Package: robodroid
RoboDroidRoboDroid is a cutting-edge software tool designed to simplify the process of managing (andvery soonalso deploying) Android machines for usage in Cyber Range environments. With RoboDroid, users can easily set up and customize pre-defined behaviors for their Android machines, allowing them to create complex cyber attack scenarios and test their defenses against a wide range of threats.📋 Table of Contents📱 Context⚡ Overview📚 How It WorksInteraction with the Frida Agent🔌 InstallRoboDroid Libraryℹ️ UsageruncommandENV VariablesRun in Docker🚀 Demo🚧 Roadmap📚 Credits🪪 License📱 ContextMobile devices have become ubiquitous in today's world. People use smartphones for almost every aspect of their lives, including banking, shopping, and communication. As a result, mobile devices are now a primary target for cybercriminals.However, the security of mobile devices is often overlooked in cybersecurity training and testing environments. This can leave organizations vulnerable to attacks that exploit the weaknesses of mobile devices. Therefore, it is important to introduce mobile components in next-generation cyber-ranges to adapt to the current world that is more and more smartphone-addicted.RoboDroidis designed to help fill this gap by providing a set of tools that can simulate human-like smartphone behavior. The pre-defined behaviors are created usingFridaand are managed in theRoboDroid Libraryrepository.⚡ OverviewThe goal ofRoboDroidis to provide a simple way to introduce mobile components in Cyber Range environments. Its main objective is to provide users with an easy-to-use platform that allows them to simulate human-like behaviors and actions on mobile devices.RoboDroid leveragesFridatechnology to run behaviors that are specific to applications, while usingADBfor all other operations. This powerful combination enables users to create workflows of preset behaviors that can simulate a mobile user's actions.One example of a workflow that can be used in a cyber range environment involves simulating a mobile user receiving a phishing email, clicking on the link contained in the email, and subsequently downloading a malware.The following picture summarizes it:The workflow can be broken down into the following steps:The user receives a phishing email containing a link that appears legitimate.The user clicks on the link, which redirects them to a malicious website.The website prompts the user to download an app, which they do.The app is installed on the user's device and begins executing malicious code.The malware gains access to sensitive data on the device, such as passwords, credit card information, and other personal details.By creating and running workflows like this, users can simulate realistic cyber attack scenarios and test their defenses against a wide range of threats. This helps to ensure that systems and networks are well-protected against potential vulnerabilities, and that users are prepared to respond effectively in the event of an attack.📚 How It WorksInteraction with the Frida AgentRoboDroid ommunicates with the Frida Agent provided by the RoboDroid Library via messages, providing efficient interaction.
When the RoboDroid begins a specific behavior, it awaits a message from the Frida Agent. The message could be of eitherFAILUREorCOMPLETEDtype.If the message type isFAILURERoboDroid restarts the current behavior to ensure successful completion. If the message type isCOMPLETEDthe current step is marked as finished, and RoboDroid moves to the next step.Furthermore, a message of typeCOMPLETEDcan also containoutputsthat can be used in subsequent steps. This ensures that the tool can optimize its behavior to achieve accurate simulation of human-like actions on mobile devices.By providing this robust communication process, RoboDroid ensures the seamless integration of the Frida Agent into its toolset, and facilitates the creation of complex workflows for the simulation of mobile devices in a Cyber Range environment.🔌 InstallYou can easily install it by running:pipx install robodroidWe suggest you to usepipxinstead ofpipbecause in future Python versions package installation withpipwill be removed outside virtual environments.RoboDroid LibraryRoboDroidhas built-in support for automatic behaviors download (andsoonauto-update) from theRoboDroid Libraryrepository. If you want to add a new Frida behavior we suggest you to head over to the specific repository and make a Pull Request.ℹ️ Usagerobodroid --helpThis will display the help for the tool:&&&&&&&&&&&
           &&&&         &&&&
         &&&               &&&
      (&&&&   &&&&   &&&&   &&&)&
      &(&&&&               &&&&)&
          &&&&           &&&&
             &&&&&&&&&&&&&
       &&&  &&&&&&&&&&&&&&&  &&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
              &&&&&&&&&&&
               &&&& &&&&
               &&&& &&&&
            RoboDroid v0.0.3

 Usage: robodroid [OPTIONS] COMMAND [ARGS]...

