Proj 5x: Bank of America Code Modification (25 pts)

What You Need for This Project

• An unrooted Bluestacks Android emulator or a real Android device to test the app on (a rooted emulator like Genymotion will NOT work)
• Android Debug Bridge running on Kali, connected to Bluestacks
• You should have that already set up from previous projects

Purpose

Responsible Disclosure

Installing the App

Archived Copy If they update the app, and you want the instructions below to work exactly as written, use this archived copy.

Pulling the APK File from the Phone

adb shell pm list packages bof
adb shell pm path com.infonow.bofa
adb pull /data/app/com.infonow.bofa-1.apk

Decompiling the Android App

apktool d -f -r com.infonow.bofa-1.apk

Finding the PIN Input Module

grep setAtmPin -r .

On your Kali machine, execute this command:

nano ./com.infonow.bofa-1/smali_classes5/com/bofa/ecom/servicelayer/model/MDAUserVerificationDetails.smali

Enter the search string setAtmPin as shown below.

Press Enter to perform the search.

The routine that gathers the user's ATM card PIN appears, as shown below.

Adding Trojan Code

Type Ctrl+X, Y, Enter to save the file.

Repacking the App

apktool b com.infonow.bofa-1

Troubleshooting If apktool returns errors, as shown below: I think this error comes from a Java version conflict. The simplest fix I found is to just extract a fresh Kali 2019.1 64-bit VM and use it instead of a machine that has been used for other projects. Use the apktool that comes with Kali, and add adb with these commands: apt update apt install android-tools-adb -y If you get a "E: Could not get lock /var/lib/dpkg/lock-frontend" error, restart Kali.

Making a Code Signing Certificate

Execute this command:

keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000

Then a series of question asks for your name, etc. You can press Enter for each question except the last one, which you must answer yes to, as shown below.

Signing the APK

jarsigner -sigalg SHA1withRSA \
-digestalg SHA1 -keystore my-release-key.keystore \
com.infonow.bofa-1/dist/com.infonow.bofa-1.apk alias_name

The app is signed, as shown below.

Uninstalling the Original App

• Apps & notifications
• Bank of America
• Uninstall
• OK

Installing the Modified App

adb install com.infonow.bofa-1/dist/com.infonow.bofa-1.apk

Monitoring the Log

adb logcat | grep TROJ

Entering a PIN

• At the lower left, click Home (the icon shaped like an envelope)
• At the lower center, click the circular icon with six dots.
• Click BofA. The phone turns sideways and the print becomes tiny.
• At the bottom, click Accept
• At the bottom, click "Sign in or enroll"
• In the center, click Enroll
• At the bottom, click "GET STARTED"
• At the top, click "ATM or Debit Card"
• Enter data into the fields, as shown below. Remember what you put in as a PIN; I used 2222
• At the bottom, click CONTINUE

The PIN appears in the log, as shown below.

Saving a Screen Image (15 pts)

Save a full-desktop image. On a Mac, press Shift+Commmand+3. On a PC, press Shift+PrntScrn and paste into Paint.

YOU MUST SUBMIT A FULL-SCREEN IMAGE FOR FULL CREDIT!

Save the image with the filename "YOUR NAME Proj 5xa", replacing "YOUR NAME" with your real name.

Challenge: Steal SSN (10 pts)

Capture an image of the log including a SSN, as shown above.

Turning in your Project