Leveraging Verbose Data to exploit Insecure Randomization in Mobile apps -Allan Trindad

### Overview In this presentation, Allan (also known in the security community as Paradox) explores methods for exploiting insecure randomization and sensitive interface feedback in Android mobile applications. Using two vulnerable target applications—a "guess the number" app and the Mobile Hacking Lab "guess me" challenge—the speaker demonstrates how combining standard tools with UI-level verbose data allows attackers to bypass application constraints when traditional timing-based random seed guessing is unreliable or restricted by attempt limits.

### Key Topics - **Android Debug Bridge (ADB):** Utilizing ADB for application navigation, inputting text, sending key events (such as Tab and Enter), pulling logs, and starting launcher activities exposed via `AndroidManifest.xml`. - **Insecure Randomization:** The vulnerabilities associated with `java.util.Random`, which defaults to using the system timestamp in milliseconds when unseeded, contrasting it with `java.security.SecureRandom`. - **Timing-Based Exploits vs. Search Strategies:** The limitations of relying purely on timestamp-seeded pseudorandom number generation when attempt counts are strictly throttled. - **UI Automator & Verbose UI Data:** Using Android's `uiautomator dump` command to extract UI hierarchy trees in XML format to dynamically read UI states, screen text, coordinates, and button properties. - **Real-World Attack Scenarios:** Applying screen feedback extraction to scenarios like user enumeration, Brazilian CPF validation bypasses, and PIN brute-forcing when SSL pinning blocks API inspection.

### Technical Details The target applications require guessing a secret number between 1 and 100 within a strict limit of 10 attempts. An examination of the decompiled `MainActivity` showed that starting a new game instantiates `java.util.Random` without an explicit seed, defaulting to `System.currentTimeMillis()`. Because identical seeds produce identical pseudorandom sequences, an attacker can theoretically reproduce the output if the generation timestamp is known.

Allan first built a Java and Bash timing exploit leveraging `adb logcat` and `gdate`. When simulating UI inputs via ADB, the application logged the Enter key action, allowing the script to infer the approximate millisecond timestamp of the random generator's execution. However, because the user only gets 10 guesses, minor timing discrepancies caused this timing-based approach to fail frequently within the allotted attempts.

To overcome this limitation, the speaker pivoted to reading verbose UI strings via the `uiautomator` tool. Running `uiautomator dump` generates an XML file (`window.xml`) detailing every on-screen element, including element bounds/coordinates, enabled/disabled states, and feedback strings such as "too high, try again" or "too low." By parsing this XML with Java's `DocumentBuilderFactory`, the exploit adapted into an automated binary search. The script dynamically adjusted lower and upper bounds based on on-screen error messages, enabling the exploit to reliably guess the secret value in about four attempts with an approximate 99% success rate.

### Takeaways - **Randomness Selection:** Relying on `java.util.Random` for sensitive or game-critical values is inherently unsafe; developers should use cryptographic alternatives such as `SecureRandom`. - **Verbose Data Risks:** Overly verbose client-side feedback (e.g., differentiated error messages, state changes) provides high-signal oracles that can be parsed and leveraged by automated tooling. - **UI-Driven Exploitation:** When network-level inspection is thwarted by mechanisms like SSL pinning, UI Automator combined with ADB provides an effective alternative channel for automating input and extracting sensitive interface states.