荣耀彩票代理

IT技术互动交流平台

Android安全开发之浅谈密钥硬编码

作者:伊樵、呆狐@阿里聚安全  发布日期:2016-05-19 22:09:15

 0x00 JIANJIE

ZAIALIJUANQUANDELOUDONGSAOMIAOQIZHONGHERENGONGAPPANQUANSHENJIZHONG,JINGCHANGFAXIANYOUKAIFAZHEJIANGMIYAOYINGBIANMAZAIJavaDAIMA、WENJIANZHONG,ZHEIYANGZUOHUIYINQIHENDAFENGXIAN。XINXIANQUANDEJICHUZAIYUMIMAXUE,ERCHANGYONGDEMIMAXUESUANFADOUSHIGONGKAIDE,JIAMINEIRONGDEBAOMIYIKAODESHIMIYAODEBAOMI,MIYAORUGUOXIELU,DUIYUDUICHENGMIMASUANFA,GENJUYONGDAODEMIYAOSUANFAHEJIAMIHOUDEMIWEN,HENRONGYIDEDAOJIAMIQIANDEMINGWEN;DUIYUFEIDUICHENGMIMASUANFAHUOZHEQIANMINGSUANFA,GENJUMIYAOHEYAOJIAMIDEMINGWEN,HENRONGYIHUODEJISUANCHUQIANMINGZHI,CONGERWEIZAOQIANMING。

0x01 FENGXIANANLI

MIYAOYINGBIANMAZAIDAIMAZHONG,ERGENJUMIYAODEYONGTUBUTONG,ZHEIDAOZHILEBUTONGDEANQUANFENGXIAN,YOUDEDAOZHIJIAMISHUJUBEIPOJIE,SHUJUBUZAIBAOMI,YOUDEDAOZHIHEFUWUQITONGXINDEJIAQIANBEIPOJIE,YINFAGEZHONGXUEAN,YIXIAJIEYONGWUYUNSHANGYIGONGBUDEJIGEAPPLOUDONGLAIJIANGJIANG。

1.1 某互联网金融APP加密算法被破解导致敏感信息泄露

MOUP2PYINGYONGKEHUDUAN,YONGLAIJIAMISHUJUDEDESSUANFADEMIYAOYINGBIANMAZAIJavaDAIMAZHONG,ERDESSUANFASHIDUICHENGMIMASUANFA,JIJIAMIMIYAOHEJIEMIMIYAOXIANGTONG。

荣耀彩票代理FANBIANYIAPP,FAXIANDESSUANFA:

FAXIANDESSUANFADEMIYAO,YINGBIANMAWEI“yrdAppKe”,YONGLAIJIAMISHOUSHIMIMA:

JIANGSHOUSHIMIMAYONGDESJIAMIHOUCUNFANGZAIBENDILocusPassWordView.xmlWENJIANZHONG:

ZHIDAOLEMIWENHEJIAMISUANFAYIJIMIYAO,TONGGUOJIEMICAOZUO,KEYICONGWENJIANZHONGHUIFUCHUYUANSHIDESHOUSHIMIMA。HUOZHESHIYONGXINDESHENGCHENGXINDESHOUSHIMIMA

荣耀彩票代理ERYUFUWUQITONGXINSHIJIEKOUZHONGDEJasonZIDUANYEYONGLEDESSUANFAHEMIYAOYINGBIANMAWEI“yRdappKY”:

和服务器通信采用http传输,没有使用https来加密通信,如果采用中间人攻击或者路由器荣耀彩票代理镜像,获得流量数据,可以破解出用户的通信内容。

荣耀彩票代理1.2 MOUZUCHEAPPJIAMISUANFABEIPOJIEDAOZHIYIXIELIEFENGXIAN

荣耀彩票代理MOUZUCHEAPPYUFUWUQITONGXINDEJIEKOUCAIYONGhttpCHUANSHUSHUJU,BINGQIEYOUDUICHUANSHUDEBUFENCANSHUJINXINGLEJIAMI,JIAMISUANFACAIYONGAES,DANSHIMIYAOYINGBIANMAZAIjavaDAIMAZHONGWEI“shenzhoucar123123”,KEBEINIXIANGFENXICHULAI,DAOZHIWEIZAOQINGQIU,JIEHEFUWUQIDUANDELOUDONG,YINQIYUEQUANFANGWENDEFENGXIAN,RUYUEQUANCHAKANQITAYONGHUDEDINGDANDENG。

HEFUWUQITONGXINSHIDESHUJUWEI:

qZIDUANSHIJIAMIHOUDENEIRONG。NIXIANGAPP,CONGDENGLUActivityRUSHOU:

