Description
This assignment is focused on the analysis of one Android application, which is used for the Buga Service in Aveiro. The specific objectives of analyzing an application are related to identification of features, structure and other relevant findings.
The BUGA Application
Location: https://play.google.com/store/apps/details?id=pt.multiverso.bikesharing.bikesharing
This application is not malicious and will allow students to address the reversing of a common Android Application, mostly from a Application Security perspective. It refers to the BUGA Bike service in Aveiro, providing functionality related to the use of the city shared bikes.
The following aspects should be covered:
- characterization of the technologies used, as well as their versions, update status.
- characterization of the main logic blocks/processes/activities of the application, with focus on the ones responsible for data persistence, communication and authentication
- characterization of the APIs, communication methods, and message structure
- identification of potential issues, vulnerabilities and bad practices
The output should be composed of a report and a series of files, code snippets and related documentation supporting the report. If allowed by the authors, a subset of the reports may be sent to the product developers. We wish that with your knowledge we can validate the application, and find issues requiring some attention.
In the end, someone reading the report should have information about the overall structure of the application, how the main functionalities are implemented, and which potential vulnerabilities or issues are present.
Rules
The use of automated tools to scan the application is accepted. However, grading will mostly consider your work, your strategy, and your analysis, and the techniques used, not the raw results.
This project is expected to be authored by the students enrolled in the course. The use of existing code snippets, applications, or any other external functional element without proper acknowledgement is strictly forbidden. If any content lacking proper acknowledgment is found in other sources, the current rules regarding plagiarism will be followed.
The scope of this work is the application itself and the messages is normally exchanged. Any component in the support servers, its behavior or data are out of scope.
References and tools
- Frida: https://frida.re/
- APKTool: https://ibotpeaches.github.io/Apktool/
- Android Studio: https://developer.android.com/studio
- Dex2Jar: https://github.com/pxb1988/dex2jar
- JD-Gui: https://github.com/java-decompiler/jd-gui
- OWASP ZAP: https://www.zaproxy.org/