[General Topics] anupritaisno1:
hardening

Lately I had been researching on how to further secure Android against Exploits, Malware, and Privacy issues. Some, if not most, of this guide is for the more paranoid users but I believe it is usefull information for everyone. I will try to keep it as easy to follow as possible.

Part 1 - ADB & Root:

What is ADB:

ADB (A.K.A the Android Debug Bridge) is a tool used by developers to allow access to an android device via a computer. The program consists of a server (ADBD) which lives on the phone/tablet and the client (ADB) which lives on the computer. This allows dev's to quickly access logs and install applications over a command shell.

The Threat:

While ADB is usefull if it is left on an attacker can use it to gain access to the device and dump logs, bypass the lock screen, root the device, steal credentails and more. One such attack is Kos' P2P-ADB. This framework allows an attack to bypass most (if not all) security if ADB is enabled on the device.

The Solution:

The easiest solution is to simply disable Degbuging. The setting is disabled by default but most custom roms have it enabled. To disable (on ICS/JB) it go to:

Code:

Settings ---> Developer Options ---> Android Debugging

Ensure Android debugging is unchecked.

For the more paranoid:

Adb actually relies on the ADBD binary. On most AOSP roms the binary is stored in /sbin/adbd if you change the permissions to 000 it can no longer execute and can't be used at all. One way to achieve this is by using this init.d script:

Code:

# Disable the adbd daemon

mount -o rw,remount -t rootfs rootfs /

chmod 000 /sbin/adbd

mount -o ro,remount -t rootfs rootfs /

mount -o ro,remount /system

Save the code to a file called 99secure and place it in /etc/init.d/ If your rom supports init.d the script will execute on boot and remove the adbd permissions so it can't run.

What is root/superuser:

Quote:

The superuser is a special user account used for system administration. Depending on the operating system, the actual name of this account might be: root, administrator, admin or supervisor. In some cases the actual name is not significant, rather an authorization flag in the user's profile determines if administrative functions can be performed.

The root user has full access to the system and can perform almost any task. Most custom ROMs ship with root enabled.

The problem:

Running with root enabled is inherently insecure. If a malicous app is allowed to run with root permisions it has full access to the system and can do what ever it wants (delete information, steal passwords, keylog, activate the camera, etc.)

The Solution:

If you are running a CyanogenMod Rom you can disable root by going to:

Code:

Settings ---> Developer Options ---> Root Access ---> Disabled

Alternatively you can change the permisions of the "su" binary to 000 with:

Code:

mount -o rw,remount /system

chmod 000 /system/xbin/su

mount -o ro,remount /system

Part 2 - Bluetooth:

Bluetooth is a great technology that allows close range (~30m) wireless comunication between devices such as headsets and speaker phones.

The Problem:

Bluetooth is a wide open whole for an attacker to gain access to your device. There are multiple exploits against bluetooth (such as bluejacking). While most aren't widely used bluetooth should be disabled when not in use.

The Solution:

Disable bluetooth via the settings app:

Code:

Settings ---> Bluetooth ---> Off

Alternatively you can disable the bluetooth service/daemon:

Code:

mount -o rw,remount /system

chmod 000 /system/bin/bluetoothd

mount -o ro,remount /system

and even the bluetooth device (this was done on a Galaxy Nexus running CM10 JB):

Code:

mount -o rw,remount /system

chmod 000 /dev/ttyO1

mount -o rw,remount /system

After that is done bluetooth can no longer be turned on by accident or a malicous attacker (provided they don't have root).

Part 3 - NFC:

What is NFC:

Quote:

Near field communication (NFC) is a set of standards for smartphones and similar devices to establish radio communication with each other by touching them together or bringing them into close proximity, usually no more than a few centimetres. Present and anticipated applications include contactless transactions, data exchange, and simplified setup of more complex communications such as Wi-Fi.[1] Communication is also possible between an NFC device and an unpowered NFC chip, called a "tag".[2]

NFC standards cover communications protocols and data exchange formats, and are based on existing radio-frequency identification (RFID) standards including ISO/IEC 14443 and FeliCa.[3] The standards include ISO/IEC 18092[4] and those defined by the NFC Forum, which was founded in 2004 by Nokia, Philips and Sony, and now has more than 160 members. The Forum also promotes NFC and certifies device compliance.[5]

As per Wikipedia

The Problem:

This year at defcon NFC was shown to be vulnerable to attack (http://xdaforums.com/show....php?t=1832186). Another example is the recent Samsung Exploit which can be executed by NFC tags as well.