荣耀彩票代理FENXIDENGLULIUCHENG:v1SHIYONGHUMING,v2SHIMIMA,v3SHIPushId,ZAIYONGHUMINGHEMIMABUWEIKONGBINGQIEZHANGDUBUXIAOYU11QINGKUANGXIA,ZHIXINGLoginOperateXIANGGUANCAOZUO,ZHUIZONGLoginOperateDESHIXIAN,FAXIANJICHENGZIBaseOperate,JIXUZHUIZONGBaseOperateDESHIXIAN:

荣耀彩票代理ZAIBaseOperateDEinitUrl()FANGFAZHONG,ZHAODAOLEAPPSHIZENMESHENGCHENGQINGQIUSHUJUDE:

荣耀彩票代理JIXUZHUIZONGSHANGTUZHONGDEinitJsonUrl()FANGFA,FAXIANQIDIAOYONGLEAESJIAMI:

JIXUZHUIZONGaes.onEncrypt()HANSHU:

ZAIonEncrypt()HANSHUZHONGDIAOYONGLEencrypt()HANSHUYONGLAIJIAMISHUJU,ZHUIZONGencrypt()HANSHUDESHIXIAN,FAXIANQISHIYONGAESSUANFA,BINGQIEMIYAOYINGBIANMAZAIjavaDAIMAZHONGWEI“shenzhoucar123123”

荣耀彩票代理DAOXIANZAIQINGQIUZHONGDESHUJUJIAMIRUHESHIXIANDEJIUQINGXILE,LINGWAIYOUYUFUWUQIQUANXIANKONGZHIBUYAN,JIUKEYIGOUZAODINGDANidDEQINGQIU,DADAOYUEQUANFANGWENDAOQITAYONGHUDEDINGDAN。

荣耀彩票代理GOUZAO{“id”:”11468061”}DEQINGQIU:

QIZHONGuidSHEZHIWEINIZIJIDEuidJIKE,KEYICHENGGONGKANDAOQITARENDEDINGDAN:

 

荣耀彩票代理GONGJIZHEWANQUANKEYIZUODAOSHIYONGQITAJIAOBENZHONGXINSHIXIANXIANGTONGDEJIAMIGONGNENGBINGPINJIECHUGEGEJIEKOUQINGQIU,PILIANGDESHUAQUDINGDANXINXIHEYONGHUQITAXINXI。

荣耀彩票代理1.3 MOUJIUDIANAPPJIAQIANSUANFABEIPOJIEDAOZHIYIXILIEFENGXIAN

MOUJIUDIANAPPHEFUWUQITONGXINSHIJIEKOUCAIYONGhttpTONGXIN,SHUJUJINXINGLEJIAMI,BINGQIEDUICHUANSHUCANSHUJINXINGQIANMING,ZAIFUWUQIDUANXIAOYANQIANMING,YIJIANCHACHUANSHUDESHUJUSHIFOUBEICUANGAI,DANSHIJIAQIANSUANFAHEMIYAOBEINIXIANGFENXI,KEDAOZHIJIAQIANJIZHISHIXIAO,GONGJIZHEKERENYIWEIZAOQINGQIUBAO,RUOJIEHEFUWUQIDUANDEQUANXIANKONGZHIYOULOUDONG,ZEKEYINFAYUEQUANFENGXIANDENG。

APPHEFUWUQITONGXINDEYUANSHIBAORUXIATU,KEYIKANDAOYOUJIAQIANZIDUANsign:

NIXIANGAPPDINGWEIDAOJIAMISUANFADELUOJIDAIMA,com.htinns.biz.HttpUtils.class,QISHIXIANLUOJIWEI:

荣耀彩票代理YUANSHISHUJUSHIunSignData,SHIYONGRC4SUANFAJIAMI,MIYAOWEIKEYBIANLIANGSUODAIBIAODEZHI,JIAMIHOUDESHUJUWEIsignData,CHUANSHUDESHUJUSHIDEdataZIDUANWEIsignData。

荣耀彩票代理JIAQIANZIDUANsigndDESHENGCHENGFANGFASHIYONGunsignDataPINJIESHIJIANCHUOtimeHEresultkey,RANHOUZUOmd5,ZAIJINXINGbase64BIANMA。SHIJIANCHUOBAOZHENGLEMEICIQINGQIUBAODOUBUYIYANG。

荣耀彩票代理sendSign()SUANFASHIYONGcHUOc++XIEDE,FANGRULEsoKU,QITAZHONGYAOSUANFADOUSHIYONGjavaXIEDE。

KEYISHIYONGIDANIXIANGFENXIsoKU,ZHAODAOsendSign()FANGFA

ERWUYUNLOUDONGTIJIAOZHECAIYONGDESHIFENXIsignHEgetSign(sign)DESHUJU,ZUOYIGESUANFAPOJIEZIDIAN。QISHIHAIYOUZHONGFANGFAZHIJIEDIAOYONGCIsoKU,LAISHENGCHENGZIDIAN。

