LinkedIn製のAndroidセキュリティチェックTool「QARK」がオープンソースとして、Githubで公開されました。

QARKとは

QARK(=Quick Android Review Kit)はAndroidアプリケーションの脆弱性を検知するセキュリティチェックToolです。ソースコードまたはAPKファイルからチェックが可能です。テスト端末のroot取得は不要で、ユーザーが通常利用する環境下の脆弱性に焦点を当てています。

動作環境

python 2.7.6
JRE 1.6+ (preferably 1.7+)
OSX or Ubuntu Linux (Others may work, but not fully tested)

検知項目

次のような項目を検知します。

export可能なコンンポーネント(Activity,Serviceなど)
不適切なexportコンポーネント保護
アプリ外で取得されそうなIntent
不適切なX.509証明書の検証
外部から書き込み可能なファイル
データをリークしそうなActivity
Sticky Intentの使用
不適切なPendingIntent
不適切なBroadcastIntentの送信
ソース中の秘密鍵
不適切な暗号化の使用
Tapjacking可能なアプリ
バックアップ可能なアプリ
デバッグ可能なアプリ
既知の脆弱性を持つ古いAPIバージョンをサポートするアプリ

使い方

Pythonで実行します。

python qark.py

1	python qark.py

QARK開始！！
APKファイルかソースファイルか、解析対象を選びます。

.d88888b.           d8888   8888888b.    888    d8P  
d88P" "Y88b         d88888   888   Y88b   888   d8P   
888     888        d88P888   888    888   888  d8P    
888     888       d88P 888   888   d88P   888d88K     
888     888      d88P  888   8888888P"    8888888b    
888 Y8b 888     d88P   888   888 T88b     888  Y88b   
Y88b.Y8b88P    d8888888888   888  T88b    888   Y88b  
 "Y888888"    d88P     888   888   T88b   888    Y88b 
       Y8b                                            
                                                      
                                                      

INFO - Initializing...
INFO - Identified Android SDK installation from a previous run.
INFO - Initializing QARK


Do you want to examine:
[1] APK
[2] Source

Enter your choice:1

.d88888b. d8888 8888888b. 888 d8P

d88P" "Y88b d88888 888 Y88b 888 d8P

888 888 d88P888 888 888 888 d8P

888 888 d88P 888 888 d88P 888d88K

888 888 d88P 888 8888888P" 8888888b

888 Y8b 888 d88P 888 888 T88b 888 Y88b

Y88b.Y8b88P d8888888888 888 T88b 888 Y88b

"Y888888" d88P 888 888 T88b 888 Y88b

Y8b

INFO - Initializing...

INFO - Identified Android SDK installation from a previous run.

INFO - Initializing QARK

Do you want to examine:

[1] APK

[2] Source

Enter your choice:1

APKファイルをPathで指定するか端末からPullするか選択します。

Do you want to:
[1] Provide a path to an APK
[2] Pull an existing APK from the device?

Enter your choice:1
Please enter the full path to your APK (ex. /foo/bar/pineapple.apk):
Path:sampleApps/goatdroid/goatdroid.apk

Do you want to:

[1] Provide a path to an APK

[2] Pull an existing APK from the device?

Enter your choice:1

Please enter the full path to your APK (ex. /foo/bar/pineapple.apk):

Path:sampleApps/goatdroid/goatdroid.apk

AndroidManifest.xmlを発見！！

INFO - Unpacking /Users/kaname/Documents/tool/qark/qark/sampleApps/goatdroid/goatdroid.apk
INFO - Zipfile: <zipfile.ZipFile object at 0x107d98810>
INFO - Extracted APK to /Users/kaname/Documents/tool/qark/qark/sampleApps/goatdroid/goatdroid/
INFO - Finding AndroidManifest.xml in /Users/kaname/Documents/tool/qark/qark/sampleApps/goatdroid/goatdroid
INFO - AndroidManifest.xml found

INFO - Unpacking /Users/kaname/Documents/tool/qark/qark/sampleApps/goatdroid/goatdroid.apk

INFO - Zipfile: <zipfile.ZipFile object at 0x107d98810>

INFO - Extracted APK to /Users/kaname/Documents/tool/qark/qark/sampleApps/goatdroid/goatdroid/

