Checking Memory for Sensitive Data (Memory Flag) - hpAndro Vulnerable Application Challenge
🚩 CTF Link : http://ctf.hpandro.raviramesh.info
♚ All application on Playstore: https://play.google.com/store/apps/de...
♛ Consolidate challenges app: https://play.google.com/store/apps/de...
🔊 YouTube Channel: / androidappsec
🟦 Facebook Page: / hpandro1337
🔷Twitter handle : / hpandro1337
Process Memory Flag
==================
https://mobile-security.gitbook.io/mo...
All applications on Android use memory to perform normal computational operations like any regular modern-day computer. It is of no surprise then that at times sensitive operations will be performed within process memory. For this reason, it is important that once the relevant sensitive data has been processed, it should be disposed from process memory as quickly as possible.
The investigation of an application's memory can be done from memory dumps, and from analyzing the memory in real time via a debugger.
Analyzing memory can help developers identify the root causes of several problems, such as application crashes. However, it can also be used to access sensitive data. This section describes how to check for data disclosure via process memory.
First identify sensitive information that is stored in memory. Sensitive assets have likely been loaded into memory at some point. The objective is to verify that this information is exposed as briefly as possible.
To investigate an application's memory, you must first create a memory dump. You can also analyze the memory in real-time, e.g., via a debugger. Regardless of your approach, memory dumping is a very error-prone process in terms of verification because each dump contains the output of executed functions. You may miss executing critical scenarios. In addition, overlooking data during analysis is probable unless you know the data's footprint (either the exact value or the data format). For example, if the app encrypts with a randomly generated symmetric key, you likely won't be able to spot it in memory unless you can recognize the key's value in another context.
Therefore, you are better off starting with static analysis.