Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing

0:00Chris RomeoHey folks, season 4, episode 16 of the AppSec Podcast. On this episode, we talk about iGoat and pen testing iOS mobile applications. This is the first interview from AppSec USA, and we hope you enjoy. The Application Security Podcast. Here we go. Hey folks, welcome to this episode of the AppSec Podcast coming to you live from AppSec USA. And, uh, I'm joined here by Swaroop, who is doing a talk here at AppSec USA, but he's also had a lot of experience and has ownership of the OWASP iGOAT project. And so he's going to explore what that means for us. But first, Swaroop, if you would tell us your security origin story. So how did you get into security? How did you get started?

1:11Swaroop YermalkarYeah. Thanks, Chris, for inviting me. So I've done my engineering from India and I was fascinated by the security. I started with Wi-Fi signals. So how they works. And mostly I was very, very much attracted towards like how to hack into the Wi-Fi. Like it was, it was a fun thing during college. But after that, I, as soon as I've done my engineering, I got job in security. Like it was a security as consulting.

1:40Okay.

1:41Swaroop YermalkarAnd in the same time, I also started into bug bounties. And in over the time, I become the one of the top bug bounty researchers worldwide. working with Synack and then Cobalt. And yeah, so, and after that, I authored a book on iOS security that is Learning iOS Penetration Testing, and it's one of the most popular books on iOS security available in the market. And I was— as my specialization is more towards iOS, okay, I'd taken up that OWASP iGoat project and And we are now keeping that project very much active. And it's like a leading project to learn for the iOS security and also the pentesting for both developers and pentesters.

2:32Chris RomeoYeah.

2:33Swaroop YermalkarSo it's kind of brief about me.

2:35Chris RomeoSo now you didn't, you didn't hack the Wi-Fi here at the conference, did you?

2:38Swaroop YermalkarNo, I stopped that. It was fun during engineering.

2:42Chris RomeoSo do you still do bug bounties and that type of stuff now?

2:45Swaroop YermalkarYeah, I do a lot. And that's, I'm going to present in the talk tomorrow, like some critical findings where I'm not going to disclose everything, but like how I was able to take AWS just by using mobile application.

3:01Okay.

3:02Swaroop YermalkarBecause if you see, then most of the companies pay attention to the web APIs or the backend, but the mobile part is somehow neglected.

3:11Chris RomeoAnd you're doing bug bounties? I didn't even realize people did bug bounties. They give you the app and let you actually test the app in their bug bounty environment?

3:20Swaroop YermalkarYeah, they give you the like App Store URL or Play Store, whichever app is there.

3:24Chris RomeoOkay.

3:25Swaroop YermalkarAnd they say whatever you can do, find issues for us.

3:28Chris RomeoOkay, so it goes to the production, it's their production application. It's not like a test environment or anything.

3:33Swaroop YermalkarSo depends on clients. If you prefer the production or if you prefer the— they send you some Crashlytics invite or the testing environment.

3:42Chris RomeoOkay.

3:43Swaroop YermalkarYeah.

3:43Okay, cool.

3:44Chris RomeoAnd so what is your talk here at AppSec USA? It's called Pen Testing Swift Applications for Fun and Profit. Kind of has a familiar name to a popular article written about what seems like 100 years ago by Aleph One, right? About buffer over or something for smashing the stack for fun and profit or something. Yeah, maybe a little run on that, but with OWASP iGoat. So tell me, tell me about this talk and Give me just kind of a high-level summary of what you talk about in this talk.

4:13Swaroop YermalkarSure. So recently we released the OWASP SpyGo in Swift. So previously it was completely in Objective-C.

4:20Chris RomeoOkay, so is that the old— what's the difference between Swift and Objective-C for those that don't know?

4:26Swaroop YermalkarSo Swift is a new language, right? It's a new language by Apple. So previously, like, most of the companies' entire development was in Objective-C. And now if you see, the companies are moving from Objective-C to Swift, and it's important to learn that Swift vulnerabilities as well. So that's the reason we recently released a Swift version of OWASP PyGuard project. And so that is one part of my talk. And as I said, I do bug bounties. I had like critical findings from them in the iOS applications, which I'm going to explain in the talk.

