Windows Mobile Application Security Testing - Part 4

Before I start this part of article I want to thanks all of you who have appreciated me for this series. I’m very excited to continue writing on WP8 application security testing.

Previous article we learned setup proxy with device and perform dynamic analysis on the WP8 Applications. In this article we are going to learn analysis of Isolated storage or local file system using Windows power tool.

In case you haven't rooted your device and wants to analysis dynamically local storage of the application, then this article will help you to check local storage of the application. You can able to check local storage or isolated storage for only developer signed apps using Unlocked device. If you haven't Unlocked your device yet then I recommend you to unlock your device using my part 1 article. 

So next we need one developer signed application for our demo purpose right. In my previous article I mention found youtube developer signed app from XDA forum. You can also download this application for your learning purpose from here.

Isolated storage

Isolated storage is used to store local data on a Windows Phone. It is "isolated" because other applications can't access this data.

All I/O operations are restricted to isolated storage and do not have direct access to the underlying OS file system, which helps to provide security and prevents unauthorized access and data corruption from other apps. If you want to share data between two applications, you will need some kind of cloud-based service that can share that data for you.

Microsoft has provided two way to store data locally for their developers. The first way is to collection of name/value pairs call IsolatedStorageSetting and other way is through the creation of actual files and folders called IsolatedStorageFile. We will check this later while doing static or reverse engineering analysis.

Windows Phone power Tool

As in my previous article I already written about Windows Phone Power Tool which is powerful tool to deploy WP8 Applications (Only developer signed App) and analysis isolated storage in device. We will use this tool for analysis dynamically storing data into device. If you want to install Windows Phone Power Tool please read my previous blog post.

Fig. 1 WP Power Tool

Let deploy the Youtube application into device using WP power tool

Fig 2. Deploy Application

You can see the information about the application in Dev Apps

Fig 3. Application Information

Now we’ll going to inspect isolated storage. As you can see there is no data found at this time.

Fig 4. Isolated Storage

Lets use the application by exploring application functionality and save some data. You can also login into application using google account.

Fig 5. Youtube login form.

After using the application you can refresh the app in WP Power tool by right click on application. Now you can see there are bunch of data available for inspection.

Fig 6. Isolated Storage Data

Isolated Storage Explorer

This is one more tool which can help you to explore or modify dynamically storing data into device (isolated storage). You can download and install from here.

Fig 7. IsoStore Spy App.

Isolated Storage Explorer (ISETool.exe)

Isolated Storage Explorer (ISETool.exe) is a command-line tool that is installed with the Windows Phone SDK. ISETool provide you to explore list of Isolated Storage or you can copy and replace the files into directories of the application.

This tool you can find from the following path.

C:\Program Files (x86)\Microsoft SDKs\Windows Phone\v8.0\Tools\IsolatedStorageExplor

Fig 8. ISETool 

ISETool.exe <cmd[:param]> <target-device[:param]> <product-id> [<desktop-path>]

<cmd[:param]> - Specifies the command to be executed (one of the following)
 ts -(takesnapshot) to download the contents of isolated store from <target-device> to desktop
    rs -(restoresnapshot) to upload the contents of isolated store from desktop to <target-device>
    dir - lists the contents of the device folder.
    EnumerateDevices  - lists the valid device targets along with their device indices.

<target-device[:param]> - Specifies the target device (one of the following)
    xd - default emulator
    de - Windows Phone device connected to the desktop
    deviceindex:n - device listed at index n. To get the list of devices use the following command
                    "ISETool EnumerateDevices"

<product-id> - Specifies the GUID of the product. This is located in
                 WMAppManifest.xml file of the project

<desktop-path> - desktop path for download and upload

To get the list of devices use the following command

ISETool EnumerateDevices

Fig 9. To get the list of Devices

If you want to get application Product ID or GUID of the product which is located in WMAppManifest.xml. In order to get manifest file you have change application extension .xap to .zip and extract the file. (Only this is for developer signed applications)

Fig 10. Application ProductID

Now lists the Application contents of the device folder.

C:\Program Files (x86)\Microsoft SDKs\Windows Phone\v8.0\Tools\IsolatedStorageExplorerTool\ISETool.exe dir de dcbb1ac6-a89a-df11-a490-00237de2db9e

Fig 11. List of file and Directory

Now to download the contents of isolated store from device to desktop.

