New vulnerability in Android allows any app to receive devices private network information (such as IP and MAC addresses) without any special permissions

Recently, while developing network utilities for Android, I’ve stumbled upon an interesting vulnerability. 

I wanted to retrieve network information from my Android device and others devices on my local network, such as IP, MAC address and device’s vendor name, and so I started to experiment with the different API Android supply in order to receive such information.

Since it’s been a few years since the last time I developed an application in Android, I noticed a lot of API hardening was done in order to protect users' location from being tracked and traced by 3^rd party applications, without the users’ knowledge. One of these protections is implemented in the WifiManager API, which “provides the primary API for managing all aspects of Wi-Fi connectivity” (from Android API documentation).

Starting from Android 6.0 (API level 23), Android removed all access to the device’s local hardware identifier (such as the WIFI and Bluetooth MAC address, which can be used for location tracking) and when an app is trying to retrieve it, it will get a constant “02:00:00:00:00:00” MAC address. In addition, an app can try to retrieve the BSSID and SSID of scanned WIFI networks only if permission to “ACCESS_FINE_LOCATION”, as well as other WIFI and network permissions are granted to the app explicitly by the user.

The vulnerabilities I found, allowed me to bypass all of those restrictions and retrieve both the device’s WIFI network information (including its local IP and MAC address) and neighbor devices’ information on the same network, without any permissions declared on my app’s manifest file.

In addition, with only internet permission granted (which is a normal permission that doesn’t require any explicit run-time permission request from the user) I could further expand my app to be a fully-fledged network scanner (similar to the well-known “Nmap”) in order to discover, communicate and even try to attack other network devices on my local network, such as over computers, routers and IoT devices. These functionalities are not possible to obtain by an app without a set of permissions, some of them declared as “dangerous” by Android OS.

The vulnerabilities which allowed me to do most of these action were found on some of the Linux command-line programs, which are located in most Linux distributions in the “/bin” path. Android OS includes some of these Linux programs under its “/system/bin” path, but access to them is restricted without special or root access. Trying to interact with them from within an Android app, usually ends up with “operation not permitted” errors coming from the network layer and printed to the device’s stderr and stdout, without the needed permissions.
Through some command-line binaries (and many of their different options) though, this information can be accessed from within an Android app without any errors thrown. While combining several methods and then parsing their output from the Android's application layer, I could successfully build my network scanner without any special or dangerous permissions being explicitly asked for from the user.

I forwarded all of my findings to the Android security team, they acknowledged and after further investigation by them, it was found that this issue was already reported by an internal Google engineer. They mentioned that “the fix for this issue is targeted for release with the next major version of Android”.

Although I couldn’t personally test this assumption, I believe this vulnerability targets a large amount of different devices from different vendors, running different Android versions, including the latest Android version (10).

My personal tests included Android emulators running Android 5, 6, 7 and 10 stock versions as well as a test made on a Samsung Galaxy S8 device running Android 9 and (as for now – the latest) April security patch level.

Get Geolocation coordinates from WIFI access point in Windows

In the today's mobile platforms, getting geo location coordinates and draw them on a map is super easy, you just use one of the many native API given to you by the Android or iOS, whether it's using GPS, cellular or WIFI data to get the current location of the device.

On Windows however, it's harder to get any good alternative, so I've come up with this tool.
It retrieves coordinates (altitude and latitude) on Windows natively using C++ by scanning WIFI access points.

The scanner will scan every Wireless LAN interfaces plugged in to your Windows machine, enumerate all the available AP found in nearby, then gather all the BSSID interfaces it find together.

With that data, it's then possible to use one of the many WIFI geolocation API (Google, Unwiredlabs, Combain, Mylnikov and others), which will give you the coordinates of your location based on the list of BSSIDs the tool gathered.

The location retrieved will then be shown on Google Maps. 

https://github.com/agentzex/windows_wifi_geo_locator

Scan devices on your network with Windows natively

I couldn't find any decent solution for a lightweight LAN network discovery tool running from a Windows machine with WinAPI, so I decided to create one, using C++.