5:01Chris RomeoSo I guess, so in your talk, you're gonna reference some of the really critical issues and things. Since we're recording this now, and this isn't going to get posted until after your talk, you can give us kind of the inside scoop. So what are some of those critical issues that folks should be thinking about with their mobile apps?

5:19Swaroop YermalkarYeah. So if you see when I talk with the managers or security folks, they have the automated tools scanners for the web APIs, but they don't have tools or the people who can check for the mobile applications. So that's the reason, like I was checking one of the production application that was for pentesting. And what I found that one of the developers, like, so it was basically iOS application, and it's a general practice that once you get the application, you do reverse engineering, then disassemble the code. And, uh, while doing the disassembling, I found that the AWS keys were hardcoded in the code itself.

5:58Chris RomeoThat doesn't sound good.

5:59Swaroop YermalkarYeah, so I use that keys, uh, and I tried the permission, and I was So the keys I got had a lot more permission. I was able to launch EC2 instances and I was able to do a lot more things. Like I was able to list all the IAM users of that particular enterprise. And so if getting those keys into wrong hand, a wrong hand could do anything. Like someone could just launch thousands of EC2 instances and that could cost—

6:30Chris RomeoNot only did they have the keys hardcoded into the app, they didn't limit the permissions of the key.

6:36Exactly.

6:36Chris RomeoThe key had full access to EC2 and all the other AWS resources.

6:39Swaroop YermalkarYeah, so there are 2 issues. Like, one is getting the keys. So that is the— that was the issue in the code level, like the developer has a mistaken. And the other was AWS, the keys, they should have the very limited permission, right? But it has a lot more permissions, so I could do whatever I want. So, but as a POC, I just launched one free tier EC2 instance.

7:00Chris RomeoJust to prove it.

7:01Swaroop YermalkarYeah, I just submitted.

7:03Chris RomeoNow, how prevalent is that issue? Does that happen a lot in mobile apps as you're testing? Does default credentials and keys included inside the app?

7:11Swaroop YermalkarYeah, so if you see, not like AWS, but like different, like in one of the applications I found the QA accounts were hardcoded. Like, so as soon as you load the application, it was creating one database and it had one QA credentials with the endpoint. So you can actually access the upcoming features. Like, so application has quarter 1, 2, 3 releases.

7:34Chris RomeoOkay.

7:35Swaroop YermalkarSo using that, I was able to log in as a backdoor entry and I was able to access their all upcoming features. Yeah.

7:43Chris RomeoSo, yeah.

7:44Wow. Yeah.

7:45Chris RomeoSo that's one kind of big class of mobile problems would be default credentials, which that's a pretty standard problem that exists in product security. It exists in web applications even, not as much anymore as it used to, but it's still there. What's another challenge or what's another big type of issue that you see?

8:04Swaroop YermalkarSo I see the biggest challenge is if you see, we have lots of tools in CI/CD or DevSecOps where we are already looking at the backend, right? Whenever the code goes into production, it goes through all the tools. So we already get the idea of security posture, But when you're talking about the app on the device, there are people don't have much skills or they are not able to do that. And that's the reason we found so many loopholes in the code, which is like app on the device.

8:36Okay.

8:37Chris RomeoBecause you have access to the app itself.

8:40Swaroop YermalkarYeah.

8:41Chris RomeoLike if you think about it in a common, like in a web app perspective, I never give— it's hard. You can't get a copy of my binary.

8:48Swaroop YermalkarExactly.

8:48Chris RomeoLike, let's say I'm running a Java application and I'm releasing it in a WAR file.

8:53Swaroop YermalkarYes.

8:53Chris RomeoYou don't have the ability to download that WAR file like you can with an app.

8:57Exactly.

8:57Chris RomeoSo with the app, you got access to everything, so you can tear it apart. So walk us through a little bit about what you do once you get your hands on that app and tell us a little bit more about, you mentioned reverse engineering, tell us a little bit more about how that works.

9:11Swaroop YermalkarSo when we get the application, first we understand their business, like what exactly that, what is their IP or what, what is their business.

9:20Chris RomeoAnd when you say business, what do you mean? Like who it belongs to, or what they're selling, or what they do, or what is important for them?

9:27Swaroop YermalkarIs it like the data? So data is definitely important, but like which functionality is more sensitive for them, or which is the critical part of the application?