C:\Program Files (x86)\Microsoft SDKs\Windows Phone\v8.0\Tools\IsolatedStorageExplorerTool

λ ISETool.exe ts de dcbb1ac6-a89a-df11-a490-00237de2db9e G:\test\

Fig 12. Exact contents of isolated Storage

Fig 13. Download File and Folder

Now you can inspect all the file and folder manually. Later we will learn more about the individual files and their functionality.

Conclusion :

In this article we learned about Isolated Storage, tools and technique to inspect isolated files and folders. You can analysis the data of application and how/which data storing inside isolated storage. Later will learn more about the file and their functionality in terms of security.

Read More →

Windows Mobile Application Security Testing - Part 2

Previous article we learned about the windows phone 8 security basics and their features. In this article we’ll going to learn about windows phone 8 applications and sideloading developer signed app in device.

About XAP Files

XAP is the file format used to distribute and install application software and middleware onto Microsoft's Windows Phone 7/8 operating system, and is the file format for Silverlight applications. Beginning with Windows Phone 8.1, XAP will be replaced by APPX as the file format used to install apps on the Windows Phone platform, a move which was done by Microsoft in order to unify the app development platforms for Windows Store apps and Windows Phone apps.

XAP files are ZIP file formatted packages. The MIME type associated with XAP files is application/x-silverlight-app.

Fig 1. Unzipped XAP file 

If you downloaded app from store and wants to unzip then you can’t able to do so. It's because microsoft signed every app with DRM encryption. However if the app is developer signed then you can easily unzip the XAP file.

Encrypted and Unencrypted XAP file

The difference between a XAP file from the app store and an unencrypted XAP can be inspected by opening the XAP file headers in text editor. A limitation of encrypted XAP files downloaded from the app store is that they cannot run in emulators. When conducting penetration tests of a windows Phone application using emulators it's is required to obtain the XAP files of the application compiled by the developer, not from the Windows Store.

Fig 2. Encrypted XAP file

               '

       

Fig 3. Unencrypted XAP file

After some google search I found Youtube XAP unencrypted XAP file from xda-developers forum which help us to understand the Encrypted and Unencrypted applications and difference between them.

Sideloading developer signed app

If you want to perform security testing on your client applications in un-rooted devices then you have to ask them for their developer signed app and by sideloading the App you can able to perform dynamic as well as static analysis.

If you downloaded or installed app from store you will only able to perform dynamic analysis on the app. To perform analysis into internal file system (Isolated storage only) you need to get the developer signed app. Later blog post we will learn inspection of isolated storage.

You can sideload your developer signed app using Application Deployment app which will installed in your system while installing SDK.

Search in your system for “Application Deployment” and open the application. In case you would not found the app then you can use the system path C:\Program Files (x86)\Microsoft SDKs\Windows Phone\v8.0\Tools\XAP Deployment located, where you can run XapDeploy.exe .

Fig 4. Application Deployment App

You can use any developer signed app and sideload app in your device using this application.

Windows Power Tool.

Windows power tool is very useful while doing pentesting on WP8 application. It is developed for the developers to deploy application, testing the app, check isolated storage and other useful functions. You can download this application from codeplex.

However many time I face below error while installing Windows Power tool, may you can also face the same issue.

Fig 5. Windows Power Tool Error 

So it's better to install offline file which you can find from XDA Developer forum. Download the WPPowerToolsStandaloneAmir.zip file and extract the file.

Now run the WindowsPhonePowerTools.exe file.

Fig 6. Windows Power Tool

In order to connect your device with windows power tool you have to unlock your screen and then click on Connect.

After you have successfully connected with windows power tool you can able to install your developer XAPs file and other useful task able to perform for analysis the application.

Fig 7. Windows Power tool feature.

Deploy XAPs easily with WPV Xap Deployer

Project My Screen App

Microsoft has developed application for users to project phone screen to an external display which can using USB cable and connect with system to project phone display on systems.

This app is useful for us while doing pentesting on Windows mobile application to get the display on our system.

You can download application from Microsoft site Project My Screen App

Fig 8. Project My screen Application.

Conclusion :

In this article we understanding of how WP8 applications are packaged and distributed. Also we now know the sideloding developer signed app into device. Next article will learn how will do dynamic analysis on WP8 application using Device.

Read More →