award to honor the writers and artists. The great short story writer Sri T. Patmanabhan is selected by the jury for the first Priyadarshini award. Sri Rahul Gandhi is giving a Vedic award. We request all the distinguished guests to please occupy the respective seats on the diaries. Prarthane Ode Thodanga, I request everybody stand up for a minute. Prayer. I request advocate Parakulam Madhu, voice team and Preyadashina Publications and General Secretary KPCC to welcome the guest. In an age in which dark forces of fascism are engulfing our cultural spaces and intellectual and artistic discourses, it is the bonded duty of the Congress Party to stand up for freedom, freedom of speech, freedom of expression and dissent and to keep alive the Nehruvian tradition of democracy in its fullest meaning. The institution of this award itself is part of a belief that individuals, writers who stand up for democracy should be acknowledged, appreciated, respected and they should be admired. This is a humble effort to celebrate our right as an artist of our time and to uphold values of a functional and vibrant democracy. Let us hold hands and stand up for freedom and its blossoming in different ways and hues. Prey Malavari, this is our KPCC President, Shri K. Sudhakaran. Kanuri is the homeland of K. Sudhakaran. K. Sudhakaran is the guiding force behind Preyadashini Publications Society. He is supporting us in every avenues. He is the backbone of Preyadashini Publications and he is the chairman of Preyadashini Publications Society. For our and on behalf of all assembled here, I will welcome our dearest KPCC President, Shri K. Sudhakaran. Dakhulji, we heard your voice everywhere in the country, wherever a writer or an artist is cornered, tarnished or attacked by the ruling dispensation. There is only one leader in the country who can save the writers, who can support the voice of the writers of this country, that is our leader, Shri Rahul Gandhi. Bharat Jodo Yatra instilled confidence in the minds of millions and millions of Indians. Most of them are writers and artists. Recently, we visited many of the writers of Kerala. All of them said that there is only one leader who can save India from the disaster made by the fastest forces of this country. Some of them were regretting that they could not participate the Bharat Jodo Yatra, the Yatra to rebuild the country. Presenting by Rahulji, in fact, this award itself is acknowledged great recognition, Rahulji. Siti Patmanabhan is the writer who gave us stories like Makan Singh and Mananam, Prakashan Bharat and the Pankutty, Gauri and many other sparkling works of fiction is being awarded by Prearachini Publication Society. This is a great moment. We are thrilled, Rahulji, to have you here to hand over, to give away this first Prearachini award. See, Siti Patmanabhan is a freedom fighter who started writing in the year 1948. Now he is 95 plus, still active, still writing. His memory is very, very good memory he has. He has rejected many awards that cannot be awarded mentioned. He rejected many awards including the one offered him by the Sahitya Academy. He stood for democratic values, secularism always. He is the dearest storyteller of Malayalam literature.  He started his political career from Kannur. He fought many battles in this soil. He is coming from, with Rahulji, from the campaign, after the campaign, in five states. We hope that we can win in those elections. Sikesi Venugopal is supporting us in every venture. I wholeheartedly support the secular leader, the leader of the poorest of the poor, the working class, the ordinary party workers of Kerala, Sikesi Venugopal, to this award ceremony functions. Our dearest opposition leader, he is a voracious leader. He reads everywhere, wherever he gets time. He is a great supporter. He is a motivator of Preachini Publicate Society. He is fighting inside and outside the assembly for the poorest of the poor of Kerala. I welcome you, sir, to this occasion. Chiyadur Gopal Gishan is a cultural icon of the world, cultural icon of Kerala. He is a world-renowned filmmaker. Once he was offered a visa to the moon by the spokesperson of the ruling dispensation for himself with 48 other Yemenen individuals who wrote the Prime Minister against the fascism prevailing in this country. Chiyadur Gopal Gishan, sir, always speaks for democracy and human values. With all respect, I welcome you, sir, to this function. And many other technicians are on the dais. Patnashree, Chiyapukuttan Podhwal, Chiyadir Prasad, great writer of Kerala, Shikalpatan Airaanji is here, Dr. Sudha Menon is here, Shipantalam Sudhakaran is here, many other writers and artists are here. I am not mentioning everyone, the name of everyone of those that is with all respect, I welcome you all to this function. The DCC president, she is Martin George, he is the key person who has organized all this function. I welcome Martin George and all of the leaders. I can go to my speech. I welcome everyone of you, the media and artists and everyone once more I welcome you. Thank you. Thank you very much. Thank you, sir. KPCC president, Shri K. Sudhakaran is the chairman of Priyadarshani Publication Society. So, I request you to kindly deliver the presidential address. Shri K. Sudhakaran is the chairman of Priyadarshani Publication Society. If all the Congress committees are interested, this is the witness of a family. At this stage, Shri Rahulji, Shri K. Sudhakaran, Shri Pappatan, Jhore Aayu, Vrishishtadidhikul, M.B. Maar, M.L.A. Maar, Vedic, Vrishishtadidhikul, A.Briyamula, Savadri, Savadri. We know that the last few years, the Kerala Padaesh Congress Committee is one of the ones who is willing to participate in this Kerala Padaesh Congress Committee. We have started a lot of new events. We want to make the Kerala Padaesh Congress Committee more successful and more