there was, uh, um, demonstration
between, uh, uh,
that, uh, because of the bugs
of at the beginning, I could
not show you it.
So it, uh, it will be on the website.
Yeah. So you will find out all the
misinformation when, uh,
I scan an application with
it.
Uh, basically we've asked it to
an equivalent US uh, source code
and uh, um,
uh, it extracts a lot of
characteristics like, uh, permission
file digest uh, class and mittens
name entry points, uh, method,
um uh, known
behavior for uh uh Froneman
um malware, something
like that. And uh, all this
information I used to
um make uh similarities
cause uh um
uh to compare enough
with uh malware family.
OK, this is uh is a demonstration
I could not show you, but I will
I explain. You are quickly.
So, uh.
This report, uh,
summarized some of this extra
data from
this report, from some of these,
uh, extracted data
to help a manual
analysis.
So we we get, uh, basic,
uh, um,
basic data like, uh, permission.
But, uh, more important, one
like, uh, risky
behaviors.
We can see there is not translated
because it's, uh, for internal use.
So it's in fresh French.
Sorry. And the table
of uh, uh, risky
andred API call.
So, uh, these
risky calls are seen
two times more in malware than in, uh,
genuine application.
It's why, uh, it's, uh,
nice to to see where they
are using the code.
So when
I click on, uh,
for example, uh, location service,
which is a known behavior
detected, uh, I can see
where, um, well,
on the code it is, um, used.
And when I click on, uh, one
of these functions, I can
see the revulsed code.
So it's, uh, a sort of
guide, uh, for manual and I
think a starting point, um,
sorry for format windows,
uh, because
normally it was, uh,
without doing a line between those
windows in place.
But, uh, I can, uh,
just can print text currently
because we have a direct link between the
report and the source code.
And it is possible then to check
whether it is a genuine, uh,
call non-dangerous code and
all the malware code.
So we have the constant link
between the report and the source code.
OK, let's, uh,
let's carry on.
So, uh.
Yeah, it's a messy
so sorry for this, so,
uh, let's, uh, go
on. Yeah, yeah.
No, no.
Um,
is it the, um, antivirus,
uh, work pretty well,
uh, but
not as I expected.
And the reason was, uh,
the database of, uh, malware
application was too small
for, um, for
being serious in the
antivirus game.
Uh, so I designed a
massive Web crawler
called Tarantula to, um,
to download, um,
uh, lots of application and,
uh, hoping they were
malware.
So in reality, this subject
is of gathering samples
in the antivirus game is the heart
of the matter.
Um, it's a subject
which is rarely explained
or detailed in, uh, research
paper.
Um, and
it's basically, uh,
uh, that algorithm,
uh, need, uh,
uh, strong statistics.
So, uh, a big database.
So how can
we gather lots of samples?
Several university Qasm,
Preedy, like North Carolina
State
University with the Genome
Project and the University
of Gettinger here in Germany, which
drove in the desert, also
some websites share on malware
like virus share and control them.
Maybe you have heard of it.
It's a good starting point, but not
not enough.
So, um,
I, uh, I researched
on how some malware
combined antivirus companies
get their sample.
So my guess is that they,
um, they,
they get a sample from, um,
client end users mission and,
uh, intercompany
exchange mainly.
Um, he Oisin,
uh, under this report, when we can see
that 70 percent of them
are they are they are they
they got um,
uh, it's from intercompany
exchange and, uh,
um, a known sample,
something labeled as announceable,
which is in fact user and client
submission.
So it's mean, uh, you cannot
mimic, uh, in a laboratory.
So I, I, um,
design, uh, a color
called Tancharoen Uh,
which should get, uh, sample from,
uh, wild ftp terance
uh and uh, alternative market
mainly.
Uh, I stopped scrolling at
uh uh to uh
two hundred and eighty uh
uh thousand
applications and
um.
Yeah, it's uh it's a shame
for, uh,
your internal, uh, structure of Tanesha.
Um.
And, um.
Professor.
And the discovery, um,
uh, with, uh,
the application I've got is,
uh, a work in progress,
but I hope I will find lots of
malware, um,
I'm going to put on to is, uh, dynamic.
