M08: Security Misconfiguration - Attack Vectors
Table of Contents
- Attack Methodology Overview
- Configuration Analysis Attacks
- Permission Exploitation
- Network Configuration Attacks
- Debug Feature Exploitation
- Attack Tools and Techniques
Attack Methodology Overview
Attackers targeting security misconfigurations follow a systematic approach:
``
- Reconnaissance (App Analysis)
↓
- Configuration Extraction (Manifest, Info.plist)
↓
- Debug Feature Detection (Logging, Error Messages)
↓
- Permission Enumeration (Granted Capabilities)
↓
- Network Analysis (TLS Settings, Cleartext)
↓
- Exploitation (Leverage Weak Configurations)
Attack Timeline
- Initial Analysis: Minutes (extract and analyze configuration)
- Vulnerability Discovery: Hours (identify misconfigurations)
- Exploitation: Minutes to days (depending on vulnerability)
Configuration Analysis Attacks
Attack Vector 1: Manifest/Info.plist Analysis
Technique: Examining application configuration files for security weaknesses.
Android - AndroidManifest.xml Analysis:
`xml
android:debuggable="true"
android:allowBackup="true"
android:usesCleartextTraffic="true">
`
iOS - Info.plist Analysis:
`xml
NSAppTransportSecurity
NSAllowsArbitraryLoads
`
What Attackers Look For:
- Debug flags enabled
- Backup configurations
- Exported components
- Cleartext traffic allowances
- Weak App Transport Security settings
- Unnecessary permissions
Attack Vector 2: Debug Mode Exploitation
Technique: Leveraging debug features left enabled in production.
Information Disclosure Through Logs:
`
// Attackers monitor logcat for sensitive information
adb logcat | grep -i "password\|token\|api\|secret"
// Common debug outputs:
D/API: Request URL: https://api.example.com/user/12345/profile
D/API: Auth Token: eyJhbGciOiJIUzI1NiIs...
D/Database: SQL Query: SELECT * FROM users WHERE id=12345
E/Auth: Login failed for user: admin@example.com
`
Stack Trace Analysis:
- Detailed error messages expose internal structure
- File paths reveal code organization
- Database queries show schema
- API endpoints disclosed
Example Attack Flow:
`
- Install app with debug enabled
- Monitor application logs
- Collect API endpoints, tokens, database queries
- Map internal application structure
- Exploit discovered information
`
Attack Vector 3: Insecure Build Configuration
Technique: Exploiting development configurations in production builds.
Common Issues:
- Source maps included in release builds
- Development endpoints not removed
- Test accounts/credentials present
- Debug symbols not stripped
- Obfuscation disabled
ProGuard/R8 Not Configured:
`
// Without obfuscation, decompiled code is readable
public class ApiClient {
private String apiKey = "sk_live_12345...";
public String getSecretEndpoint() {
return "https://api.example.com/admin/secret";
}
}
`
Permission Exploitation
Attack Vector 4: Excessive Permissions
Technique: Exploiting overly permissive app permissions.
Android Permission Abuse:
`xml
`
Attack Scenarios:
- Data Harvesting: App collects contacts, location unnecessarily
- Malware Vector: Malicious updates abuse existing permissions
- Privacy Violations: Tracking user without clear purpose
- Cross-App Attacks: Accessing shared storage of other apps
Attack Vector 5: Exported Components
Technique: Accessing improperly exported app components.
Vulnerable Exported Activity:
`xml
android:name=".AdminActivity"
android:exported="true">
`
Exploitation:
`bash
Launch exported activity from another app or adb
adb shell am start -n com.example.app/.AdminActivity
Access exported content provider
adb shell content query --uri content://com.example.provider/sensitive_data
`
What Can Be Exploited:
- Activities (UI screens)
- Services (background tasks)
- Broadcast Receivers (event handlers)
- Content Providers (data storage)
Network Configuration Attacks
Attack Vector 6: Cleartext Traffic Interception
Technique: Intercepting unencrypted HTTP traffic.
Vulnerable Network Configuration:
`xml
android:usesCleartextTraffic="true">
`
Attack Process:
`
- User connects to public WiFi
- Attacker performs ARP spoofing
- All traffic routed through attacker
- HTTP requests captured in cleartext
- Credentials, tokens, data stolen
`
Captured Traffic Example:
`http
GET /api/user/profile HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Cookie: session=abc123def456
`
Attack Vector 7: Weak TLS Configuration
Technique: Exploiting weak SSL/TLS settings.