successful in the Kerala Padaesh Congress Committee. In the Kerala Padaesh Congress Committee, there are people who are willing to participate in the Kerala Padaesh Congress and the Congress committee as well. By doing so, they are prepared to make the Congress committee more successful and they are willing to participate We have published a number of books here. I have published more than 10,000 books here. I have published a number of books here. Pradhamapriya Darshani, Samagra Sahitya Puraskaram Pramukha Gadagrithum, Malayana's Abhimanyavumaya Sri T. Palitmanabha Adi Magathaya Chadangana. There is no need to talk about papadani with your eyes. There is no need to talk about papadani with your eyes. Everything is there. Everything is there. There is love, there is compassion, there is nation, there is science, there is compassion, there is an entire civilization. I have a brother. There are politicians, entrepreneurs, hot hands, there are lovers, there is one person who has a peaceful experience. I am the one who is responsible for this. I am the one who is responsible for this. So, there is nothing to be found here. What we are trying to find out is about Kannur. What we are trying to find out is about Akalapuram, Kulapuram and Bombay. But, there is a reason behind this. There is a writer who is writing the book of Ayuragana. That is Pryankaranayasi Papattam. When this award is given to this award, it is a book given by Shilpa and Prasamsa Patraman, who is writing the book of Ayuragana and Prasamsa Patraman. Prasastha Chalajitra Sambithayagan, Adoor Gopalakrishnan, as a jury chairman, Shri K.U.K. Kumaran, Srimathi Greshi, Sudha Menon, and Pradagulam Madhu, are the members of this award. This award was given to this country for the sake of the development of the country. This award was given to this country for the sake of the development of the country. We know that we cannot forget the country we love. India is the prime minister of India who showed the true power of the country. This country is the prime minister of India for the sake of the development of the country. India is the prime minister of India who had announced to give a life for the sake of the development of the country. The cause of the country's development is the growth of people. There are a lot of people who are suffering from blood tests and many others who are suffering from a lot of pain. They are able to get 10 lakhs. They are able to get 100 lakhs for their needs and their faiths. They are able to get a protection wall. I would like to tell you that the Kerala Congress Committee will go forward. There is a need for the community of the people and the people of Madhya Dharam, the poor and the state of India to have a protection wall. I am going to use the need to use the protection wall and the KPCC to provide a protection wall. Apart from that, the Pappatam, which is dedicated only to one person, is the pride of this country. You should remember that. It is the pride of Kannoor, Siva Pappatam. It is not of great importance. The problems you are facing are not of great importance. The whole of the world is in this place. This place is a place where the world is living in. That is the meaning of the Pappatam. We are yearning here. We do not have the chance to say that yearning is for us. The problems you are facing and the problems you are facing, the world is moving in many ways. Because, all of these are written in the Pasthikarikapattapalpala. There are more than 160 of them. There are more than 160 of them written in the Pappatam and written in the Pasthikarikapattapalpala. We should think about it. If we want to say that a great Yogi, which is dedicated for a man, is the pride of Kalaigarikapattapalpala. We do not have the chance to say that we are in Pappatam. Therefore, the great Yogi, who is dedicated for the people of Kanyakumari, and the great Yogi of the Kalaagilapu, are also dedicated to the Kanyakumari, the great Yogi of the Kanyakumari which is dedicated to the people of Kanyakumari. The stories of the beautiful world like the legends. The stories of the great Yogi, which is in December, Sakaapu puratarangiyadu. Prakriti odum manishirodum ula snekhum anum adekathin na kathagil na pradhana cheerubhagal. Sathyam snekhum deya sakhanu budhi, tyagam samathum manipigatha atodangiyam bulliyangal. Thiragal poale adekathin na kathagal iludai kadannum ala randu. Vaayikin na prakkadha anipo vedyam agum. Dhasambarathum na penkutti. Tipalpanavan na yattavum sraddayam aya kadayai karidapadunum. Adipul sinimayil ek parashinatitundu. Anjuminattaya posseingam ballunanum. Dendum mittu kudiyatukodrati. Devidichettu? Dendum mittu kudiyatukodrati, please. Muliyanalum niravadugalum mariyaligalai kududhal manishathum ula vairum. Senghan idhigalum aaki. Adekunta tani endukundum sabalam aya jividham anadekathin na kathagil. Thittugal kethirai shaktam aai pradigarikun aadekathin na shabdathinu. Keralaum paladamana kaadu orthetundu. Raghul Gandhi aayoghya tha kalpichadhi. Shabdham aakannulla. Kulshidha sarvam maranagulum modhi maranagulum nalatiyapol. Adekum Raghul Gandhi ku parashimaya pindaliyumai rangathethi. Adekathiyapol ula maha pradibakku. Pradama priyadrashini samagrashagithya puraskaram samanikadhil. Valiya charidarthi manuladhu. Abhimana manuladhu. Than de nilpidham kathayana yadna krithyamai tyakapadhithiya. Kathapurishanana namadhe priyapattati padhanapad. Adekathine... Adekathine... Abhe idha tirithirikidhu. Uru sahithiparaskaraya karapadithikundaga. Sanyi palagulam madhu. Neyathurutthu nalgunna adekum upa atishanana. Priyadrashini publication's. Adekathine ulisagathilana. Thiruchiyayutthu. Ingenayavaru avada karapadithi. Thiruchiyayu adekathine party dha atishanam. Thirumalichya congress party. Neyathurutthu nalgunna adekathine party dha atishanam. Adekathine ulisagathilana. Thirumalichya congress party dha atishanam. Thirumalichya congress party dha atishanam. Thirumalichya congress party dha atishanam. Thirumalichya congress party dha atishanam. Thirumalichya congress party dha atishanam. Thirumalichya congress party dha atishanam. Nannisu. I invite honorable opposition leader Sridhiti Sadeshan for felicitations. Buhumani Naya Rahulji. Priyapata K.B.C.C.Pasant. Priyankar Naya Pappetan. