Cuckoo sandbox is an open-source malware analysis system that can perform the dynamic and static analysis of PC files in real-time. It can gather the following information while running the malicious files in an isolated environment.

• API call information
• Network traffic information
• Memory dumps of target machines
• Newly generated files by the malware
• Deleted, downloaded, or modified files by the malicious code
• Windows screenshots during the malware execution on the target machine

The cuckoo droid is a project of the cuckoo sandbox system that provides similar features for Android malware analysis. It serves as an Android emulator to visualize the malicious behavior of Android applications.

How to Install Cuckoo Droid

In order to build a cuckoo droid malware analysis system, we need to integrate the cuckoo droid with cuckoo sandbox and android SDK (Software Development Kit) tools.

Cuckoo Sandbox and Cuckoo Droid Integration:- The cuckoo droid installation requires the cuckoo sandbox package to be cloned from the following Github repository.

git clone --depth=1 https://github.com/cuckoobox/cuckoo.git cuckoo -b 1.2

After downloading the sandboxed package, clone the cuckoo droid in the cuckoo directory using the following command.

 git remote add droid https://github.com/idanr1986/cuckoo-droid

Update the local cuckoo droid repository using the following GIT PULL request.

git pull --allow-unrelated-histories --no-edit -s recursive -X theirs droid master

The cuckoo droid contains processing and reporting configuration files in the conf-extra folder. Extract these files to the conf directory and delete the original folder using the following commands.

cat conf-extra/processing.conf >> conf/processing.conf
cat conf-extra/reporting.conf >> conf/reporting.conf
rm -r conf-extra

In the next step, generate the cuckoo droid requirements file using the following command.

echo “protobuf” >> requirements.txt

We can install the required modules mentioned in the requirements file using the following command.

pip install –r requirements.txt

Note: Cuckoo droid requires Python2 to operate in Linux operating system.

Android SDK Installation

The cuckoo droid requires the Android emulator, the adb (android debug bridge), and the avd (android virtual device) to operate as an Android malware analysis toolkit. Therefore, the following Android SDK packages must be installed on the host machine to link them with the cuckoo droid.

• Android SDK tools
• Android Platform-tools
• Android SDK platform
• ARM EABI

First off, download the SDK manager using the following path.

wget http //dl.google.com/android/android-sdk_r23.0.2-linux.tgz

Note: We have downloaded Android-23.0.2 for this demonstration.

After downloading the SDK manager, unzip the package using the following command.

tar -zxvf android-sdk_r23.0.2-linux.tgz

Navigate to the Android SDK directory and activate the Android SDK manager.

cd android-sdk-linux
tools/android

The above command loads the Android SDK manager with all the necessary Android tools and scripts.

Select the aforementioned Android SDK tools and initiate the installation process from the dashboard. After installing the packages, expand the Tools section in the SDK manager toolbar as shown below.

Click on Manage AVDs option to open the AVD manager dashboard

The dashboard shows all the available virtual devices created for the experiments. New devices can be created by clicking the create avd button in the side panel of AVD manager. We can set the following options for the dummy Android device.

For demonstration purposes, we have created a virtual Android device with the following configurations.

We can boot the newly created Android device by clicking the start avd option on the screen.

We can set the SDK tools’ path in the profile extension (.profile) to manage the emulator and virtual devices from the terminal. Open the user profile page through following command to setup the path for all important SDK tool packages.

gedit .profile
path=”path to desired SDK tools”$path

We can type the following –avd-list command to validate the path defined in the .profile extension.

emulagtor –list-avds

Cuckoo Droid Configuration

The following conf folder in the cuckoo directory contains all the configuration files to be modified by the user.

The cuckoo.conf and avd.conf are the core configuration files that require some name and path modifications.

cuckoo.conf configuration: Open the cuckoo configuration (cuckoo.conf) file to modify the virtualization software type and result server IP address as shown in the following screenshots.

Default Virtualization Software = virtualbox

Modified Virtualization Software = avd

Default result server IP = 192.168.56.1

Modified result server IP = 127.0.0.1

avd.conf configuration: The avd.conf file requires the emulator, adb (android debug bridge), and avd (android virtual device) path settings. All these packages are available in the SDK manager folder. Open the avd.conf file and update the emulator_path, avd_path, and adb_path accordingly.

Besides the aforementioned configurations, there are some optional settings like enable/disable external sniffer in the auxiliary configuration file. After updating the configurations, navigate to the cuckoo directory and run the main (cuckoo.py) Python file to start analyzing the desired virtual device.

Conclusion

The cuckoo droid can be helpful in analyzing Android applications in real-time. The framework is capable of performing the static and dynamic analysis of suspicious Android apps. A complete security audit with a cuckoo droid can be helpful to determine the risk factor of target mobile applications.