This tool can discover other devices on your network automaticlly, based on info gathered from all of the installed network cards on your Windows machine. Then, it uses them to send multi-threaded ARP requests and discover which IPs are responding.
It also prints the machine name if available.

Since the data is stored in JSON objects, it's also very easy to forward it to a remote server.

https://github.com/agentzex/windows_network_ip_scanner

How to run MicroPython on ESP8266 HUZZAH Feather and run code on startup (Complete tutorial)

I've been playing a bit with ESP8266 and related family of microchips lately, and since I love Python, what could be better than to have a fun intro into the embedded world, while trying to run it on the chip. However it turned out to be a bit more difficult than your usual 'I'll have code running in 1 hour' which usually works for me with new Python projects.

I stumbled in quite a few problem trying to flash the MicroPython build into it, and then to make it run python program on boot automatically, so I'll go over the steps here for anyone trying to do the same:

I started with downloading the driver for Windows (my host OS is Windows, I did try to connect it to a Ubuntu VM since most of the examples I saw were on Linux machines, but it wasn't detected for some reason, so I'll show you how I did it on Windows).

First download the driver from here:

https://www.silabs.com/products/development-tools/software/usb-to-uart-bridge-vcp-drivers

I downloaded version 6.7 for my Windows 10-64 bit machine (since the newer ones didn't work for me) and installed it. Now if you like me, when trying to plug the chip to the USB input of your machine and open windows device manager, you'll get a little yellow triangle with exclamation mark stating the driver is not detected (so I guessed I needs to be manually installed).Instead, it appeared as "CP210x USB to UART Bridge", now what you really want is for it to appear with some COM port at the end of the name, and under Ports section, so you can processed with the flashing ( for me it was "CP210x USB to UART Bridge(COM3)" ).  

In order to do that, right click on the undetected driver --> update driver --> Browse my computer for driver software --> Let me pick from a list of available drivers on my computer --> now you should have a list of manufacturers on the left, click on Silicon Laboratories. Then on the right windows click on "Silicon Labs CP210x USB to UART Bridge) --> click next and you’re done.

Now on the device manager, the device should appear under "Ports (COM & LPT)". Write down the COM port number because we'll use it next.

We're now ready to download MicroPython and flash it on the device! Open http://micropython.org/download and look for ESP8266, if you don’t know what to download then you should probably download the latest build bin.

Next, we'll need some tool in order to flash it to our device, so "pip install esptool" (some guides says this tool only works with python2 but I guess they're old, since I installed it with my Python3.7 and it worked). This will install esptool.py.exe on your python Scripts path. If you have it on your enviroment path you're good to go, otherwise, cd to your Scripts directory.

Run: (change to your COM port number you wrote earlier, if you have different one on your machine)

"esptool.py.exe --port COM3 erase_flash"

"esptool.py.exe --port COM3 --baud 460800 write_flash --flash_size=detect 0 esp8266-20190529-v1.11.bin" (change according to your MicroPython version)

If you've done all the steps correctly, you now have MicroPython flashed on your ESP8266, you can connect to it using some Serial connection client (I'm using MobaXterm), don't forget to choose the right serial port, Speed(bps) should be 115200 , if it doesn’t work try other value.

Great! Now you can try to play with MicroPython on your ESP8266 a bit, if you're coming from normal Python like me, you'll notice a lot of default libs are missing so you'll need to read the docs and understand what you can and can't use. 

There are also other libs relevant to this chip (for instance, with network lib you can connect the chip to WIFI).

But, without a way to run your program on the device startup, it doesn't really worth much, so in order to do that, we'll need another tool: "pip install adafruit-ampy" ,after it has finished installing, we can use the "ampy" tool to put our program on the device to run on boot.

Run: "ampy –port COM3 put 'your_python_program.py' /main.py". The file that is copied into the chip has to be called "main.py". Make sure to disconnect any serial console you have connected to the chip before running this command. It doesn't work if the device is busy!

If no errors appear, the file was copied to the device successfully, now after you disconnect then reconnect your device to the USB input, your script should run.

Here's a little script I wrote, which sends an HTTP GET command to a local Python HTTP server (with flask) I have running on a different machine in my network.

See you next time !