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. Buhumani Naya Sadeshanam. The words that he writes are actually the voice of Kerala, the voice of the history of Kerala, the tradition of Kerala, the language of Kerala. And it is something that I am very interested in understanding. I was not born here, I do not speak the language, but it is something that I am very curious about. Every day in my work in Kerala, I see some new facet of the people of Kerala. Always something that inspires me, some new way of looking at things, how you treat each other, the affection new people are able to show to each other. These are all things that are very very useful and interesting for me. How you are able to see other people's perspective, see other cultures, see other religions and respect them. This journey of understanding Kerala, which I am on, I think Padmanandji is going to be a tremendous guide and his writing and his short stories are going to be a tremendous guide for me to understand my beloved Keralite people. He can show me direction, he can show me how to understand the people of Kerala. And people also underestimate what it means to be someone like Padmanandji. This award ceremony does not reveal the hours and hours and hours of effort that he put in. The struggle that he put in, the difficulty that he faced in becoming what he has become, in representing the voice of Kerala so beautifully. So I would like to thank him for the years and years of struggle, for the difficulties that he faced, to express to the people of Kerala their own feelings. It is an honour for me to come and give him this award and I thank everybody for coming here and supporting us. Thank you. Before any of the murders, a journalist came to interview me and asked me, if there was no witness, what would have happened? I did not have time to think about it. It was a full-time, night-time experience. It was a very true experience. In my childhood, I was a student of Congress, a student of Congress, and I was a student. When I was in Kichindya, I was suspended from the school of Pangadutta. I was suspended from the school of Pangadutta. I was suspended from the school of Pangadutta. I was suspended from the school of Pangadutta. I was suspended from the school of Pangadutta. When I saw what I had done, I thought that I should not do this anymore. Even then, I was still a student of Sajeevam. Even now, I was suspended from the school of Pangadutta. I did not have time to think about the night-time experience of this school. I was suspended from the school of Pangadutta. When I came back to Kannur, I did not see much of the Kondas. I saw that a new generation came here. There were two or three people who married me in that group. If they did not say their names, I would believe that this country and this situation would not be with me. When I saw Kannur, I did not see much of the Kondas. When I saw Kannur, I did not see much of the Kondas. I did not think about the night-time experience of this school. I did not see much of the Kondas. I did not see much of the Kondas. I saw the Sadeeshan Pachai, Pramod, Martin George. There are also people who are not the people who came to my mind.  In the presentation of Sri K. C. Venubal, there is a story about Tagore. In UNESCO, in the University of Pahidurga, in the University of Vishwabhadhi Shantizighedhan, in the University of Kondras, in the University of Tiruvananthapuram, there was a group of students from Kondras, in the University of Sri Aiyadan Shaukat, there was a group named Tagore. There was a group named Tagore, in the University of Vishwabhadhi Shantizighedhan, there was a group named Tagore, in the University of Vishwabhadhi Shantizighedhan, in the University of Vishwabhadhi Shaukat, in the University of Tiruvananthapuram, in the University of Tiruvananthapuram, in the University of Vishwabhadhi Shantizighedhan, in the University of Tiruvananthapuram, respected Raul Ji. There was a very great poet in Kerala. His name was N.V. Krishnanwaziar. He was many things involved. A great philologist who knew so many languages, who took part in the freedom struggle, especially in the Kuchindya movement. He edited a paper named Swadhandra Bhadra. That is Free India. This editing was then undergound. A very great poet, a very great journalist. He wrote a very famous poem about your great ancestor Pandit Javakarlal Nahul. Roughly translated into English, it reads like this. Oh brave charioteer, please take this vehicle to the cherished end. All of us wish you well. It applies to you also. Keep it up, young man. The nation expects a lot from you. I request Honorable Rahul Gandhi Ji to receive the Priyadashmi Book Club membership application from renowned writer Sri Kalpatanarayanan sir. Thank you sir. I request the Vice Chairman Advocate Parakulam Madhu and Secretary Sri Bini Sahidi to present our talk of love to Rahul Gandhi Ji. I request the Vice Chairman Advocate Parakulam Madhu and Secretary Sri Bini Sahidi to present our talk of love to Rahul Gandhi Ji. I request the Vice Chairman Advocate Parakulam Madhu and Secretary Sri Bini Sahidi to present our talk of love to Rahul Gandhi Ji. I request the Vice Chairman Advocate Parakulam Madhu and Secretary Sri Bini Sahidi to present our talk of love to Rahul Gandhi Ji. I request the Vice Chairman Advocate Parakulam Madhu and Secretary Sri Bini Sahidi to present our talk of love to Rahul Gandhi Ji. Thank you. Thank you so much.


