• smali/baksmali http://code.google.com/p/smali/ • dex2jar http://code.google.com/p/dex2jar/ • jd-gui http://java.decompiler.free.fr/?q=jdgui • apkanalyser https://github.com/sonyericssondev
<map> <boolean name=”welcome_screen_viewed ” value=”true” /> <string name=”msisdn”>09999996666</string> <boolean name=”user_notified” value=”true” /> <boolean name=”activated ” value=”true” /> <string name=”guid” value=”” /> <boolean name=”passcode_set” value=”true” /> <int name=”version_code” value=”202″ /> </map>
An attacker with root access to the device can obtain the GUID and phone number from the unencrypted XML configuration file; but without the clear-text or encrypted passcode, mobile banking web services cannot be accessed. We have discovered a way to “unlock” the application using the Android framework to start the AccountsFragmentActivity activity, but if the web session has already expired, the app limits the attacker to a read-only access. The most profitable path for the attacker at this point is the running process memory dump, as we explain in the next section.
5.2 Memory dump analysis.