9:35Chris RomeoAnd you can tell that— so you can tell that just by using the application?

9:38Swaroop YermalkarSo yeah, we navigate to our application, we check out all the options of functionalities, and then we We figure it out like what is the most important.

9:47Chris RomeoSo the user, you're at the user level at that point. Exactly.

9:49Swaroop YermalkarOkay. So we do it like black box. We don't know what is like server side. It's like a complete black box testing.

9:56Chris RomeoWhich means you have no knowledge, no internal knowledge of the code that's running, no internal knowledge of the systems. They hand you the app and they say, see what you can do.

10:04Swaroop YermalkarYeah. So all we have is the URL, App Store URL, and with that, whatever we can do.

10:09Chris RomeoOkay.

10:09Swaroop YermalkarAfter that, we do the static analysis. We check like what is application storing locally on the device. So there is again misconception that developers say that they don't consider issues which are on the rooted device. Like they say that if let's say they are storing the credentials in the kitchen and they say that it will be accessible only if the device is rooted, so they don't care.

10:33Okay.

10:34Swaroop YermalkarBut if you see the rooting is, it's just like it's very easy nowadays. Jailbreaking device is not a tough job. If you see like jailbreaks are available till almost iOS 11, and recently there was Pangu, uh, Pangu team demonstrated jailbreak for the iOS 12.

10:51Chris RomeoOh yeah, that's brand new.

10:54Swaroop YermalkarYeah, so, so developers should keep in mind that the app is going to be accessed on the rooted device or the compromised device where, where, where the user will have access to everything, like whatever they are storing in the keychain or whatever is in the local storage, or, or they could reverse engineer the application like, uh, So in iOS, it's pretty standard format. Like, you can easily reverse engineer any application. Like, you can first decrypt the application using the tools like Clutch, and then you can dump all the classes.

11:24Chris RomeoIs that because you have the keys? Like, your phone, your personal phone has to be able to decrypt the app to run it, right?

11:30Swaroop YermalkarSo once you unlock the phone, you can use utilities like Clutch, and then you're gonna actually decrypt the application.

11:38Chris RomeoUsing your credentials on the phone?

11:41Swaroop YermalkarYou don't need credentials. So when— so basically Clutch, how it works is like when you load the application into your memory, it's basically decrypted. Okay, so Clutch uses that thing and it basically helps you to decrypt the application. Okay, and after that you use the class dumpz and you can actually dump the classes. You can— so you can also use the disassemblers and And you can understand pretty much everything in the application. What are the workflows? What are the hardcoded values and other stuff? So methodology is like static analysis, then reverse engineering, then we keep the proxy in between, and again, we check the dynamic scanning of the application.

12:24Chris RomeoSo when you say static analysis, are there tools that you're using that's actually performing the static analysis?

12:32Swaroop YermalkarSo there is no like one tool which will do everything. Like we have like different open source tools. Mostly the tools are like free and open source.

12:39Chris RomeoOkay.

12:40Swaroop YermalkarWe use for the static analysis, and that comes for like storage analysis or the keychain data and other things.

12:50Chris RomeoYeah. Okay. And so from— okay, so, so that's the static analysis side. You're dumping the classes in the disassembler. To look for hardcoded values. So when you proxy, you're just running normal DAST tools, dynamic application security testing tools against the app, or is it special tools for apps?

13:08Swaroop YermalkarIt's a normal, like we keep the Burp Suite proxy or different scanners and we check the traffic going from app to backend.

13:16Chris RomeoOh, okay. So you're not really scanning the app for vulnerabilities per se in the web, like a web service that might be running on the app because everything's running on the server side.

13:26Swaroop YermalkarYeah, mostly. You're just watching the traffic. Nowadays are hybrid application where your server, it's communicating into the servers in the backend.

13:32Chris RomeoSo, okay.

13:34Swaroop YermalkarAnd what I see is like even the endpoints used by the mobile application are weak because, because they don't— the many companies don't pay much attention towards that. Like they have the different endpoints for your web application and different endpoints for your mobile application.

13:51Chris RomeoOkay.

13:52Swaroop YermalkarAnd I found many of the issues in the endpoints used by the mobile applications.