And I like this one.
I called it of this and it basically,
uh, monitor almost
all communications, uh, between
an app in Internet
event, the encrypted one.
So at the end of the analysis,
it generates, uh, a graph
of network communication to
out, um,
to to help, um,
um, detecting some
behavior in this mess of
information.
You will, uh, you will see
the, uh, the graph, uh, when
I will present the, uh,
the banking application.
So I just thought you bypass,
as I said, uh,
as I control the phone, I put
a certification fake
certification authority's in
the phone and, um,
my phone connect to a fake access point.
And, uh, basically
the SSL request are
intercepted and, uh,
um, and,
uh, the request, uh,
um.
The decision to address requests
was sent back
to the phone signed by
our fake certificate, so the
phone actually believes that it is a
legit communication.
So at the present time, you have
analyzed, um, in detail,
27 application, of course, will
go on and, uh,
increasing the results and everything
will be made public little by little.
So as you can see, we have,
uh, at the beginning, um, analyzed
a French bank.
And but we we try to cover all
the world. And the next step will be to
analyze, uh, banks from Asia,
uh, because there are a lot of
development in the banking application.
So, uh, before presenting
the for the for the strategic
certificates we have identified, in fact,
I would like to present some statistics
which we are summarizing
what we have found.
First, if we have a look to
permission, uh, we see
that, uh, those applications
generally are very invasive
and they are a lot of
they get a lot of, uh, access to
many, many internal data in your
smartphone or tablet, which is very,
uh, worrying because they
can eavesdrop many, many information.
But it is probably more interesting
if you, uh, consider
the various, uh,
you are as a member of Europe that are,
uh, uh, involved
in the in the
in the application, uh, between
the smartphone and the
server. And two of them are
rather interesting.
First, uh, er, it is possible
to identify specifically,
um, a phone,
but if you consider er
this for something which is rather I
96 percent uh are
rodding uh dynamically the content
of the, of the up from the web.
It means that.
This content can be Ligget content,
but it can be on purpose
and very, very specifically
malicious content. It depends whether you
trust your bank on it.
Uh, and
er, the second is a second,
the second, uh, behavior, which is, uh,
rather interesting, is this
many funds are by
now vulnerable to the discussion,
arbitrary JavaScript,
um, uh, instructions.
So it means that it is possible
by providing this and
exploiting the fact that many funds are
still able to um
still variable.
But now for the newer version,
there's a number of, uh, JavaScript
that can be, uh, executed is limited.
But for an older version, it is not.
And it's possible to remotely
execute possible JavaScript,
JavaScript, of course,
either if you are on the banks or
if you are, uh, an attacker.
For example, in Manzie attack, we will
see when bank is vulnerable to this
to this kind of attack.
So
let's get started with a demonstration
report.
OK, I
will start by JP
Morgan Access, which is a mobile
banking app of JP Morgan.
And here's the
graph of network communication I've told
you about just before.
Uh, so the,
um, and it's an interesting,
uh, Jizan file received from
a JPMorgan servers.
I can see there, so the,
um, the photograph shows
all the, uh,
and, uh, Samarai overcommunication
for, uh, a address,
OK, and.
We can also see all swing
that, uh, the application,
uh, send to
Washington to, um,
to enlist.
So, uh, it's it's for
finding, uh, some,
um, that are personal.
Detrich So.
Here we can see just two
strange, and it's,
uh, in the
argument of get method
or in a post request.
So here
is the application received, uh,
Ajilon file their.
So here we can see a signature
either at the beginning, I,
uh, I thought it was a
bit long for signature,
uh, for authentication,
for example.
So maybe, uh,
it is, um, an
encrypted string, uh.
I just after that,
I, uh, um, used
a tool called API Monitor
to see if, uh,
after receiving the string zap
and decrypt something.
So what
is wrong with it?
So, uh, API
monitor, uh, basically
reverse the app and monitor function
around Ondrej code that
we configure and at
one time, uh, dump the
content of the arguments into
the la carte, which is the centralized
Android, uh, log system.
So we can see argument
of function.