Vulnerable iOS ATS Configuration:
`xml
NSAppTransportSecurity
NSAllowsArbitraryLoads
`
Attacks Enabled:
- Man-in-the-middle attacks
- Downgrade attacks to weak ciphers
- Certificate validation bypass
- Traffic interception and modification
Attack Vector 8: Missing Certificate Pinning
Technique: Bypassing TLS with custom certificates.
Attack Setup:
`
- Install proxy certificate on device (Burp, Charles)
- Configure proxy settings
- App trusts any certificate (no pinning)
- All HTTPS traffic decrypted by proxy
- Modify requests/responses at will
`
Debug Feature Exploitation
Attack Vector 9: WebView Debug Mode
Technique: Accessing WebView debugging interfaces.
Vulnerable WebView Configuration:
`java
// VULNERABLE: WebView debugging enabled in production
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
WebView.setWebContentsDebuggingEnabled(true);
}
`
Exploitation:
`
- Connect device to computer
- Open Chrome DevTools (chrome://inspect)
- Access WebView content
- Inspect DOM, execute JavaScript
- Extract tokens, manipulate UI, bypass controls
`
Attack Vector 10: Backup Data Extraction
Technique: Extracting application data from device backups.
Vulnerable Backup Configuration:
`xml
android:allowBackup="true"
android:fullBackupContent="true">
`
Extraction Process:
`bash
Create backup
adb backup -f app.ab com.example.app
Convert to tar
java -jar abe.jar unpack app.ab app.tar
Extract files
tar -xf app.tar
Access application data
cd apps/com.example.app/
cat shared_prefs/credentials.xml
sqlite3 databases/app.db
`
What's Exposed:
- Shared preferences (credentials, tokens)
- Databases (user data, cached content)
- Files (documents, images, configs)
- Cache (temporary sensitive data)
Attack Tools and Techniques
Configuration Analysis Tools
| Tool | Purpose | Platform |
|------|---------|----------|
| apktool | Decode APK resources and manifest | Android |
| aapt | Android Asset Packaging Tool | Android |
| plistutil | Parse iOS plists | iOS |
| MobSF | Automated misconfiguration detection | Both |
| Drozer | Android security assessment | Android |
Network Analysis Tools
| Tool | Purpose | Platform |
|------|---------|----------|
| Burp Suite | MITM proxy, TLS testing | Both |
| mitmproxy | HTTP/HTTPS interception | Both |
| Wireshark | Network packet analysis | Both |
| Charles Proxy | SSL proxying | Both |
Permission Analysis
`bash
Android: List app permissions
adb shell dumpsys package com.example.app | grep permission
Check for dangerous permissions
adb shell pm list permissions -d -g
iOS: Analyze entitlements
codesign -d --entitlements - /path/to/App.app
`
Real-World Attack Scenarios
Scenario 1: Debug Information Leakage
`
- Download app from Play Store
- Install on rooted device
- Enable logcat monitoring
- Use app normally
- Observe debug logs exposing:
- API endpoints
- Authentication tokens
- User IDs and data
- Internal server errors
- Use information to attack backend
`
Scenario 2: Cleartext Traffic Exploitation
`
- Set up rogue WiFi access point
- User connects mobile device
- App makes HTTP requests (cleartext enabled)
- Capture authentication credentials
- Capture API keys and tokens
- Replay requests to backend
- Access user account
`
Scenario 3: Exported Component Abuse
`
- Analyze AndroidManifest.xml
- Find exported admin activity
- Create malicious app
- Launch exported admin activity
- Bypass authentication
- Access administrative functions
- Modify app data or behavior
``
Detection and Monitoring
Indicators of Misconfiguration Exploitation
Application Level:- Unusual activity patterns from debug endpoints
- Excessive permission usage
- Unexpected component activation
- Abnormal network traffic patterns
- HTTP traffic from production app
- SSL/TLS errors or warnings
- Certificate pinning failures
- Unusual API endpoint access
- Backup access attempts
- ADB connections to production devices
- Exported component access from external apps
Mitigation Overview
Understanding these attack vectors is crucial for defense:
- Disable debug features in release builds
- Enforce HTTPS and proper TLS configuration
- Minimize permissions to only what's necessary
- Secure exported components with proper permissions
- Disable backups for sensitive data
- Implement certificate pinning for critical connections
- Strip debug symbols from production builds
- Regular configuration audits using automated tools
For detailed prevention strategies, see Prevention.
---
Remember: Misconfigurations are low-hanging fruit for attackers. Proper configuration is essential. Part of OWASP Mobile Top 10 - Educational Repository