QIANMINGPOJIEYIHOU,JIUKEYIGOUZAOFASONGJIFUWUQIDESHUJUBAOJINXINGQITAFANGMIANDEANQUANCESHI,BIRUYUEQUAN、ZHONGZHIMIMADENG。

荣耀彩票代理0x02 ALIJUANQUANKAIFAJIANYI

TONGGUOYISHANGANLI,BINGZONGJIEXIAZIJIPINGSHIFAXIANMIYAOYINGBIANMADEZHUYAOXINGSHIYOU:

1、MIYAOZHIJIEMINGWENCUNZAIsharedprefsWENJIANZHONG,ZHEISHIZUIBUANQUANDE。

荣耀彩票代理2、MIYAOZHIJIEYINGBIANMAZAIJavaDAIMAZHONG,ZHEIHENBUANQUAN,dexWENJIANHENRONGYIBEINIXIANGCHENGjavaDAIMA。

3、JIANGMIYAOFENCHENGBUTONGDEJIDUAN,YOUDECUNCHUZAIWENJIANZHONG、YOUDECUNCHUZAIDAIMAZHONG,ZUIHOUJIANGTAMENPINJIEQILAI,KEYIJIANGZHENGGECAOZUOXIEDEHENFUZA,ZHEIYINWEIHAISHIZAIjavaCENG,NIXIANGZHEZHIYAOHUADIANSHIJIAN,YEHENRONGYIBEINIXIANG。

4、YONGndkKAIFA,JIANGMIYAOFANGZAIsoWENJIAN,JIAMIJIEMICAOZUODOUZAIsoWENJIANLI,ZHEICONGYIDINGCHENGDUSHANGTIGAOLEDEANQUANXING,DANGZHULEYIXIENIXIANGZHE,DANSHIYOUJINGYANDENIXIANGZHEHAISHIHUISHIYONGIDAPOJIEDE。

荣耀彩票代理5、ZAIsoWENJIANZHONGBUCUNCHUMIYAO,soWENJIANZHONGDUIMIYAOJINXINGJIAJIEMICAOZUO,JIANGMIYAOJIAMIHOUDEMIYAOMINGMINGWEIQITAPUTONGWENJIAN,CUNFANGZAIassetsMULUXIAHUOZHEQITAMULUXIA,JIEZHEZAIsoWENJIANLIMIANTIANJIAWUGUANDAIMA(HUAZHILING),SUIRANKEYIZENGJIAJINGTAIFENXINANDU,DANSHIKEYISHIYONGDONGTAIDIAOSHIDEFANGFA,ZHUIZONGJIAMIJIEMIHANSHU,YEKEYICHAZHAODAOMIYAONEIRONG。

BAOZHENGMIYAODEANQUANQUESHIJIANNANSHI,SHEJIDAOMIYAOFENFA,CUNCHU,SHIXIAOHUISHOU,APPFANGFANBIANYIHEFANGDIAOSHI,HAIYOUFENGXIANPINGGU。KEYISHUOZAISHEBEISHANGANQUANCUNCHUMIYAOZHEIGEJIBENWUJIE,ZHINENGXUANZEZENGDAGONGJIZHEDENIXIANGCHENGBEN,RANGGONGJIZHEZHINANERTUI。ERYAOSHIPUTONGKAIFAZHEDEHUA,ZUOTUOSHANBAOHUMIYAOZHEIXIESHIQINGZHEIXUYAOHAOFEIHENDADEXINXUE。

CHANPINSHEJIZHEHUOZHEKAIFAZHEYAOMINGBAIZIJIDEMIYAOSHIZUOSHENMEYONGDE,ZHONGYAOCHENGDUZENMEYANG,MIYAOBEINIXIANGCHULAIHUIZAOCHENGSHENMEFENGXIAN,TONGGUOPINGGUAPPYINGYONGDEZHONGYAOCHENGDULAIXUANZEXIANGYINGDEJISHUFANGAN。

CANKAO

p2pYIRENDAIappJIZHONGANQUANWENTI

荣耀彩票代理SHENZHOUZUCHEAPPKEHUDUANSHEJIQUEXIANDAOZHIDEYIXILIEANQUANWENTI(SUANFAPOJIE/QUANXIANBIANLIDENG)

荣耀彩票代理JIANGJIEYIBUBUNIXIANGPOJIEHUAZHUJIUDIANJITUANGUANWANGAPPDEhttpBAOJIAMISUANFAYIJIYIXILIELOUDONGDABAO

http://jaq.alibaba.com/safety?spm=a313e.7837752.1000001.1.zwCPfa

http://www.zhihu.com/question/35136485/answer/84491440

 

延伸阅读:

Tag标签:      
  • 专题推荐

About IT165 - 广告服务 - 隐私声明 - 版权申明 - 免责条款 - 网站地图 - 网友投稿 - 联系方式
本站内容来自于互联网,仅供用于网络技术学习,学习中请遵循相关法律法规