We configure, uh, dynamically.
So could you film
it first?
Asked
us if
it's not very visible, but, uh,
so far this, uh,
here trust me, um, it's,
uh, it's, uh, received a strange
signature. Uh, it's a little
messy, but it's, uh,
the string, uh, I just,
uh, show you before and,
uh, this is
this is, uh, uh,
a decryption function, um,
uh, user.
And this, uh, ASCII
codes are, in fact, the
argument of, uh, the,
uh, decipher function.
And, uh, here's the result
at one time.
So what I did is I, uh,
I, um, uh,
I could buy copy,
uh, the return value and I use
some just some scripting
commands to get, uh, readable,
uh, string.
So here we go.
The readable string.
So it's
a civil strain separated
by a pattern and
the content of the string are not very
important because
it's the pattern, uh,
with this pattern, we can search in the
code in the rest of it, whether
we have a code, uh,
where this, uh, string
are used and what
it, uh, what does the application do?
So it's what I did.
I cannot show you the code because
it's proprietary.
So, uh, it's just a subset,
um, just just to show
you what to do.
So the string is
repressive past with
this pattern.
And, um, a part of the string
is sent directly into a
command.
Uh, I reversed this,
uh, this function run command.
Uh, it's not, uh,
basic, uh, Andre, the, uh,
function, uh, and
if the phone is, uh, of
privilege, uh, this command
execute, uh, the argument as
would privilege.
So basically what it's mean, it's
it's a remote challenge.
Why why is it is this why they
at one time when you
longit, uh, um,
send, uh, commands
from, uh, the website and
they execute it on your phone.
It's a part of a framework that
verify the, um, the security
of the phone.
Um,
and a lot of this verification is done
by sending commands
to verify the phone have been infected
or also on
that they could have done it differently.
For example, Lodine, uh, verification,
uh, procedure from
encrypted assets,
for example.
That this way of
a very free
let's let the harbor, because they
can send arbitrary commands
targeted because, uh,
uh, the
connection and the applications
and the I m e
e i which you not identify
one particular device.
So if they want,
they can send, uh, arbitrary command
at, uh, targeted device.
So basically we
have to consider it as a backdoor.
The next application is BNP Paribas.
It's a French application.
Uh.
So let's see, uh,
the network communication.
So a.
Um,
we received an interesting JavaScript,
uh, code.
It's there in context, you can see it
in text and.
Let's get
this straight so
you can see, because there's nothing
to see
here.
So this not seems to be
a regular JavaScript function.
So maybe this is a JavaScript
interface and
JavaScript interface in Android are.
But, uh,
it's, uh, uh,
it's, um, it's a grant.
The robot keeps the right to call defined
function of, uh, Java
application.
But in older version
version of Android,
there was a flaw.
And, um,
the JavaScript cooled, um,
called arbitrary command,
uh, by reflection.
So the rabbi could
get a shall, for example.
And there are lots of,
uh, vulnerable phone in use
today.
So when you when they do it
in clear text.
It any
right in the middle Ataka.
Can control the phone.
Basically, so
it is a major vulnerability,
so BNP has taken this
information, is currently trying to to
to correct there no.
So it is summarizer.
The next one is, uh, a
Russian sperm bank,
and it's an interesting,
uh, it's
an interesting example, not because
it is renewable, it's not
vulnerable.
It's sent it's like some informations,
but you will see why
it is very interesting.
So.
Here.
So we choose an API called
Yandex Maps API
and.
Let's see what it sounds,
wi fi networks, and
this is a Mac address I of
my access point used
for doing, uh,
um, network moonshining
so it could dump
all surrounding.
It's not the WiFi networks,
so it's only WiFi networks.
So why why did you
want to do it?
Uh, it's, uh, I done
some research and it is uh
in fact.
It is used for finding the location,
uh, and every
every other operator
did this way, um,
Google Maps, uh, do it this way, too,
and.
It sends also the idea
of, uh, all Wi-Fi
networks and
when we consider
the responses of
these calls, so
let's try one now.
This is not one.
It's a random try.
So maybe not
the first.