13:58Chris RomeoSo they're not as vigilant in the security for the mobile endpoints?

14:01Swaroop YermalkarYeah, like server-side validation and like those issues are more towards the mobile endpoints.

14:07Hmm.

14:10Chris RomeoI guess it makes sense because they're probably not seeing as much attack traffic to the mobile side because people just aren't poking at it as much, but that will change, right?

14:22Swaroop YermalkarBut nowadays time has changed. If you see the traffic for all the big companies, it's more from the, more than 50% is from the mobile. mobile comparing to your web application.

14:31Chris RomeoAfter the break, Swaroop answers the question, how does iGoat fit into the pen testing process for iOS and Swift-based applications? The Application Security Podcast operates with support from Security Journey. A Security Belt program provides the 3 pillars of successful AppSec training: learning, application, and experience. Visit us on the web at www.securityjourney.com to learn how you can teach and empower your developers using a new kind of security training. What is the correlation between iGoat and WebGoat?

15:10Swaroop YermalkarAlmost everyone have heard of WebGoat. So WebGoat is everyone, they start learning for the web vulnerabilities. So same is iGoat, to learn vulnerabilities in the iGoat. So as I said, I do lots of bug bounties, I do lots of security assessment, and I get case— so I take the case studies from there and I add it in the iGoat so everyone in the security community, they can explore, they can learn the vulnerabilities which, which are often found in the iOS applications. And it not only helps to find, but it also helps to secure. Like, we, we provide the solution in the code itself.

15:47Chris RomeoYeah.

15:48Swaroop YermalkarSo all you have to do is rebuild the project and that particular vulnerability will be fixed.

15:53Chris RomeoSo when I get an iGoat, is an iGoat an app and a web service? Or what is iGoat?

16:00Swaroop YermalkarYeah. So it's a mobile application.

16:02Okay.

16:02Swaroop YermalkarAnd we have the server in the AWS, also in the Docker. So you need to start the server either as a Docker or it's already there in the AWS. So it basically communicates with the server and you can use it on pretty any iDevice like iPhone, iPad, iPod, or your MacBook simulator.

16:22Chris RomeoOkay.

16:22Swaroop YermalkarSo we have made it compatible and you can just start exploring the vulnerabilities there. So they have the— we have the challenges. It's not like just vulnerable application, but it's kind of CTF where you find the values, you enter that, and the application will tell that you are correct or not.

16:40Chris RomeoSo gimme an example then of a challenge that exists in iGOAT, because I mean, I've used WebGoat, I've used Juice Shop, You know, the idea of SQL injection and cross-site scripting in those vulnerable applications is crystal clear to me. Give me an example of one of the challenges that exists in iGoat on the mobile side.

16:59Swaroop YermalkarYeah, so I will take the simplest challenge. Perfect.

17:02Chris RomeoI like simple.

17:02Swaroop YermalkarYeah, so the one challenge is like many developers make mistake to store data, like sensitive data, in the normal plist file. So plist file is supposed to store the configuration and stuff like that, but not the sensitive information.

17:16Chris RomeoOkay.

17:16Swaroop YermalkarSo in iCode, there is a challenge, um, like, uh, it will ask you to find the data in the plist which is already stored and you need to enter in the application. So what the user or the student will have to do is they will have to identify the plist, they will have to identify the data from that, and they will have to enter in the application, and the application will tell that it's, uh, right data or not. Once they find that, there is a method in the code to store the data in the kitchen. So again, they need to uncomment that code and basically rebuild the project. So next time the data will be stored in the kitchen instead of the plist.

17:57Chris RomeoOh, so they fix it?

17:58Swaroop YermalkarYeah.

17:59Chris RomeoSo part of iGoat is not— it's not just breaking and finding the broken pieces, it's actually fixing.

18:04Swaroop YermalkarExactly.

18:05Chris RomeoOkay, that's, that's, that's different than Any of the other, when I think of WebGoat and Juice Shop and even DevSlop, that's different. That's a different approach. And I think that's actually pretty cool to go further than just break it, let's break it and then let's fix it.

18:22Swaroop YermalkarSo we have built for both pentesters and developers.

18:26Chris RomeoGot it.

18:26Swaroop YermalkarBecause I do lots of training and over the time what I understood is developers are very interested to learn security. but they don't have the right platform because they— when they start looking for security solutions, they end up with lots of Stack Overflow, then the different blogs.

