Using Frida on Android without root

Frida is a great toolkit by @oleavr, used to build tools for dynamic instrumentation of apps in userspace. It is often used, like Substrate, Xposed and similar frameworks, during security reviews of mobile applications. Typically rooted Android devices are used during such reviews. There are several reasons for this, but the most important is that the frida-server binary, which executes on the device, requires root privileges to attach to (ptrace) the target application, in order to inject the Frida gadget library into the memory space of the process. »

Pinning - not as simple as it sounds

Two weeks ago I presented (once more) on the topic of pinning, this time focusing on bugs seen in real-world Android applications implementing pinning. The presentation also covered CVE-2016-2402 in some detail, Android’s Network Security Configuration and a few other relevant topics. The conference was Android Security Symposium - a great security event, hosted in an awesome venue within Vienna University of Technology. So, here are the slides and here is the video. »

Inside SafetyNet - part 3

This post is part of a series: Inside SafetyNet part 1 (Oct 2015) Inside SafetyNet part 2 (Feb 2016) Inside SafetyNet part 3 (Nov 2016) How to implement Attestation securely using server-side checks (my blog, Cigital blog) SafetyNet Playground (POC server-side implementation) Play Store - Android source - PHP source It’s been more than 8 months since my last blog post on Android’s SafetyNet. In that post I was describing an end-of-2015 version of the system (version code 2495818). »

Migrating from Ghost to Hugo

This weekend I migrated my blog from Ghost to Hugo. Ghost is great, but I couldn’t justify running a DigitalOcean droplet just for hosting a blog, maintaining it and updating Ghost all the time. Static pages work just fine. So, after looking around at several static site generators I decided to use Hugo. Here is what I did to migrate: Created a new hugo site on my local system. Got a JSON backup of my Ghost content using the export tool. »

Hiding root with suhide

Update: This post was written after he release of suhide v0.01 and documents that version. Scroll further down for some notes on the newer suhide v0.12. ChainFire recently released suhide, a new “root hiding” mod for SuperSU. It is claimed to beat SafetyNet - and it does, for now - no configuration necessary. Here is some proof, using our SafetyNet Playground app: So how does it do it? suhide.zip is flashed to the device through Android recovery. »