The Solution:

NFC can be disabled by:

Code:

Settings --- > Wireless & Networks ---> NFC

Alternatively you can disable the NFC Device:

Code:

mount -o rw,remount /system

chmod 000 /dev/ttyO3

mount -o rw,remount /system

Part 4 - Network Attacks:

Just like a computer android is succeptable to attacks over the network. Bellow is a init.d script that will harden the TCP/IP stack:

Code:

# hardening TCP/IP stack for IPV4

sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 #ICMP broadcast

sysctl -w net.ipv4.conf.all.accept_redirects=0 # ICMP redirects ipv4

sysctl -w net.ipv6.conf.all.accept_redirects=0 #ICMP redirects ipv6

sysctl -w net.ipv4.conf.all.send_redirects=0 # ICMP redirects

sysctl -w net.ipv4.conf.all.accept_source_route=0 #source routing disable

sysctl -w net.ipv4.conf.all.forwarding=0 #Forwarding traffic

sysctl -w net.ipv4.conf.all.rp_filter=1

sysctl -w net.ipv4.conf.all.log_martians=1 #filter martians

sysctl -w net.ipv4.tcp_max_syn_backlog=1280 # TCP syn half-opened

sysctl -w net.ipv4.ip_forward=0

sysctl -w net.ipv4.tcp_syncookies=1

Android also runs IPTables ( A firewall). You can change this by script or a nice GUI tool calledDroid Wall

Part 5 - Removing unneeded applications:

These commands will remove some applications that aren't needed and may have internet access. The bottom ones are kept for root only:

Code:

rm -f /system/xbin/irsii

rm -f /system/xbin/nano

rm -f /system/xbin/nc

rm -f /system/xbin/telnet

rm -f /system/xbin/telnetd

rm -f /system/xbin/opcontrol

chmod 740 /system/xbin/rsync

chmod 740 /system/xbin/strace

chmod 000 /system/bin/bluetoothd

chmod 750 /system/bin/iptables

chmod 750 /system/bin/ping]

There may be more you want to remove like ssh.

I personally removed "Packet Management" as well to prevent installing apps over USB:

Code:

# disable the Packet Management binary

chmod 000 /system/bin/pm

Part 6 - Removing APK's:

You can also remove unneeded APK's by:

Code:

mount -o rw,remount /system

rm -r /system/app/[apk name here]

mount -o ro,remount /system

I removed these apps:

Quote:

Bluetooth.apk

NFC.apk

Development.apk

DrmProvider.apk (You may not want to do this if you use the playstore)

Email.apk ( I use K-9 instead)

Exchange.apk (I don't need it you may)

PackageInstaller.apk ( Used to install apps. Don't remove if you want to install apps).

What apps you can and can't remove

Part 7 - Misc:

Personally I don't use the playstore/Google Framework as it sends back WAY to much info for me to trust it. I also reccomend using Full Device Encryption and a secure Kernel such as FuguMod.

Alot of the information I got is from this Sans guide

I will be posting more as I look into other security options

Let me know if I missed anything and please hit thanks if I helped at all.

Bellow is the init.d script I am using (modified from the Sans guide) ** ONLY TESTED ON A GSM GALAXY NEXUS ***:

Code:

#!/system/bin/sh

# Customize some parameters and lockout the SO

# July 2011

mount -o rw,remount /system

# Disable Bluetooth

chmod 000 /dev/ttyO1

#Disable NFC

chmod 000 /dev/ttyO3

# hardening TCP/IP stack for IPV4/IPV6

sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 #ICMP broadcast

sysctl -w net.ipv4.conf.all.accept_redirects=0 # ICMP redirects ipv4

sysctl -w net.ipv6.conf.all.accept_redirects=0 #ICMP redirects ipv6

sysctl -w net.ipv4.conf.all.send_redirects=0 # ICMP redirects

sysctl -w net.ipv4.conf.all.accept_source_route=0 #source routing disable

sysctl -w net.ipv4.conf.all.forwarding=0 #Forwarding traffic

sysctl -w net.ipv4.conf.all.rp_filter=1

sysctl -w net.ipv4.conf.all.log_martians=1 #filter martians

sysctl -w net.ipv4.tcp_max_syn_backlog=1280 # TCP syn half-opened

sysctl -w net.ipv4.ip_forward=0

sysctl -w net.ipv4.tcp_syncookies=1

# Removing/ disabling unnecessary binaries. Some of them have access to Internet

rm -f /system/xbin/irsii

rm -f /system/xbin/nano

rm -f /system/xbin/nc

rm -f /system/xbin/telnet

rm -f /system/xbin/telnetd

rm -f /system/xbin/opcontrol

chmod 740 /system/xbin/rsync

chmod 740 /system/xbin/strace

chmod 000 /system/bin/bluetoothd

chmod 750 /system/bin/iptables

chmod 750 /system/bin/ping

## This is the last step of the hardening

# do a backup before

# disable the Packet Management binary

chmod 000 /system/bin/pm

# Disable the adbd daemon

mount -o rw,remount -t rootfs rootfs /

chmod 000 /sbin/adbd

mount -o ro,remount -t rootfs rootfs /

mount -o ro,remount /system

thanks to x942