INFO - Finding AndroidManifest.xml in /Users/kaname/Documents/tool/qark/qark/sampleApps/goatdroid/goatdroid

INFO - AndroidManifest.xml found

AndroidManifest.xmlの解析をするかどうか聞いてくるのでy

Inspect Manifest?[y/n]y
Press ENTER key to continue
INFO - Determined minimum SDK version to be:9
WARNING - Logs are world readable on pre-4.1 devices. A malicious app could potentially retrieve sensitive data from the logs.
ISSUES - APP COMPONENT ATTACK SURFACE
WARNING - The backup element is not specified in the manifest, which therefore defaults to true. Potential for data theft via local attacks via adb backup, if the device has USB debugging enabled (not common). More info: http://developer.android.com/reference/android/R.attr.html#allowBackup
POTENTIAL VULNERABILITY - The android:debuggable flag is manually set to true in the AndroidManifest.xml. This will cause your application to be debuggable in production builds and can result in data leakage and other security issues. It is not necessary to set the android:debuggable flag in the manifest, it will be set appropriately automatically by the tools. More info: http://developer.android.com/guide/topics/manifest/application-element.html#debug

Inspect Manifest?[y/n]y

Press ENTER key to continue

INFO - Determined minimum SDK version to be:9

WARNING - Logs are world readable on pre-4.1 devices. A malicious app could potentially retrieve sensitive data from the logs.

ISSUES - APP COMPONENT ATTACK SURFACE

WARNING - The backup element is not specified in the manifest, which therefore defaults to true. Potential for data theft via local attacks via adb backup, if the device has USB debugging enabled (not common). More info: http://developer.android.com/reference/android/R.attr.html#allowBackup

POTENTIAL VULNERABILITY - The android:debuggable flag is manually set to true in the AndroidManifest.xml. This will cause your application to be debuggable in production builds and can result in data leakage and other security issues. It is not necessary to set the android:debuggable flag in the manifest, it will be set appropriately automatically by the tools. More info: http://developer.android.com/guide/topics/manifest/application-element.html#debug

逆コンパイル開始するよ。

Press ENTER key to begin decompilation
INFO - Please wait while QARK tries to decompile the code back to source using multiple decompilers. This may take a while.
:
:
:
INFO - Trying to improve accuracy of the decompiled files
INFO - Restored 11 file(s) out of 13 corrupt file(s)
INFO - Decompiled code found at:/Users/kaname/Documents/tool/qark/qark/sampleApps/goatdroid/goatdroid/
INFO - Finding all java files

Press ENTER key to begin decompilation

INFO - Please wait while QARK tries to decompile the code back to source using multiple decompilers. This may take a while.

INFO - Trying to improve accuracy of the decompiled files

INFO - Restored 11 file(s) out of 13 corrupt file(s)

INFO - Decompiled code found at:/Users/kaname/Documents/tool/qark/qark/sampleApps/goatdroid/goatdroid/

INFO - Finding all java files

静的コード解析、ISSUES発見！！いろいろとチェックしてくれます。

Press ENTER key to begin Static Code Analysis
INFO - Running Static Code Analysis...
INFO - Looking for private key files in project
:
:
ISSUES - ADB EXPLOIT COMMANDS
INFO - Until we perfect this, for manually testing, run the following command to see all the options and their meanings: adb shell am. Make sure to update qark frequently to get all the enhancements! You'll also find some good examples here: http://xgouchet.fr/android/index.php?article42/launch-intents-using-adb
==>EXPORTED ACTIVITIES: 
1.activities.Main
adb shell am start -a "android.intent.action.MAIN" -n "org.owasp.goatdroid.fourgoats/org.owasp.goatdroid.fourgoats.activities.Main"
2.activities.SocialAPIAuthentication
adb shell am start -n "org.owasp.goatdroid.fourgoats/org.owasp.goatdroid.fourgoats.activities.SocialAPIAuthentication"
3.activities.ViewCheckin
adb shell am start -n "org.owasp.goatdroid.fourgoats/org.owasp.goatdroid.fourgoats.activities.ViewCheckin"
:
:
To view any sticky broadcasts on the device:
adb shell dumpsys activity| grep sticky

INFO - Support for other component types and dynamically adding extras is in the works, please check for updates

Press ENTER key to begin Static Code Analysis

INFO - Running Static Code Analysis...

