BSidesSF 2018 - Keep it Like a Secret: When Android Apps Contain Private Keys (Will Dormann)

### Overview In this BSidesSF 2018 presentation, Will Dormann from CERT/CC details his research into Android applications that inadvertently bundle private keys. Inspired by a security researcher's tweet noting a Cisco app distributing a private key, Dormann set out to systematically analyze Android applications on a large scale. Expanding on earlier 2014 research where he gathered approximately 1 million apps to inspect SSL certificate validation, he developed an automated pipeline that downloaded roughly 1.8 million free applications from the Google Play Store to identify, extract, and crack embedded private keys and keystores.

### Key Topics - **Automated App Discovery and Crawling**: Utilizing random words from multilingual dictionaries with `GPlayCli` and a throwaway Google account to search and download free APKs. - **App Inspection and Storage**: Using `androguard` to inspect APK metadata, MIME types, and embedded files; organizing files by SHA-256 hash into manageable directory structures, and managing metadata across SQLite databases (split into APKs, contained files, and keys). - **Key Formats and Keystores**: Analyzing diverse formats including PKCS#1, PKCS#8, PEM, DER (via OpenSSL's ASN.1 parser), PKCS#12 (.p12), Java KeyStore (JKS), and Bouncy Castle. Dormann explains that while PKCS#12 uses container-level encryption, JKS and Bouncy Castle expose container contents without a password, though individual private keys remain encrypted. - **Obfuscation and Hiding**: Developers frequently attempt to disguise keys under misleading names or directories (e.g., naming keystores as `.txt`, `.bin`, `.apk`, `.png`, or placing them in `/fonts/data.ttf`), but MIME-type analysis still identifies them. - **Password Cracking and Key Extraction**: Employing John the Ripper and Hashcat (specifically `naive-hashcat`) with CPU and GPU setups. Dormann demonstrates that many passwords fall to standard wordlists (RockYou), keyboard walks, or human habits (initial capitals, trailing digits). - **Passwords Bundled in Applications**: Even strong, high-entropy passwords fail if the application must use them; passwords were frequently discovered in plaintext notes (such as `readme.txt` or `app sign in credentials.txt`), resource files (`strings.xml`), compiled native libraries (`.so` files decompiled in IDA), or encrypted using obfuscated functions in decompiled Java/Smali code.

### Technical Details - **Samsung Smart Home Case Study**: Dormann analyzed the Samsung Smart Home application (specifically refrigerator-related APKs) containing `common14k_pri.key`. Using `apktool` and `JEB`, he reversed `SmartHomeLauncherActivity.java` to locate a `setPassword` call. The decryption routine (`decryptPDE`) was extracted and compiled into a standalone harness to yield the 16-character password. Using OpenSSL, he extracted the private key, checked certificate transparency logs via crt.sh, verified matching public and private key moduli, and established that the key was an internal CA certificate capable of representing samsung.com. - **Findings and Statistics**: Out of 1.8 million apps inspected, Dormann identified 6,180 private keys. These included roughly 2,000 Google Play signing keys, 64 unique OpenVPN private keys, PGP keys, Apple Push notification private keys, 21 iPhone developer private keys, and enterprise distribution private keys. Combined attacks using RockYou and strings harvested directly from APK code cracked approximately 76% of password-protected keys. - **Developer Feedback**: When Dormann notified over 6,000 affected developers, responses ranged from developers using App Inventor (which bundled signing keys automatically into all created apps) to honeypot claims, confusion, offers of bounties, and indifference.

### Takeaways Bundling private keys in mobile applications presents severe security risks, allowing attackers to sign malicious updates, impersonate services, or access protected infrastructure. Password protection on embedded keys provides little defense if the application itself contains the decryption credentials or keys. Dormann recommends that app stores like Google Play and Apple App Store implement automated scanning to warn developers whenever private keys are detected in uploaded application archives.