Yeah, thank you for the short introduction. I'm Siegfried. This is my colleague Stefan and today we'll talk about our tracking application investigation. We are both from Germany from a research institute called Fraunhofer SIT. It's located in Darmstadt, close to Frankfurt. A few words about ourselves. So I'm Siegfried. I'm leading a research group at this research institute called Secure Software Engineering and our main focus is on static and dynamic code analysis. So writing new analysis in order to find vulnerabilities in binaries as well as source code. I'm also a founder of the team called TeamSIC, which I will say in a second, and a founder of Code Inspect, which is a reverse engineering tool for Android. So Stefan, would you like to say a few words about yourself? Yeah, hello. My name is Stefan. I belong to the Test Lab Mobile Security Group. I'm also developing static and dynamic analysis tools. And in my spare time, I'm digging around a bit with IoT stuff. And together with Siegfried, I'm a co-founder of our hacking team. Good. Thank you. So we talked about this TeamSIC. So what we presented today is not the results of both of us. It's basically the results of our team, which is called TeamSIC. So what is it? A few words about it. It's a hacking group. So we meet once a week in our spare time. So the team consists of researchers from this research institute as well as students around our universities, around the university. And so we usually look into different interesting projects. Then we try to find some vulnerabilities. And that's basically the goal to learn from each other. So the credits definitely go to those brilliant students and researchers mentioned below. Two of them are actually here in the audience. Good. So before we start with the talk, a short beer announcement. Since we are, well, you already know from Germany and actually from Munich or close to Munich, we thought it might be yet another cool idea to bring or import some boxes of beer. And since this is our third first DevCon talk, we imported two boxes of beer this year. So after the talk, feel free to come and grab a cold beer. There are 40 bottles for you guys. Thank you. So let's get started. A short agenda for today. I will start with a little bit of motivation and then do a little bit of background information. And then we dig into our results of our security findings. First topic is client side authorization. I will explain what I mean by that. Then we will talk about the client side vulnerabilities and then we will talk about server side vulnerabilities. In the end, a few words about responsible disclosure because this was funny this year and a summary in the end. Good motivation. So when I started, when we started putting the slides together, I said, how can I motivate tracker applications? So while you first of all think about surveillance, so looked a bit up online and I found a cool blog post about a CAA museum. For instance, in the 60s already, there were some radio receivers inside a pipe. So very small stuff, which was very interesting to see. In the 60s, again, like a camera inside a pack of cigarettes to hide and to audio record or video record the environment. And in the 70s, like a microphone fit already into a dragonfly in order to spy on people. So I guess you already get it. This was the past. So how is it right now? I guess we all have it in our pocket. It's the smartphone. Well, because there are a lot of sensors in it like GPS and this kind of stuff. So you get a lot of information from people. This is the reason why there's already spyware and rat abusing this stuff and extracting all the information and using it for whatever reason. But we also ask ourselves or we ask are there any benign reasons or are there any good reasons to use such kind of apps or surveillance apps or tracking applications? And then we found three different topics, which was interesting. So first of all, families. So there are apps out there where adults want to know where their child's are. So they want to know if they are whatever safe in the environment based on the location information. There are couples, which was interesting, like track my boyfriend, track my girlfriend apps. I don't know why they do this. So they mutually agree on installing the application and whatever to check if they are not cheating on each other. I don't know. But there are many of them out there. And friends as well. So you want to know where your body is in order to meet or whatever. So there are benign reasons. The question is how do you differentiate between the good and the bad now, right? Because from an implementation perspective, both are implemented in the same way. So for this, we looked up on Google Play and we found these kind of apps. So we thought there might be a definition, what are good apps and what are bad apps? So I found one of them is the Android security report stated it that commercial spyware is any application that transmits sensitive information off the device without user consent does not display a persistent notification that this is happening. So this means if you want to install a benign tracking application and if you want to upload it to a Play Store, you need to show the monitor person notifications like whatever right now I'm accessing your location information or whatever and I'm sending it to your mom. Some kind of this. If this is the case, then this is a legitimate app. And if not, then it's considered a spyware and it shouldn't be in the Play Store. This is at least what we found. Good. So we've only focused in this talk or in our project on those legitimate apps and we ask ourselves the question because they're collecting a lot of data. How well is the collected data protected on the client side or on the server side? For that, well, we looked up as a Google Play Store, we typed in tracking application, tracked my boyfriend, tracked my girlfriend. And then we found 19 different apps. Why is this an odd number? Well, we just downloaded a few of them, the first hints and at some point we stopped. And then while we found so many vulnerabilities that at some point we got bored and this is the reason why there are 19. This is no special reason for 19. So we looked that we at least get those that have the most installations based on the Google Play Store statistics. And another point is we only looked for free applications. So I know that there are a lot of commercial spyware applications out there. Those were not the target in this project, only the ones where you can download for free and you get for free and you can use for free. So as a spoiler, we found 37 different vulnerabilities in total, very, very sensitive ones. And while in this talk, we will show a few of them or at least a few categories of them. Good. Before we see the takeaways of this talk, so what will you learn today? I have to tell you that if you expect any sophisticated exploit in this talk, unfortunately, I have to disappoint you. So it was in this project very, very easy to get access to all this highly sensitive data and even to do mass surveillance in real time. And we usually play this game of can we upgrade the applications which we have to pay for premium features? Can we upgrade it for free? And yeah, we will also say a few words about that. And yes, it was possible again this year. Good. Then I will come to the background information, just very, very small background information, very easy setup that we are all at the same page. So how does this work? So usually you have this application and you have an observer and a monitored person and both install this application and then there is some kind of pairing process where they know, okay, I belong to this guy or whatever or I can monitor this person. And on the monitored side, well, it collects all this sensitive information like location and so on and sends it to the back end and in the backend side, you basically the observer pulls the information saying, hey, right now I want to know where my kid is or whatever.  