INFO - Looking for private key files in project

ISSUES - ADB EXPLOIT COMMANDS

INFO - Until we perfect this, for manually testing, run the following command to see all the options and their meanings: adb shell am. Make sure to update qark frequently to get all the enhancements! You'll also find some good examples here: http://xgouchet.fr/android/index.php?article42/launch-intents-using-adb

==>EXPORTED ACTIVITIES:

1.activities.Main

adb shell am start -a "android.intent.action.MAIN" -n "org.owasp.goatdroid.fourgoats/org.owasp.goatdroid.fourgoats.activities.Main"

2.activities.SocialAPIAuthentication

adb shell am start -n "org.owasp.goatdroid.fourgoats/org.owasp.goatdroid.fourgoats.activities.SocialAPIAuthentication"

3.activities.ViewCheckin

adb shell am start -n "org.owasp.goatdroid.fourgoats/org.owasp.goatdroid.fourgoats.activities.ViewCheckin"

To view any sticky broadcasts on the device:

adb shell dumpsys activity| grep sticky

INFO - Support for other component types and dynamically adding extras is in the works, please check for updates

gradleビルドを実行して、カスタムAPKを生成してくれます。

For the potential vulnerabilities, do you want to:
[1] Create a custom APK for exploitation
[2] Exit
Enter your choice:1
Generating exploit payloads for all vulnerabilities
org.owasp.goatdroid.fourgoats.activities.Main
adding value to string: org.owasp.goatdroid.fourgoats
adding value to string: org.owasp.goatdroid.fourgoats.activities.Main
org.owasp.goatdroid.fourgoats.activities.SocialAPIAuthentication
adding value to string: org.owasp.goatdroid.fourgoats.activities.SocialAPIAuthentication
org.owasp.goatdroid.fourgoats.activities.ViewCheckin
adding value to string: org.owasp.goatdroid.fourgoats.activities.ViewCheckin
org.owasp.goatdroid.fourgoats.activities.ViewProfile
adding value to string: org.owasp.goatdroid.fourgoats.activities.ViewProfile
adding value to string: org.owasp.goatdroid.fourgoats.services.LocationService
.broadcastreceivers.SendSMSNowReceiver
adding value to string: org.owasp.goatdroid.fourgoats.SOCIAL_SMS
------------ Building Exploit APK ------------
:
:
:app:packageDebug
:app:zipalignDebug
:app:assembleDebug

BUILD SUCCESSFUL
Total time: 45.071 secs

For the potential vulnerabilities, do you want to:

[1] Create a custom APK for exploitation

[2] Exit

Enter your choice:1

Generating exploit payloads for all vulnerabilities

org.owasp.goatdroid.fourgoats.activities.Main

adding value to string: org.owasp.goatdroid.fourgoats

adding value to string: org.owasp.goatdroid.fourgoats.activities.Main

org.owasp.goatdroid.fourgoats.activities.SocialAPIAuthentication

adding value to string: org.owasp.goatdroid.fourgoats.activities.SocialAPIAuthentication

org.owasp.goatdroid.fourgoats.activities.ViewCheckin

adding value to string: org.owasp.goatdroid.fourgoats.activities.ViewCheckin

org.owasp.goatdroid.fourgoats.activities.ViewProfile

adding value to string: org.owasp.goatdroid.fourgoats.activities.ViewProfile

adding value to string: org.owasp.goatdroid.fourgoats.services.LocationService

.broadcastreceivers.SendSMSNowReceiver

adding value to string: org.owasp.goatdroid.fourgoats.SOCIAL_SMS

------------ Building Exploit APK ------------

:app:packageDebug

:app:zipalignDebug

:app:assembleDebug

BUILD SUCCESSFUL

Total time: 45.071 secs

端末にインストールするかどうか聞いてきます。

Do you want to install this to your device? (y/n)n
INFO - The apk can be found in the /Users/kaname/Documents/tool/qark/qark/build/qark directory
An html report of the findings is located in : /Users/kaname/Documents/tool/qark/qark/report/report.html
Goodbye!

Do you want to install this to your device? (y/n)n

INFO - The apk can be found in the /Users/kaname/Documents/tool/qark/qark/build/qark directory

An html report of the findings is located in : /Users/kaname/Documents/tool/qark/qark/report/report.html

Goodbye!