There are millions of mobile applications available for Android and iOS users.  The download statistics of many of these applications are quite remarkable. However, the large number of downloads does not guarantee the safety of any application. For instance, the SHAREit is a famous data-sharing application with over one billion users. Recently, security researchers have found serious bugs in this app that could lead to severe mobile attacks. Finding security flaws and backdoors in mobile applications require knowledge, experience, and dedicated tools. In this article, we shall analyze one such tool called Mobile Application Security Framework (MobSF).

The Mobile Application Security Framework (MobSF) is an automated tool that can be used for mobile penetration testing, malware analysis, and security assessment of Android, iOS, and Windows applications. The tool can perform static and dynamic analysis of a variety of applications including the APK, XAPK, APPX, and IPA files.

How to Install MobSF?

The MobSF is supported by MAC, Linux, and Windows operating systems. The Linux users require the GIT, Python3.8+, and Java Development Kit (JDK8+) to install the framework and its dependencies. These packages can be installed using the following commands.

sudo apt install git
sudo apt install python 3.8
sudo apt install openjdk8-jdk

The following dependencies must be installed before running the MobSF setup files.

sudo apt install python3-dev python3-venv python3-pip build-essential libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg62-turbo-dev zlib1g-dev wkhtmltopdf

Note: The MobSF documentation mentioned the libjpeg8-dev library as a prerequisite. However, the Kali Linux users should replace the libjpeg8-dev with libjpeg62-turbo-dev package if they encounter the following installation error.

After meeting all the dependencies, clone the MobSF source code using the following command.

git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git

Navigate to the tool’s directory and run the following setup file to install the framework.

cd Mobile-Security-Framework-MobSF

./setup.sh

The installation can take quite a while due to the large set of installation files and packages imported during the setup process.

How MobSF Works?

The Linux users can run the MobSF framework using the following command.

./run.sh

The above command opens the MobSF dashboard on the localhost server running at the default 8000 port. The default port can be replaced with the desired port using the following command.

./run.sh 127.0.0.1:desired port here

We can analyze the desired mobile application by uploading the supported (APK, XAPK, APPX, and IPA) files to the MobSF dashboard. To analyze the MobSF working, we have used the vulnerable Androgoat APK file from the following Gihub repository.

https://github.com/satishpatnayak/AndroGoat

The Androgoat’s APK upload to the MobSF dashboard populated the different levels of statistics and graphs on the screen.

The following screenshot gives a top-level overview of the target APK file showing the risk score and development information about the application.

If we scroll down the results, we find different types of analytical information, such as Application signing record, permissions status, network security information, manifest files analysis, code review, NIAP (security policy enforcement) compliance results, and code de-compilation (reverse engineering) options.  Screenshots from each set of aforementioned information gathered by the framework are shown below.

Application Signer Record

The application singing certificate gives detailed information about the supported hashes and encryption followed by the application.

Allowed Permissions Status

The following image suggests that the application is granted dangerous read and write permissions.

Network Security Information

Network security test reveals some dangerous vulnerabilities, such as sending clear text traffic and trusting user certificates without verification.

NIAP Test Results

The following screenshot shows a glimpse of app’s adherence to National Information Assurance Partnership (NIAP) security policy.

Manifest Analysis

The manifest file record also reveals the security flaws found in the target application.

Besides the aforementioned analytical results, we can decompile the target files to get useful information about the backend code of the application. The following screenshot shows the available scan and decompile options.

We can get the information about all the JAVA files through view source option.

The code from each file can be viewed separately for further analysis.

Conclusion

Mobile applications debugging and security analysis is a complex job. The MobSF tool can make the job easy by automatically finding the security flaws, vulnerable codes, and risk factors of target mobile applications.  It also supports integration with other penetration testing tools through REST API keys.

So you’ve heard all those stories about the NSA surveillance, Government-sponsored hacking; well, even the open Wi-Fi networks at restaurants and public libraries are vulnerable. To protect yourself and your browsing data from prying eyes, you’re probably already using a VPN on your laptop. But then you ask, what about my phone? What about when I get that Instagram notification while I’m out and about?

If you’re like me, you’ve already tried configuring a VPN service on your phone. And I say tried because these services tend to provide you with a .ovpn file, you know, for OpenVPN; but then you install it to no avail. Or maybe it works just fine. But, then again, you wouldn’t be reading this if it did.

So, what can you do? Is there an alternative to OpenVPN? Are mobile users left to their own devices, forever to be surveilled whoever is connected to the same open network they are?

Enter HTTP Injector. A universal SSH/Proxy/SSL Tunnel/Shadowsocks client that encrypts your connection data so you can browse the internet privately on your phone, without the hassle of not knowing if that .opvn file will be compatible with your very unique model of Android device. And, guess what? You won’t even need to root your device.