OK, yeah,
so it sends Wi-Fi networks
and the response is.
Fund by WiFi, so they
know Miyoshi and they get
my location with my wife.
Uh, it means that
they have my wi fi, my
address in the database.
But how do they have
all this information, in fact,
when you, um,
for example, Google Maps, uh,
all the time, they send,
uh, also sending Wi-Fi
networks, which you last
known, GSM location,
because GSM, GSM
cannot locate you.
Precisely. Indore
So the map, uh, your fi
networks with the last
last, uh, final GSM
location is this way.
They populate the database.
And so
they can, um, locate
other users,
so basically they have a database of
world Wi-Fi networks.
Wonderful.
And it's not, uh, it's
it's not, uh, especially Yandex,
it's Google Maps and all the,
uh, companies that do, uh,
that does, um, Wi-Fi,
um, location.
And it's not, uh,
it's not the end because
the reimplement,
the Google Map API,
they do not use it.
Yandex, um,
you your option for
disabling the, um,
the location of
just no effect on, uh,
this application on spamming so
we can disable your location each
track your location.
So the last one is,
uh, Bradesco, um, a
Brazilian bank
in this, uh, application.
Uh, is, um,
some exchange I sent with,
uh, this oast, uh, Web
service are full of money
that come that year
and
anesthetizing station there.
We receive a private key.
In context, yeah,
so, uh, what,
uh, why
is this private key, I just
done some
quick research.
So basically, uh,
uh, you take
this address
could be,
I know, no Internet connection so I
can see you that I will continue.
This private key is for accessing the
Web service of the bank
where.
And this is not over
is the application and, uh,
Chickory JavaScript, uh,
file is here, the library,
uh, but it is
very, very detailed from,
uh, 2010.
So, uh, there are
several Savona vulnerabilities
that have been discovered.
And, uh, they are in the,
uh, CVT database.
Um,
I, I did not
find a way to exploit this winnability,
Ismat, or but although
surely we can do it is
just what I say.
I think you
know why
this is the end of the presentation.
I will be pleased to answer
your question
so and I will let Eric
show concrete.
So in fact,
it is only a small sample because twenty
twenty seven is a small part
of what we intend to
to cover. But in the forthcoming
weeks, many details, details
will be published. In fact, we just we
are waiting either for the end
of the bunk or
for the correction of the program.
And of course, uh,
if the banks do not answer so
we will have to publish at least in order
to make them aware of the problem.
So we intend, of course,
to analyze other
kind of apps because some games
are maybe the games
is less less important.
That banking, of course, but it can leaks
a lot of data.
And we intend to to
see whether the new for the new version
of Angry Birds and so on still
contains many undesirable
functionalities, uh, impaction,
security tools, because we have
some concern about apps who
are supposed to protect often, but in
fact, they are leaking information and,
uh, making or
smartphones, tablets are weaker.
So,
in fact, all those tools are
still under development.
And we intend to, uh, to put more
mathematics in order for people to use
some advanced techniques in
data mining in order to have a better
view and understanding of the different,
um, uh, relationship
between, uh, API call or functional
internal functionalities.
Of course, for every time
a bank will correct a security
issue, we will look after world
if they correct the security
and the users privacy as well,
because in fact, just switching from HGP
to GPS, if you don't correct a very
narrow, it is not a solution.
So it will be very careful about the
respect of the privacy aspect
in working apps.
So it is only
a small uh, we are
very sorry not to be
able to show all the technical details,
but everything will be very public as
soon as possible.
In fact, it is clear that the banking
application market is not a very
mature market.
And, um,
of course, we have found some
vulnerabilities. But as main a
figure, as main, uh, aspect.
In fact, a user's privacy is not
respected.
So banks are collecting a
lot of information that they should not
collect. And we are not strictly
related to the bank account
management.
So I think that every
everyone should
put a big pressure on developers and
of course, maybe, just
maybe a dream. But I think that as as
users and consumer, we should have,
uh, we should ask
for more security and
especially for, uh, regarding
privacy and the technology.
Uh, the main problem was to find,
identify, contact banks
issue.
And even
for French bank, we are French.