And apart a couple of applications also had the cool feature of installing a messenger into this tracking applications. So this means that you can chat with your girlfriend or whatever. So you also can send pictures and videos. And this is important for the remaining talk. So all these data are stored in the backend. So what are the attack vectors here? Well, as I said, the usual game, can we upgrade premium features for free? So we will say a few words about that. Then obviously the two communication channels can be do a man in the middle. And how was it implemented? How was the protocol implemented? We will say a few words about that. And the other last attack vector is the backend, basically. Good. So in the following, we will talk about all of those three stages now. First client side authorization. So before I do this, I start with, we all know this, but just to get clear what it means to do, to access the sensitive data. So you have an observer and you would like to access sensitive data or data from the backend. So there are usually two steps involved. First authentication, including identification, and then authorization that you're authorized. The check is on the backend, which checks if you're allowed to access this data. We all know this, but I'm just saying. And then what we saw is usually, so there was most of the time, this kind of authentication process, many times broken, many times there was none. But at least it was there. And then there was something where we found a client side authorization. And I will explain this in a second. So I will show you four different examples of what we found out, which was not okay. Good. The first one, um, yeah, as I said, the usual game of premium features. So these kind of applications contain some features which are disabled by default. And if you pay wherever $5 or something like this, then you get super cool premium features. One of them is for instance, removing advertisement that you have read that you're not seeing the advertisement anymore. Very easy. So we asked ourselves, um, how was this implemented to, for instance, get rid of the advertisement. And then we looked into the code. And we found the following. Um, share preferences, get boolean L ads, for instance, then there was a check if removed. So if this flag is set to true, and if yes, then they basically disabled this view on the client side. For those of you who don't know the code here or what the share preferences is in Android, share preferences is a file that comes with the application. Um, it's a XML biased XML based file and it has a key value pair. So in this case, this L ads, for instance, was set to false. If you set it to true, then you basically can get rid of the, um, advertisement. Um, the question is for those who don't know it can, how can we manipulate this file? Well, there are basically two ways. First one, if you have a rooted device, it's very easy to, to change this value on an unrooted device, you and the application allows you to backup.  This is all known and well known from, also from the past. Then when we looked into this, uh, share preferences file, we found some other cool settings there. So one of them was SMS full. So SMS full is like in from the monitor person, all the text message basically can be, uh, can be accessed by the observer. Um, so the full text message because they want to know if the girl from the boyfriend is cheating or whatever. So they want to exactly know what's going on. And as I already mentioned, so if you set this one guy from false to true, uh, oh yeah, sorry, I forgot to say it. So what does this full mean? This full means if you did not pay, you only get the first X characters of the text message. And if you pay, then you get the complete text message as an observer. Um, well, if you set it to true, we already learned this right now, then you get the full text message. But the question was how was this implemented? It was implemented in such a way. So the observer basically said, hey, please give me all text messages from this guy or from my kid or from my girlfriend. And then the server says, yeah, okay, sure. Um, you get the complete text message text may one, two, three, like the complete one. And then at the client side, there was a check like, okay, so if you did not pay, I only show the first 50 characters. And if this is not the case, you basically see the complete text message. And this, this was a little bit funny to see and you shouldn't do this.  So yeah. Good. So next stage, second stage of, of this kind of box where, um, so as I said, there are basically these two roles. You have a parent which has the admin role and then you have your kid, which has less privileges. And if you're an admin, you can create a new admin or whatever. And if, well, and you can monitor basically your kid. And the question was, okay, how do these apps differentiate between an admin or a parent and a child, a children. So, and the question was, yeah, there's a shared preferences file and there is a set called East parent. And if this guy is set to true, um, then your parent and then your admin. So this means if you are the kid and you change your share preferences file to true, then you're an admin and can spy back to your parents if you want. Good. Next stage. Another example of this kind, I guess you already get this thing. So there was there were applications that contained, um, additional security protection mechanisms, which, um, once you open the application, um, you can enter a pin and then it asks you for the pin. And if you enter the correct pin, then you own, then you can access the application or the data in the application. So this is a good security feature. The question again was, uh, how was this implemented? And I guess you already get this kind of game now. There was a flag in the shared preferences file, this time P flag. So it's not so directly pointing to remove, uh, to lock screen or something. And if you set this to false, then you do not see any lock screen at all. Even if you added a pin or something, you can directly access the data there. Yeah. And last but not least, um, obviously the same also work for log in. So honestly, so there is an ease login. And if you were logged in before, so they store basically the username and password. And if you set this guy to true, it automatically locks you in even without typing the username and password. Again, shared preferences. I mean, yeah. So the last slide here in this case is please do not use shared preference for authorization checks. So for those of you who are bug counters, so please look into shared preferences. It's always fun and you find a lot of stuff. And for the developers, please don't use this again. We talked about this two years ago in last year about shared preferences. And yeah, there are for sure more apps that don't understand or developers that don't understand this. So please don't do this again. Good. So this was it from my side. I will now hand over to Stefan who will continue with the remaining slides. Okay. Thank you. Thank you. I will explain the rest of our findings and vulnerabilities now. First, the client side and communication vulnerabilities. And for the people who are not aware about the concept, a few words about man in the middle attacks. The basic idea is just to get as an attacker between the communication, so between the user and the back end and try to eavesdrop or even manipulate the communication. If, for