AntiTaintDroid (a.k.a. ScrubDroid)- Escaping Taint Analysis (and stealing private information) on Android for Fun and Profit

UPDATE:  source code published on Github [2, 5]

Good news Everyone! I wrote an app that bypasses TaintDroid's [1] privacy monitoring features (Taint analysis) in more than a few ways. I will share the app on my GitHub [2] account very soon. Currently the app is capable of collecting private information such as Android device ID, Google account ID, network ID, IMEI etc. and send it to a pre-configured server (of course without raising any TaintDroid alert). If anyone is interested while I fine-tune my app (add support for reconfigurable server among other small things), please drop me a line in the comments. I would be happy to share how and what I have done.

To know more about how TaintDroid and Taint analysis works, please read their publications here [2]. If you Google for TaintDroid, you will also find a fair amount of information on what it is and how it works. Thanks for reading my Blog. I will update this post as soon as the next bit is ready.

[1] http://appanalysis.org/
[2] https://github.com/gsbabil
[3] http://appanalysis.org/pubs.html
[4] http://www.google.com.au/search?q=TaintDroid
[5] http://gsbabil.github.io/AntiTaintDroid/

Android emulator gives "SDL init failure" error on Ubuntu/Linux

If you are getting the following error:

SDL init failure, reason is: No available video device

from Android emulator on a Unix/Linux platform, this typically indicates your shell's DISPLAY variable is not pointing to the correct X11 Display. Try launching the Android emulator as shown below. You may add your own parameters as needed as long the DISPLAY=:0 is there.

DISPLAY=:0 emulator -kernel your_zImage -system your_system.img -ramdisk your_ramdisk.img -sdcard your_sdcard.img

Disable New Tab Page in Firefox 13

Firefox 13 introduced something called "New Tab Page" which shows a history of 9 most visited pages in a tile interface, much like the way Google Chrome does. Actually it looks like the picture below:

But, there are two problems with it. First, if you don't want your browsing history to be shoulder-surfed (someone looking at your browser over your shoulder), this is not a good thing. Second, it actually makes the new tab open a slighter slower than before for which the reason must be obvious.

Anyway, since there's no point-and-click kind of configuration options anywhere in Firefox 13 to turn this feature off, we need to edit Firefox's hidden global configuration settings. This settings interface can be reached by typing "about:config" in the address bar and pressing enter. It will show you a plethora of Firefox's internal options. Most of these options are explained in "Mozilla Knowledge Base". In order to turn off the new tab page, the two relevant options are:

1. browser.newtab.url
2. browser.newtabpage.enabled

You can quickly locate these two by typing "newtab" in the search bar. As the name suggests, the first option is set to "about:newtab" as default which is the page that displays the 9 most visited page links in tiled interface. We can set it to "about:blank" to force disable the new tab page feature. The second option is better is setting it to "false" (by right clicking and selecting "Toggle" from the menu) will disable new tab. Next time we click the plus icon in the tab-bar or press Ctrl+T, Firefox will open new tab page without the tiled history links. Cheers!

Ubuntu 12.04 – How to use VNC even at the login prompt

I have a partially headless desktop machine on my desk only connected with a monitor. I typically use this machine for heavy duty computation or simulation. The machine is more than decent hardware wise. But I have a decent enough laptop where I like to keep all my day to day stuffs. Given the scenario, if I should ever have to use keyboard and mouse on the desktop machine, I would typically use Synergy to control the desktop using the keyboard and mouse from my laptop. Since the desktop has a much larger screen, it is quite convenient that way for many specific things. The desktop runs a SSH server. So, I can login over SSH and start the Synergy client which would connect back to the Synergy server running on my laptop. The setup is actually quite handy.

Now, there’s a catch. The problem is that synergy refuses to bind to the keyboard and mouse on the desktop machine due to missing X authentication credentials at the login prompt. Since at the login prompt, the user (me@desktop) hasn’t logged in yet. So, he (me@desktop) doesn’t have a proper X credential yet. Apparently, there is no easy way to pass the custom MIT-MAGIC-COOKIE to synergy. Therefore, I decided to fall back to VNC, which is also occasionally useful when I am working remotely.

Ubuntu 12.04 Precise Pangolin (I think 11.10 too) comes with LightDM as the login and display manager. Therefore, the desktop environments such as GNOME, KDE or LXDE would be started by LightDM only after the login has been successful. As mentioned before, Synergy can’t work in this phase because the X server authentication credentials from LightDM can not be passed easily. Therefore, to type in the password at LightDM login prompt, I use x11vnc. On Ubuntu, a quick “apt-get install x11vnc” will install it. The reason I like it a lot is mostly because it can be used like a regular console utility to start-up the VNC service. For example, I could just do “x11vnc –display :0” to quickly setup a VNC session over SSH and then login remotely over VNC. The additional benefit would be that VNC will be passed thru SSH (by means of SSH port forwarding), it will be way more secure than just plain VNC. So, coming back to where we were - to start x11vnc at the login prompt, a typical “x11vnc –display :0” wouldn’t work. Because the X server will refuse authentication as we need the authentication credentials for the LightDM service which is started as “root”. x11vnc provides an “-auth auto” option. But, it will also mostly likely fail because the “.Xauthority” file wouldn’t be found.

To get around this, we need to locate the right “.Xauthority” file where the MIT-MAGIC-COOKIE is saved. After some snooping around on my file-system, it appears that the LightDM service stores it’s files in “/var/lib/lightdm” directory. Great! now if we just do a “sudo x11vnc –display :0 –auth /var/lib/lightdm/.Xauthority” x11vnc will run in the login prompt and we will be able to use VNC even after login .