It was very, very difficult.
And even going through the year, as
is said, computer emergency
response team in the banks, they are not
communicating between themselves.
So it is very difficult.
So what is interesting,
all those apps are
as well on the Google, uh, play
it mean that Google does not does
not perform any security verification.
So don't trust application because they
are on the Google Play.
There is no verification.
I think, however, that Google has a power
maybe to enforce some trust policy
and to ask for more security.
Well.
So what's the solution once
again, if they are available,
choose open source apps, but in world
is difficult because is a closed
world and uh,
as a main observation,
it is maybe better to you
to prefer local or national
banks or instead of international
banks because they they try to collect a
lot of data.
So sorry for the
problem of the move, but everything once
again will be made available as soon as
possible. And thank you for your
attention.
Thank you very, very much for the
insight into this huge ongoing
effort before
taking questions, some
practical advice.
If there are questions, please line up.
But within the hour after the
microphones, some practical
advice. You find all the slides
and all the links to the websites
on the Congress Web page.
If you go to the schedule, the far plant,
click on the lecture,
click on the lecture site, you find
all the links and even a PDF of all
the slides and the links.
And it's a very well worth, a close
look and a visit.
Now, I think we wait half
a minute until those who want to
leave have left the room.
For those of you who want to ask
questions, please line
up on the
microphones to
sit at home.
You have some
sort of equilibrium based on what the
president of Georgia, Jimmy
Fictionist. No, it was more of a
procedure.
You mean
something called Windows
in Mexico?
I mean, the problem is
we do
know that you're all
right.
OK.
OK, ask your question.
Yeah, I let this one slide
regarding which please use the
microphone.
Yes, that's one slide which
apps use which permissions statistics
page.
And the second point was, I
think that
the ability to use plain text
communication is clear text
communications.
What does it mean exactly?
That they could use HTP,
but I can't figure to use.
So what does it mean?
Um, if a well understood
why they use GDP instead of actually GPS
know now what do they use
it for sending banking
information.
No, no, no.
When uh we uh I,
I never seen an application banking
application, uh,
connecting, uh, to the,
uh, bank account in
HGP. It's, uh,
the other functionality
like user tracking, which is a
functionality. Yeah.
And, uh,
um, since, uh, we, we
have seen like, uh,
the private k uh, we see
this product is not used for,
uh, connecting to your account
is used for other service
services.
So, uh,
your money is
pretty safe if, uh,
if they not choose some backdoor
like in the JPMorgan
case.
OK, but do their checks,
uh, the certificates of,
uh, of the server and
there were some lectures last year and
the year before on how they
all do it wrong and not check the
certificates and necessary connections
and stuff.
Mm hmm.
Uh.
Uh, so your question
is it is any other, uh,
trustbusting or, uh,
O'Shea's or something like that or
not doing a good.
Yeah, I, I've
seen one up, one application,
but it's not an official backing
up. It's a knapsack.
Uh, um,
aggregate.
Uh, I don't know, it's in English,
but, uh, in fact it used
um which aggregates
a lot of banking account
when you have, um, multiple accounts
and this up uh
uh thing.
Um, uh was sending
the uh the
the password with
uh uh, SSL
communication that trust almost so
that there was not no
security at all, but is,
uh, the only one case
where I've seen, uh,
misconfiguration in SSL.
OK, yeah.
So it's not as bad as it sounded
on the slide.
Yeah. But in fact the
apps were aggregating several uh,
banking applications will be probably a
problem in the future because at
the present time we're mainly banking
apps alone.
But those, uh, aggregation,
uh, application, uh, will
have to be monitored because they are
only a very few.
But the problem will be maybe at that
level.
Yeah, this is a whole different
problem, right, if you if you
trust your bank to deliver a secure
application, it's one thing if you trust
somebody else to do
to the implementation of
our banking APIs, it's
gonna be a tough thing.
OK, thank you.
OK, next question
after we now, quite a few
of the good examples for
horrible practices, which
was the best app you found.
And to directly add on that question,
how the two German bank apps
compare
the best.