instance, the app communicates in plain text, this would be very easy for an attacker because he can read everything, change data and so on. Another case would if the app has implementation flaws like it uses broken encryption or has errors so that the attackers easily can bypass the encryption. And the last step, so this would be the only reliable protection against man in the middle attacker to implement secure, correct, and confidential, integrity protected, authenticated communication. So our first step mentioned man in the middle attack. We had an application where it was required to sign in and we wanted to know how secure is this login process. So as a user, you have to enter your credentials. As an attacker, we observe them. The first thing you can see is a HTTP connection, so it's plain text. So man in the middle attacker would be able to read the plain text credentials. But as you can see in the sketch request, there are not our credentials. So we replied a few times to get or to see some pattern. And as you can see, we have different parameter names and different parameter positions, but we have always two same parameter values. So this looks interesting and we dig now into the code to find more about the implementation. The first thing we saw was a hard coded encryption key. Reverse engineering then this algorithm, we saw, okay, the user data or the user name is XORed with this key, base 64 encoded. And there was a predefined set of random values. One of them was randomly picked and combined with the username. This is the same procedure for the password. So this means if we now can as a man in the middle attacker observe the traffic, we just simply take the value, decode it, XOR it and we get the credentials in plain text. The other parameters we saw also were garbage. So we had two additional parameters that were also randomly selected from a predefined set. But they had no value. And this is some kind of weird obfuscation. We don't know why this was done by the developer, but it's the wrong way. So as I said, if you were able to eavesdrop this data, you can decrypt it, get the login data and authenticate. How to do it rightly in Android. So secure communication is not so hard. You just have to do an HTTPS connection, use TLS 1.2 or then later 1.3. You just need a valid server certificate to get it for free, for instance, from let's encrypt. And on the Android side, doing HTTPS is very easy. Define a new URL object, open a connection. Yeah. And that's all. Then it's done. Okay. So the next thing we saw, problems with authentication. A secret already mentioned, the apps are transferring all the tracking and location data to some kind of back end. In most cases, the back end hosts the database. And if you want to connect to a database, for instance, in Android, you have to instantiate the database driver and then you have to establish a connection. Now, what we saw in the application is a typical pattern, how you should not do it in an application. At first, they establish the connection, so you need the URL, you need a login name and you need a password. And the problem is now the password is stored in the application. This means everybody who has access to the application or to this code can simply extract the password. So the username has the URL and has complete access to the back end storage where all the data was stored. We had a few apps. Here you see a simplified database scheme. So this back end stores the email address, some name, and especially also the location information. And in our findings, we in common had 860,000 different tracking apps or locations. And even if you make regular requests or query, you also can observe or track the people in real time because the app regularly sends updated data to this database. That's not all, of course. So when we looked also in the code a bit step further, we thought, okay, yeah, SQL. So for SQL, you should in the right way use prepared statements. You can see, okay, they already defined a prepared statement. And now we would expect some method which will set the values in this statement. But what we see was they overwrite the prepared statement with a concatenated statement. And as a user, you can for instance control the email address. And in this sample what you see here is a classic SQL injection vulnerability. So the app is broken already by design, but we stumbled above this additionally.  Okay, now there are more exciting things. Let's get to the servers which are hosting all the data. A secret already introduced. We need an authentication process and authorization process. And we try to analyze and find if there are problems, design flaws or other vulnerabilities to bypass or break these processes. So we have different, let's say, stages of vulnerabilities and findings in some five. And I will now explain the different findings on the server side. So the first thing is not really a vulnerability. It's more, let's say, a feature or a usability thing. The application after the installation has by design or by default an option which says all located and tracked data are sent to the back end and everybody has access. This means they are freely accessible. So this is kind of, let's say, design flaw. A better option would be some opt-in where default is not everybody can access it. And if the user agrees, he can activate that everybody can access this data. How looks this data? Or how can you access it? It's very easy. You just need to know the website and the username of the person you want to track or want to listen. And for this, we have prepared a short demo video. So if you go to the website, you just, as I said, you have to know the URL of the website. Then you have to enter a username. For this, we choose a random username. We call the user sexy. If you open it, you already see, you get some tracking on Google Maps. Now you can open details. You see when the track was stored. You also click on this track button. You get the correct location, when the track was stored, the starting time. You get some kind of profile information, the altitude and so on. Here you see the altitude diagram. And now you also can track or reply the track of the person. You can see, okay, he's entering his car. You see his speed. He's driving around because of the connection with Google Maps. You can also zoom in or look in detail. So you can see, okay, the person is going to some school. He's driving around and so on. It's also a bit curious. In this track, the person is going to a school at 1 p.m. She's moving between the school and the ATM several times. Don't ask what she's doing or he's doing there. And yeah, at the end, she's going back to his home address. Okay. As I said, this was just a feature. This was not really a bug. But this is not all. We also stumbled about a bug in this website. So this is not a feature. This is a bug in form of an XSS. So next step, authentication problems. Sometimes you have the impression, yeah, authentication what. We took another application. If you look at the traffic of the application or reverse engineer code, you see some HTTP request in there. It's already mentioned. Nothing new. Plain text communication. Then we have a user ID. The user ID is the idea of the user itself. So the person wants to monitor something. This user ID was protected by Caesar encryption. I don't know why it makes no sense. Then we have the child ID. This is the idea of the person you want to observe. This is a simple 10-digit large number. And we have the current date. This is the date when the last tracking of the person was stored. And as you can see, this is not a very complex request. If you can also trial or guess this child ID, the person you want to monitor, if you enter this, the host