 Manage and deploy Android machines with pre-defined behaviors for Cyber Range environments

╭─ Options ──────────────────────────────────────────────────────────────────────────────────╮
│ --help  -h        Show this message and exit.                                              │
╰────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ─────────────────────────────────────────────────────────────────────────────────╮
│ run               Run RoboDroid.                                                           │
| update-library    Update the RoboDroid Library to the latest version                       |
│ version           Print the current version and exit.                                      │
╰────────────────────────────────────────────────────────────────────────────────────────────╯runcommandYou can runrobodroidin two different modes:Interactive (default)Managed&&&&&&&&&&&
           &&&&         &&&&
         &&&               &&&
      (&&&&   &&&&   &&&&   &&&)&
      &(&&&&               &&&&)&
          &&&&           &&&&
             &&&&&&&&&&&&&
       &&&  &&&&&&&&&&&&&&&  &&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
      &&&&  &&&&&&&&&&&&&&&  &&&&
              &&&&&&&&&&&
               &&&& &&&&
               &&&& &&&&
            RoboDroid v0.0.3

 Usage: robodroid run [OPTIONS]

 Run RoboDroid.

╭─ Options ───────────────────────────────────────────────────────────────────────────╮
│ --log-mode          [silent|normal|debug]  Set logging mode [default: normal]       │
│ --mode      -m      [interactive|managed]  Set run mode [default: interactive]      │
│ --config    -c      TEXT                   Name of the managed config file to load  │
│ --help      -h                             Show this message and exit.              │
╰─────────────────────────────────────────────────────────────────────────────────────╯In the interactive mode there is a prompt that lets the user select theADBhost, the port and the device to use while themanagedmode uses a config file thatMUST BE PLACEDunder$HOME/.RoboDroid/configinyamlformat. Themanagedmode is the perfect mode to use while setting up a lab/environment without the need of user input/configuration.
The following table provides a description of the fields used in theconfigfile:KeyRequiredDescriptiondeviceTrueInfo about the device to useworkflowTrueThe workflow to use (name of the file)Before actually running it you need to provide at least one valid workflow file thatmustbe placed under$HOME/.RoboDroid/workflowsinyamlformat.
This config file defines all the steps of the workflow that will be executed, you can take a look at theexamplesfolder for some valid configurations. The following table provides a description of the fields used in theworkflowfile:KeyRequiredDescriptionidTrueThe ID of the workflowinitFalseThe init section, contains the initial setup actionsbehaviorsTrueThe list of behaviors to executeIn theinitsection you may set the APKs that must be installed and the packages that must be cleaned up (storage and cache) before running the actual workflow. The structure of this section is the following:KeyRequiredDescriptioninstallTrueList of paths of APKs to installclearFalseList of packages to clean up (storage and cache)In thebehaviorssection there is the actual workflow. It is alistof elements that are calledstepswhich are meant to be executedsequentially. Everystephas the following structure:KeyRequiredDescriptionidTrueID of the stepnameTrueThe name of the behavior (in the RoboDroid Library or in the commands list)typeTrueThe type of the behavior ("frida-behavior", "adb")inputsFalseThe list of inputsFinally every input has the following structure:KeyRequiredDescriptionidTrueID of the inputvalueTrueThe value to assign to this inputThe last thing to say is that you canalso use outputs from previous steps as input to the next ones. To do that you can set the value of an input by using thereservedprefixrobodroid.outputsfollowed by the ID of the step and the ID of the output, for example:...
  - id: get-link
    name: k9-mail-refresh-and-get-link
    type: frida
  - id: open-and-download
    name: firefox-android-open-link-and-download
    type: frida
    inputs:
      - id: link
        value: robodroid.outputs.get-link.link
...ENV VariablesThe CLI options can also be set through env variables (especially useful when running inside Docker); the following table provides a list of the current env variables available:KeyDescriptionROBODROID_LOG_MODELog level of RoboDroid [silentROBODROID_RUN_MODERun mode [interactiveROBODROID_MANAGED_CONFIG_NAMEThe name of the managed config to use (while running inmanagedmode)Run in DockerTODO🚀 DemoWe made a brief demo video that shows RoboDroid in action with a template that does the following:Sets up and email account on the K9 Mail appWaits indefinitely for a new email and returns the first link inside itOpens the link with the Firefox Android (Fenix) application, downloads the linked file and installs itThis workflow simulates a common phishing attack (although simplified) that can be used in a next-generation Cyber Range involving Android Mobile Devices.🚧 RoadmapRoboDroidis a newborn tool and still needs to grow up! Currently these are the features we plan to add very soon:Automatic deploy of AVDAutomatic deploy of ReDroid instanceAutomatic deploy of Genymotion instanceMulti-device supportInteractiveCreative mode (without workflow file)Continuous workflow mode (restart the whole workflow indefinitely until manually stopped)Of course we plan to add more and more behaviors in theRoboDroid Libraryand more and moreadbcommands in this repo. We also encourage every user to contribute to this projet and make it better!📚 CreditsDeveloped by Angelo Delicato@SecSI🪪 LicenseRoboDroidis released under theGPL-3.0 LICENSE