I don't know if they are the best
application, but, uh, more generally,
uh, I found that,
for example, uh, some,
uh, and national banking,
France was would, uh,
like Societe Generale
and some up from, um,
uh, India was good.
But they are not known at
the, uh, international level.
Uh uh, the.
Commerzbank in Germany was
pretty good and,
uh, um,
uh, Dutch bank was
also quite good.
So, uh, Zsa Zsa
Zsa Zsa Zsa
Zsa was not all horrible,
if it can, uh, uh,
reassure you.
Yes.
Thank you. There is one problem.
There is two different point.
You have the American security issue,
but from a more general point of view,
you have user's privacy, uh,
respect. And in this case, uh,
Bankside may be less, uh,
respectful of all data.
Um, maybe you are not
you don't know the concept, the concept
of user tracking in, uh,
websites of, uh,
if you like, you know, so each
time you click on something that you do
request to send onto a server
and say, uh, this
user clicked on this
and eat it,
it stayed, uh
uh, it's it's time
on these windows.
So it's like, uh,
all you do is known and
is, uh, uh, stored
and, uh, is Z'Ha'Dum
statistic and some behaviors,
uh uh, you
know, some behaviors of, uh,
uh, consumption.
It's pretty
creepy to me, but
thank you. Next question here.
Well, uh, thanks a lot.
First of all, thanks a lot for your work
and for presenting it, because it is
really interesting.
I would like to ask, uh, this
question. Uh, your program,
uh,
does some reverse engineering
of the KODE and you are able to browse
the reverse engineered code.
But how does it behave when the Cojocaru
skated, for example, with programed
DexCom or if the code is developed
using A.K.
or something like that, the reverse
never fail.
OK, but the code can be obfuscated.
But when you are, uh,
trying to understand, uh, Riverside
Code, you do not need
to understand all
it all it happen,
OK.
The main important thing in Android
application are Android API
call, which is the
function that the
phone provide to access,
uh, valuable information.
OK, so if
I can see this function,
I basically can see what
the application can do, even
if there are some different code
here and there.
It's not important.
And I never I
never seen an application of
that Officemates API
calls, but it isn't
typically possible, but I never
seen it.
More of a
static analyzes.
We all know of
limitations on obfuscation
and where nobody can
beat all of it.
OK, so it's why
we use also dynamic
analyzes.
In fact, when obfuscated
obfuscation is used for obfuscation,
it means that with the tool it is
possible to bypass the obfuscation.
But if some
some some day we will find
very deeply obfuscated,
uh, application, we will do by
end manually.
So but most of the time
the automatic reversing is still
insufficient in order to bypass very
poor obfuscation that we
excuse.
What the what do you mean with bypass?
Because when you obfuscate, you lose some
information, at least understand
the function in some functionalities.
OK, ok, ok, ok.
But it's at the present time we didn't
ever found very sophisticated application
sophisticatedly, you know,
didn't care about protecting the apps.
Mm hmm.
OK, thanks a lot.
Well, that's another question on the
other microphone.
OK, in the beginning of the talk, you
said you used men in the middle
to be able to analyze the SSL
communication.
But this to me means that the
applications should have understood
they are not talking to the bank and
should have just stopped communication at
all.
It's a very interesting question
because BNP
Paribas, which is venerability,
beat my, uh,
SSL man in the middle.
The vulnerability I've discovered is
because of user tracking
framework.
But, uh, I could not connect
to the server because
they refuse my connection wi because
I think I am not
sure that, uh uh
but uh, one hundred
percent that I think
they and they are honest are set
of certification authorities
and they do not use the systemized.
So it basically
bypasses for uh beat my uh
my system.
OK, but this happened only with BNP
Paribas.
Uh, can we please.
I just happened only with one bank.
All the others blocked it up and, uh,
with maybe five
of the twenty seven banks.
But, uh, it's um
the banks are, uh, more,
more careful, a little more careful
on security. So some of the bank
implements that trick, but
not all apps
at all.
Thank you.
More questions, if not again,
you find the slides and the links on
the Congress website and, uh,
keep an eye on it.
Thank you very much, gentlemen, for that.
Thank you.