responds the whole track of the person. We choose this tracking data and printed it into some Google Maps. And here you see some tracking profile of one of our students. And this is completely accessible without any authentication login process or whatever. Everybody who knows this URL can track other persons. Okay. Secret already introduced some additional features. Apps also have the possibility to send or track text messages. And the question was, can we also get these messages? Oh, sorry. If you look into the traffic again to get a message from the monitored person, you have to make a simple, there's an API. You have to make a simple post request. You get a number, how much SMS you want to have from this user and his user ID. So after that you get a timestamp and the phone number and the messages the monitored person sent. Now what happens if you let the user ID empty? You get all stored text messages from the server. Yeah. Okay. So as you see, this is not rocket science. We have no real complex exploits. You just have to know how to use your browser and send a URL. Now we get into exploiting. We have fewer SQL injection. Very simple. So again, we have another type of app. And in this app it's also possible to track a person. Here you have to know the mobile number of the person. So this means the backend provides an API. If you enter the mobile number, you get the longitude, latitude, the location, timestamp of the person you want to monitor. Okay. Now a little spoiler. We are talking about SQL injection. So what do you think what happens if you do this? Yes, you get all data, phone number, location data from the backend. If you look at the history, the first recording started in the year 2016. That's all. Simple SQL injection. The next one is a bit more, let's say, complex SQL. Secret also mentioned additional features like messenger functions so people can, for instance, with your girlfriend, you can exchange images. As in the usual messenger, these images are stored on a cloud system. And of course there's one cloud for all images. Not every user has his own cloud. And in this case, the user needs to authenticate at the cloud backend. Now also filter. This means, okay, this user has authenticated. The images belong to the user.  The question is now, can we somehow bypass this authentication or were we able to compromise the cloud? Spoiler, a little demo. So if you take a look at this cloud, it already provides some simple web interface. By the way, we have to obfuscate the URL because this bug was still not fixed from the vendor. So the cloud storage provides us some kind of simple web interface. But you see with you enter the URL in the browser, we get no images because we are not authenticated. And we are in the section SQL injection. So let's try a simple SQL injection at the parameter. That should be in the upper corner, a bigger image of the SQL injection. You can see it here. And surprise, surprise, we get a preview of the images stored on the cloud system. We can also open this images and download. And as you can imagine, if people are exchanging images and have the possibility to exchange images, they also will exchange not just burgers or selfies, they will also exchange more private or sensitive information. Let's say from the section of adult entertainment and so on. So we also found very sensitive data on the cloud. And yes, I cannot say how much data. We did not count them or download them because of privacy reason and so on. And as I said, the bug is still not fixed. Okay. And so this way we would be able to dump all images. So yeah, thank you. Then the last step, these were just images. Now we want to go to the crown jewels. So can we get the credentials? And one of our application had a strange, let's say installation process. So the app were able to recognize if it was already installed on the device. So they had some special installation procedure. This means when you install the app the first time, it's generated some kind of device ID and stores this on the back end. And you remove the application and reinstall it. It requests to the server for the device ID and compares and is able to detect, okay, I already was installed on this device. And if it realized that it already was installed on the device, the server already sends the username and the password and the email address back to the application. So our first idea was, okay, the device ID, how can we spool it? But the problem is the device ID is a long number. It's very complex. And then it's a domestic number. You can perhaps reproduce it, but it's not the best way. So our other trick, let's the idea empty does also not work. So let's try an SQL injection. Here you see a little curl command, which is doing the request with the SQL injection. And what we get was a stored user credentials, the username, user ID, the password in plain text. Now you can imagine, we can iterate over all values. And all in all we were able to or could extract over 1.7 million data passwords credentials, everything in plain text.  So then, okay, there's more. Surprise, surprise. A few words at first about Firebase, who is not aware of it. Firebase is a service from Google supporting web or app developer. They're providing service for crash analyzers, cloud messaging or storage. In our case, we focus on two services. The one is a real-time database. And the other thing is an authentication process or an API for this. So just imagine this real-time database like a classical database if you're not aware about this Firebase service. So we have another app. They have implemented an authentication process. They hosted their own authentication server. And as a user or as an attacker, at first you have to send a login request. For this, you have to send the user email. In our case, as an attacker, we will send the victim's email. On this backend, there's a database, a classic database with a public available table. And this table stores the user email and the corresponding user ID. And so if you're sending your post request, the database is curing the database. If he finds the corresponding email address, he replies this user ID. In the next step, the app now tries to access to this Firebase database by sending the user and this queried or corresponding user ID to get access to the stored data. So we're querying in this user ID, in this publicly available table. And as a response, we get the location data, the address, date when the request was sent. So this was the first thing. And as you can imagine, guessing the email address, you will get really easy access. I'm sorry I have found in this movie not a better face palm, but this is the first one. So in the next step, you see the app or the database back and also replies the user credentials back to the app. The question is now why? Yeah. This is an example how you should not do it. The developer implemented a client side verification. This means they're expecting the credentials from the server and comparing it in the application and if it's correct, they allow access. So think you're aware of it. It's not the correct way how to do this. Another thing is our old trick. What do you think what happens if you remove the user ID? Of course, we get all stored data from this database containing location, address data, user credentials, security token, whatever.  