18:43Chris RomeoYeah.

18:43Swaroop YermalkarAnd they don't know what exactly to fix that problem. And over the time they will leave because they have already— they are under pressure to implement some functionality or feature. So OWASP Cygode is one platform where they can just use the one single point where they can learn how to attack, and also they will learn how to secure that particular vulnerability.

19:02Chris RomeoOkay, so now give me like a more difficult challenge. Give me an example of something that's— you said that was an easy one. Give me an example of one that's maybe medium or hard.

19:13Swaroop YermalkarSo we have the, let's say, cloud misconfiguration attack. It's basically, we— so we see that nowadays everyone using the S3 buckets for their data, like file storage. And many of the times they are like misconfigured. So this is, I took from one of the case study like in the bug bounty. Like, uh, so one of the application was, uh, having like storing all the user profile images in the S3 bucket.

19:42Chris RomeoOkay.

19:43Swaroop YermalkarAnd that bucket was publicly, that had public access. So in the iGOT, we have developed one challenge, uh, where you, you, you will ask to enter the credit card data. And there's a hint, is like cat image. So if you intercept the traffic, you will see that the data is coming from the S3 bucket. And if you explore that more, like, you will see that you can list all the files from the S3 bucket, and you will have the one file which has the credit card information that you need to enter in the application.

20:13Chris RomeoIs it in your AWS? It's actually in your S3 bucket on AWS? Yes, the file is. Okay, so it's not even in my Docker or anything. It's actually on AWS.

20:21Swaroop YermalkarIt's actually on AWS.

20:23Okay.

20:23Chris RomeoAnd so how— so then how do I— walk me through at a high level without giving people all the answer. Walk me through at a high level, how do you get to that? What are the steps you go through in profiling the app to be able to find this problem?

20:38Swaroop YermalkarDo you mean like what should be the solution or—

20:44Chris RomeoWell, without giving us the exact solution, like what are— like are you finding this in the app by decompiling or disassembling the app and then you're finding a reference to the AWS, and then you're going to the AWS and looking in the bucket and finding the permissions are bad. Is that basically what's happening, or is there more to it?

21:00Swaroop YermalkarYeah, so there are multiple approaches. The one is, as you said, like, we can disassemble that, um, we can just dump all the strings, and there you will find the references to the AWS and also your S3 bucket. And then you can link and find the permission set. That is the one approach. Or if it's like, uh, you can also intercept the traffic using Burp Suite And if it's from S3 bucket, you can observe that the data is coming from S3 bucket. And then also you can use the same thing like to identify if— what are the permission levels and stuff like that.

21:30Okay.

21:30Swaroop YermalkarAnd we also have a very interesting challenge of like encryption key management because— so we say developers that don't store sensitive information locally, right? Because it can be accessible.

21:41Chris RomeoYep.

21:42Swaroop YermalkarBut again, developers ask then what to do. So we suggest them encrypt the data. But again, developer asks where to store the encryption key, right? Because that is also a problem, because if you are storing the key on the device itself, then it's accessible.

21:54Chris RomeoYeah.

21:54Swaroop YermalkarSo in iGOT, we have developed several challenges. Uh, we say that there is no one solution, there could be different scenarios. Like, the one solution, uh, one of the solutions is random key generation.

22:07Chris RomeoOkay.

22:08Swaroop YermalkarSo every time you are storing the data, let's say you need to store something, data, uh, some sensitive data locally. That is the one requirement. You can store it, uh, the— but encryption key will be generated at the runtime. So let's say you're using the iPhone and you have the unique hardware ID, so that will be unique for your own device. So like that, I will take one parameter, other I will take as a timestamp, like, uh, some timestamp, and using that I will create the encryption key. So the thing is, encryption key will be different for each of the devices, each of the users. So I cannot use the same key for decrypting everyone's data. So we are not saying that use the one solution, but in iBot we have developed the different scenarios. So whichever, like the one is like storing the encryption key at the server side. So every time you want to encrypt the data, the key will be fetched from the server and that will be used for the encryption. So it totally depends on like, we cannot say stick with one solution.

23:09Chris RomeoOkay.