Installing the App

To download the HTTP Injector app on your Android device, simply go to the Play Store and search for  HTTP Injector, the app’s logo should appear as you type.

Once in the app’s Read more section, if we look at the description, we find that it also helps users circumvent certain website restrictions; say, if their local network is behind a firewall. This may pose certain security risks, depending on where you browse, so just take that into consideration and be careful which websites you visit.

Scrolling further down, you will notice it provides instructions an overview on how to configure the app. We will elaborate on the procedure later in this tutorial. However, it’s good to know that it’s available for everyone, in case you need summary of what needs to be done.

Once reviewed, the app can be installed by clicking on Install, just as with any other Android application. Notice it’s not too large, considering it consumes approximately 5 MB of storage.

First-Time Usage

If you launch the app for the first time, you’ll be met with the following notification.

Don’t let the professional part intimidate you. If you follow the steps in this tutorial, you’ll be able to use it safely in no time. So, feel free to check the box next to I understand this app is for professional users only and click OK. You will then be greeted with the main application window.

Before clicking on START for the first time, we need to configure some settings to ensure that network traffic is encrypted via the HTTP Injector app. According to the documentation for the Android app, there are 3 basic methods by which we can use the application.

• Using the built-in SSH client
• Using the IPTables mode and connecting a third-party VPN app to the HTTP Injector proxy address
• Configuring your ISP’s Access Point Name (APN) into the app, and then using the localhost address (127.0.0.1) with port 8989 as the proxy for all connections.

We will be focusing on the first method, with the built-in SSH client, mainly because of how easy it is to configure. A little disclaimer, though. We will be demonstrating the use of a free server which, according to the app, restricts the use of BitTorrent clients to prevent saturation over the network. Therefore, we would advise against torrenting while connected to the SSH tunnel, to help maintain a fast network for all users who choose to use the same server as you.

Configuring HTTP Injector

First, open the sidebar menu by tapping on the menu icon near the top-left corner of the screen.

Here, we’ll first need to use a payload generator, which will help create the configuration file which is required for the encrypted connection to work.

From here, you’ll notice a bunch of options that allow for fine-tuning your connection settings. Choosing the Normal payload should work for most uses. Unless you know what you are doing, and have specific requirements you need to have met, we recommend to leave the default settings and click the Generate Payload button at the bottom of the screen.

You’ll get a pop-up notification, letting you know the Payload has been generated. Notice the Payload field has been populated with the custom template. Notice how the Tunnel Type field denotes that we’ll be using an SSH tunnel to encrypt all traffic.

Next, we need to select a server to which we will connect through the SSH tunnel. That way, all traffic will appear as if coming from that server. We can set it up by, once gain, tapping the sidebar menu icon on the top left of the screen. Here, we need to scroll down and select the Servers option.

You will get a pop-up prompt letting you know that the app will display an ad, in order to provide free services. Click OK and feel free to skip the ad once the option to do so shows up.

You will also get a pop-up warning requesting that you please refrain from torrenting while using the app, in order to prevent the server from being removed, or its password from being changed.

The screen will then display a list of free servers available for use with the HTTP Injector Android app. Notice how on the right side we can check the status of each server, to see whether it’s Busy or if it’s under Normal load.

For this example, we will select the Singapore 01 server that is under normal load, by tapping on it. Upon selecting, we need to enable the Remote Proxy and Secure Shell (SSH) options for it.

It’s okay to leave the remote proxy on port 80, as this would be the default one set for this particular server. Once all settings resemble the above screenshot, feel free to click on the Save button.

Finally, all we need to do is click the START button. Notice the pop-up requesting for your permission to set the VPN connection.

Notice how there is now a key symbol near the clock on the top-right corner of the screen, the HTTP Injector icon near the carrier name, as well as the new notification in the slide-down panel.

Testing the configuration

To wrap things up, let’s perform a quick DNS Leak test to find out whether our connection is encrypted successfully or not. For that, we can use the website dnsleaktest.com to verify this.

Here, we can see that our connection appears as coming from Singapore, just as expected from the server we chose. Feel free to click on the Standard test option at the bottom of the page.

Once the test is done, we can see that our Domain Name Service (DNS) data comes from servers located in the US, as shown in the screenshot below.

For full transparency, here’s a screenshot of my current homescreen, showing my current location, at the moment of writing this tutorial.

Conclusion

In conclusion, you can see how all traffic is indeed encrypted, and appears as if was generated from the server located in Singapore; all thanks to the Secure Shell (SSH) tunnel created with the help of the HTTP Injector Android app.

Remember, though, that this is just one of the methods available for using it. So feel free to experiment with the other options available through the app.