So, to recap, the steps are:

• apt-get install x11vnc openssh-server
• Reboot the machine (or log-out). In my case it’s my desktop.
• ssh user@desktop. I would do it from my laptop.
• sudo x11vnc –display :0 –auth /var/lib/lightdm/.Xauthority
• Now, from my laptop I can use any VNC viewer to connect my desktop even in the login prompt.

Recovering from repeated crash at Firefox (11 Beta 7) start-up

Quick Solution
 

Delete

• session.js
• sessionstore.bak
• files inside sessions folder

from inside your Firefox profile directory. Follow this page to find out where you profile directory is located.

How I found what caused the crash

 

After quite few "unresponsive script" error inside Firebug 1.9.1 (mostly on LifeHacker.com and Boston.com) and repeatedly selecting "Stop Script" with no apparent benefit, I chose to kill Firefox from Windows Task Manager [1]. For those who don't know that it is - try pressing "CTRL+Shift+Esc" on your keyboard or just right-click on your task-bar and select "Start Task Manager". It looks like this:

I didn't realize the fun is just about to begin. To my surprise, upon the next restart Firefox started as usual and but quickly crashed. It kept happening much like flashing the Firefox's main window for a second or two and boom, it crashed! This behavior was already a good indication that it might be caused by a corrupted file, most probably a SQLite [2] database and this must have happened due to my killing Firefox forcefully using the Windows Task Manager. So, I started to digging around for a resolution.

First, I tried to start Firefox in "Safe Mode" with all add-ons disabled as suggested here [3] with "-safe-mode" flag. It didn't work! From my all previous experience, Firefox's safe-mode always seemed the best way to solve crash related problems, buggy extensions and add-ons. But, in this case it kept crashing even in safe-mode.

Then, I tried to open Firefox in "Private Browsing" mode with the "-private" flag. On Windows 7 (I guess on Vista too), this can be done with right-clicking the Firefox task-bar icon and selecting "Enter Private Browsing". Interestingly, Firefox was able to start in this so-called incognito mode! This was another strong hint that some files must be corrupted in my "Firefox Profile Folder" [4].

To try the theory, I closed all running instances of Firefox and I renamed Firefox's "profiles.ini" [5] to "profiles.ini.bak" to force Firefox into creating a fresh new profile. I started Firefox and it successfully created a new profile in my "%APPDATA%\Mozilla\Firefox" directory. The new profile directory was named "an9pz0cj.default".  By the way, if you are like me and you love your Firefox's plethora of customized settings and very longs list (77 in my case) of plugins only to profoundly avoid reinstalling them, don't forget to regularly backup your profile directory. My default previous profile directory was called "yn0z15ze.default" and I backed it up in a RAR archive.  After generating a fresh profile, which also generated a new profiles.ini, I copied all files (not folders, I decided to try them in the second iteration) from "an9pz0cj.default" and pasted them in "yn0z15ze.default". Windows 7's copy and paste is great. It kept showing me all the conflicts due to size, date-time of source and destination files. I kept the list of the files where the file-size was different. In my case, the list looked like the following:

• cert8.db - SSL certificates are stored here.
• chromeappsstore.sqlite -- HTML5 local data store.
• content-perfs.sqlite -- Individual settings for pages.
• permissions.sqlite -- Permission database for cookies, pop-up blocking, image loading and add-ons installation.
• search.sqlite -- Information about search plugins
• sessionstore.bak -- saved sessions.
• sessionstore.js -- saved previous session
• signons.sqlite -- Encrypted saved passwords
• TestPilot.log --  Log file.
• webappsstore.sqlite -- DOM local storage.

I Google'd up on the name of the files and got a rough idea of what they are meant for and how they are used inside Firefox. So, at this point I my preferred profile "yn0z15ze" is working but with some default files which means I must have lost some data, may be some customizations too as the list contains cert8.db, search.sqlite and signons.sqlite etc.

Now comes the final part - I have to test each of the files above one by one and figure out which one was causing the crash. As you may have gotten the idea already - I love my Firefox and my customizations. So, I wanted to make sure that I lose minimum amount of data due to the crash.

So, I renamed my previously moved "profiles.ini.bak" to "profiles.ini". By the way, profile.ini looks like below:

[General]
StartWithLastProfile=1

[Profile0]
Name=default
IsRelative=1
Path=Profiles/an9pz0cj.default
Default=1

So, I could have just replaced "an9pz0cj" with "yn0z15ze" and saved profile.ini to achieve switching between profiles. Anyways, I did that anyhow and started copying files as shown on the bulletted list above from  "yn0z15ze" RAR archive to now running "yn0z15ze" with some fresh files of "an9pz0cj". I kept restarting Firefox each time to check if Firefox is crashing. After a few iterations of stopping Firefox, copying fresh files into "yn0z15ze" and restarting, I stopped at "sessionstore.js". I copied this file and Firefox crashed!

Wow, so now I know which file was causing my Firefox to crash! Also, now that I know this file only contains a list of my tabs which I was browsing before the very initial task-manager kill, I can safely disregard this file now ;). Phew, so the case is solved. If you happen to come across a situation like mine, try deleting the "session.js" and/or "sessionstore.bak" and/or files inside "sessions" folder. It's weird that even in Firefox's safe-mode the problem managed to persist. Time for a bug report I guess :). Hope you find it useful.

[1] http://en.wikipedia.org/wiki/Windows_Task_Manager
[2] http://en.wikipedia.org/wiki/Sqlite
[3] http://kb.mozillazine.org/Safe_Mode
[4] http://kb.mozillazine.org/Profile_folder_-_Firefox
[5] http://kb.mozillazine.org/Profiles.ini_file