How to Hack & Protect Flutter Apps — Simple and Actionable Guide (Pt. 1/3)
PreviousBuild secure apps in React NativeNextHow to Hack & Protect Flutter Apps — OWASP MAS and RASP. (Pt. 2/3)
Last updated
Last updated
Either you want to hack Flutter apps, or you want to make them bulletproof. I will show you how it’s done. My name is Tomáš Soukal, and I am a security consultant at Talsec. This guide is unique in its focus on Flutter apps, so you don’t have to read through iOS or Android-only specific hacks over and over again.
Part 1 (this article) ↓
Disassemble app.
Extract its secrets.
Part 2 (link) ↓
Make a fake clone.
Check every transmitted JSON.
Inject code.
Part 3 (link) ↓
Steal authentication tokens.
and attack the API.
After reading this short guide, you will know how to hack and how to protect against mobile threats.
Disclaimer: Don’t do this to anyone with ill intent, as this is legit hacking. Use this only for learning purposes.
Back in the day, I had an opportunity to interview a friend of mine whose app was hacked. He created a popular app called BetterVision for the blind and visually impaired. There was a good reason for the over 100K installations John’s creation has achieved. BetterVision provided a ground-breaking feature. It could turn a phone’s camera into a powerful assistant easing a daily routine for disabled users worldwide. With success, however, soon came difficulties. John’s app suffered a cloning attack, and his In-App purchases got stolen. Profits are now four times smaller because of cracked versions being still available. The attacker replaced In-App payments code with his payment gate!
“They stole our apps by reverse engineering and republished.” Hacking and protection go hand in hand. I have seen dozens of questions on StackOverflow about mobile application security. Some people ask for remediation only after their app is hacked, and others take security in mind from the start. I collected a few of those posts:
Let’s examine what do hackers use.
These are key tools you should know about. Hacking is a time-restricted activity. With proper tooling you will be able to dive deep into app’s internals in a no time. Time is money.
Magisk or su allows you to modify app’s internal files
Frida gives me a relatively simple way to sniff into the app’s process during its run. I can modify return values and inspect processed data
ApkTool can disassemble app, and then I can modify the app and assemble it again
Mobile Security Framework (MobSF) is Swiss knife with many analysis, reconnaissance, and disassembling tools. (must have!)
Lucky Patcher can repackage and mitigate common protections directly on device
Runtime Mobile Security is IDE for Frida with many useful scripts and monitors
Ghidra or IDA PRO can create a readable code from app’s binary libs and modify the assembler
reFlutter is the first Flutter-oriented reverse engineering tool necessary for MiTM attacks and binary inspection
BurpSuite's Interceptor mode to capture app’s network requests (typically JSON’s and raw data)
It’s nice to have a rooted emulator with a feature-rich Total Commander file manager and Termux terminal on board.
MobSF is an automated, all-in-one mobile application (Android/iOS) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Run these three commands to install it, drag’n’drop any Flutter APK and watch the magic happen:
Note: don’t run random code found on the Internet. Check the original source and verify it’s safe to run.
Alternatively, you can run it in Docker or check this online mobsf.live site (be careful, scan results are public!)
MobSF can do compliance checks, search for secrets, embedded URLs and find common issues automatically. It can also help you to uncover vulnerable modules (3rd party libs) and unsecured entrypoints (receivers, deep links).
Let’s proceed with some exciting stuff. I always imagine app’s stored data as a chest full of precious gold. Once the app lands on your rooted device (or enable Developer Settings), you can freely inspects it’s embedded data and assets. You will find databases, access tokens, API keys, bearer tokens, media assets, Shared Preferences. Shared Preferences files are particularly interesting as they are often misused to store sensitive data like login credentials.
Let’t check this example. I created demo app using standard shared_preferences plugin. The app just increases the counter with value preserved in the Shared Preferences.
Let’s open Total Commander.
In the Total Commander, I can see the XML file with this preference:
Here it is:
I can even modify this value and the app will immediately update (thanks, Flutter) the value in the UI! I hope you are at least a little worried about sensitive data in your shared preferences now. Before I will show you more (in the next part), let’s discuss the rooting issue.
FYI, Talsec provides technologies like Secure Storage or Obfuscation to make attacker’s life harder ;)!
Some developers refuse to believe there are vulnerable mobile systems (in 2022). They are convinced that the Android/iOS sandboxing model and security practices are decent nowadays. They may be wrong.
Privileged access rights escalation breaching system security model is still possible in many scenarios. Check these vulnerable systems:
Device or emulator can be rooted on purpose
App may be jeopardized by a 3rd party dependency
New OS exploits may be discovered / OS may be unpatched
HW exploits
Have you heard about Dirty Cow, Log4j, and Janus vulnerabilities?
I promised this guide to be actionable, so here is the table of most common attacks and possible remediations. The rooting attack which can help attacker to steal sensitive data (and more) can be prevented by usage of the right anti-root or RASP solution (premium: Talsec RASP, free: freeRASP, basic: flutter_jailbreak_detection). You will see more attacks in action in the next part :)
Subscribe Talsec and maybe try to crack-open some Flutter app in the meantime!
written by Tomáš Soukal, Security Consultant at Talsec