23:09Swaroop YermalkarWe have the different scenarios, different requirements. So as per your convenience, you can try out that solution and you can apply to your application.

23:16Okay.

23:18Chris RomeoInteresting. So where do you see iGoat, or what are you going to do with iGoat in the future?

23:22Swaroop YermalkarSo the next goal is like, definitely iGoat is at a definitely good stage. We are also working, planning to automate most of the tasks in iOS security. If you see, there are definitely some challenges with iOS because it keeps changing, unlike Android. Like if you see, there is so much file structure change from iOS 10 to 11. So that is a challenge, but we are planning to automate like many of the tasks which are for the iOS pentesting. Like, so if we can automate most of the things, then that will help the developers or the pentesters to find the issues at the early stages.

23:58Chris RomeoOkay.

23:59Yeah.

23:59Chris RomeoYeah. So, and how often are you adding new challenges?

24:04Swaroop YermalkarSo it's pretty fast. If you say every month we release the new version with at least some bugs fixed or the new challenges. And its team is pretty small and all are the working people, but we try our best to spend time for that project.

24:20Chris RomeoYep.

24:20Swaroop YermalkarAnd we have done like, we recently launched a new website, we have launched the documentation, and we have the supporters or developers from all around the world. So Junard is from Singapore, Anthony is from India, like who are like consistent help me in developing this project. And there are other people like Arun from India who is helping on the documentation and stuff. So, it's a community-based project.

24:49Chris RomeoYeah, this sounds pretty cool and it sounds like it's a nice fit within the existing vulnerable web applications that we have at OWASP. How does iGOAT stack up against Mobile Application Security Verification Standard and Mobile Security Testing Guide? Are they— do they work together?

25:09Swaroop YermalkarYeah. So if you see Mobile Security Standards or OWASP top 10 list, it almost covers all the attacks which are listed. And it's pretty much, we are covering almost all the top 10 list and all the major attack scenarios.

25:28Chris RomeoOkay. So you're staying in sync with all the mobile projects are staying in sync to some degree amongst each other. Okay. Yeah, and it seems like mobile is going to only become more and more prevalent into the future. It seems like, like you said in the beginning, more people, more applications and things are going from server-side with web browser clients on laptops to mobile platforms. Mobile side, yes. So, when you think about like Apple's different devices, like Apple's— they have an Apple Home thing now, don't they? Like a HomePod or something like that? Does that— are those apps in the same setup? Are they the same apps that are like what we're running on our phones?

26:14Swaroop YermalkarSo yeah, if you see, they have the Apple Watch, Apple Home. So it's pretty much same applications which runs on all these devices.

26:24Chris RomeoOkay. So all of the things you're doing from a pen testing perspective apply to all the different devices that are non-laptop or non, you know, host operating system based?

26:36Swaroop YermalkarSo frankly, I have mostly worked with the iPhone, iOS applications, and couple of Apple Watch, but not the other devices.

26:45Chris RomeoOkay. I just, I'm thinking, as I think about those, they're probably, they gotta be on the same problems.

26:50Swaroop YermalkarSame, because they run on the same iOS operating system. And it's pretty much that when we are talking about iOS, the structure will remain same. They will have the local data storage and they will have the keychain and same.

27:01Chris RomeoSo tvOS and watchOS, and I don't even, I don't know what runs on the home devices, but they're all gonna have the same or similar style of problems to what you've already laid out here for the phones.

27:13Swaroop YermalkarDefinitely. If you do security review, we are going to get these fancy bugs.

27:17Chris RomeoYeah, so maybe we should not have all these devices.

27:21Yeah.

27:22Chris RomeoWe know that's never gonna happen, so we have to make them secure, and it sounds like you're on your way down that road of helping to make that happen in the industry. So thank you for your contributions on iGoat, and thanks for taking the time to bring us up to speed on.

27:35Swaroop YermalkarYeah, thanks, Chris, for inviting me.

27:37Thanks for listening to the Application Security Podcast. If you enjoy the podcast, please do us a favor and visit the iTunes Store and give us a 5-star rating. Our intro music is 8-Bit Kung Fu by Born and TJ, and the outro is Southern Delight by Stefan Cartenberg. You can find us on Twitter @appsecpodcast or on the web at www.appsecpodcast.org.