So it's sometimes easy to bash people. So what's the problem here? The first thing is they did not set any authorization rules on the Firebase. This is always a common problem developer are not aware about this thing and they use some default configuration and then the authorization is disabled. Further thing as I explained, if you're doing authentication, you don't do it on the client side. You have to do this on the server side. And especially if you want to work with Firebase, then use the SDK. Don't construct any strange code constructs by yourself. The SDK supports Google sign in, you can use custom email, password sign in, Facebook, whatever. They already implemented it in the correct way in this SDK. It's also possible to use your own authentication back end. There's a good tutorial on the Firebase side. If you do this step by step, you're on the right way. But don't do anything with public available databases, construction and other weird things. Okay. A few experiences about our responsibility disclosure process. Of course, we informed all vendors. We gave them 90 days to fix them but 90 days are not strict. If the vendor says, okay, I need longer because of some development cycles or whatever, we say it's okay as long as you fix it. This time we got a few strange reaction. The first one is as expected. We will fix it. Thank you. Everybody is fine. The second is, yeah, sometimes you have no reaction. One reacted, how much money do you want? They thought we want to eavesdrop them but then we clarified, no, just won't give you the report. Please fix it. Yeah, the last thing, it's not a bug. It's a feature. For this people, a manufacturer who do not react on our emails, we try to involve Google. Google has this app security improvement team and also security team. We wrote an email to them, send the advisories, reports everything but we did not get any direct replay or any reaction. Last week we checked the store and 12 of the applications were removed so seven are still vulnerable. I also, the demo video you saw, this back end is still active and nobody is reacting. So a short summary of our talk. As always, as you saw, don't use plain text communication. Mobile is a radio communication. In most cases it's very easy to eavesdrop, sniff or manipulate your data. SQL prepared statements. It's nothing new. Each, especially Android, they provide a huge API for SQL and prepared statements. If you're doing app development, don't just focus on the app. If you use back end, this is a bunch, you have to consider also the security on the back end side. And very important also, don't store any user secrets like passwords, encryption keys, whatever on the client side. Everybody who has access to the app and there are a lot of people who are like reverse engineering Android apps, it's very easy to extract the information. Also, Siegfried already explained the shared preference thing. If you have anything, any special feature or you need a license, Google provides an API for this. And also if you're working with Firebase, use, read the Firebase tutorials, use the authentication and authorization API they provide. Here you see at the end, again, a list of the apps we analyzed. As you can see, the left column are the apps with the client side vulnerability. The right side, these were apps where the back end is involved, where we are able to access location data or even all storage data. If you look at the table, nearly all apps, especially on the back end, were vulnerable against some type of attack. So this is the end of the talk. So thank you for your attention. To two last words, all our findings, we wrote also for the vendor, we wrote advisories. The advisories are accessible on the website, final on the findings. And also for the vendor, we wrote advisories. The advisories are accessible on the website, final on the findings. And the last thing who wants to talk with us or discuss or has a question, come to us, grab a cool beer. We also have a bottle opener so you don't have to be thirsty. And thank you again.


Welcome to the session on RATPAC. The idea here is to give a foot for thought, like we have been building a STTP application. By that, I mean both the traditional web applications plus the rest services, what they're using. So we have been building these for quite some time, but can that be done in a better way? Can there be a better programming model for that right on JVM? I'm sure all of you have learned a lot about functional programming and might have got inspired by that. But if your day job is to develop pretty much on JVM, then how some of these good ideas can be brought on to JVM and use them. So RATPAC is one such effort. So you could call it anywhere between a library and a framework. It's not so opinionated as many frameworks, but it's a good tool for developing a lightweight, say, microservices or gateway to microservices, REST API for mobile device or so. So that's where RATPAC stands. RATPAC was started about maybe three years back as a groovy version of Sinatra. But later on people found that much more can be done on that right by changing the programming model. So as of today, RATPAC core is totally a Java 8 library. On top of that, you have a small groovy layer, which makes it very easy to write a few DSLs rather than writing full-fledged methods. But Java 8 does have lambdas, which will make the life a little bit easier. But if I were to do everything in Java 8, probably we can look at only a few examples. So it might take quite a bit of time to explain how old programming is. So that kind of readability is what groovy DSL will bring in. I don't have any more slides, so I'll right away get into the code and explain all the concepts or the programming model for what I want to highlight using code. But before jumping on to that, the traditional programming model is the thread per request. So whenever a request come, I mean, the server would have already created few hundred threads and is ready to serve the request. So whenever a request comes, a thread is allocated for that request. And throughout the processing of that request, the thread is allocated only to that particular request. But serving request involves several IOs, maybe calling the reading file, making the database calls, or maybe calling some web services and getting the response. So all these times, the thread will get blocked. So what this leads to is that non-optimum utilization of resource.


Hello, this is Mark Schmidt with Cloud Platforms Business Unit at Red Hat. Today we'll be walking through an OpenShift 4.0 installation on AWS. First thing we'll need to do is configure the NS zone in AWS Route 53. I've pre-configured the following domain in Route 53 and we'll just verify that with the simple dig command. Next we'll create an admin user in AWS IAM. You will need to make sure that it has admin access privileges and you will want to ensure that you store the AWS access key as well as the secret access key for the installation process. Next you can download the OpenShift 4 installer by going to cloud.openship.com backslash clusters backslash install. That will redirect you to GitHub. OpenShift installer releases. At this point you can select the appropriate binary for your Workstation OS, either Linux or Mac. Once the download is completed then you can rename the installer and then make it executable. You'll also want to download the pull secret and save that as well as you'll need that during the interactive OpenShift installer. Before running the install it should be noted that if you have default settings on your AWS account for resource limits you may want to expand your elastic IP range from 5 which is the default to 10 so that you don't run into resource limitations during the install. You can now kick off the OpenShift installer with create cluster variables. You'll need to give the public SSH key. If you don't have one SSH-keygen will generate that for you. At this point you can enter your AWS access key as well as your secret access key from when the user was created earlier. Now you can select your region and provide the DNS domain that was previously determined. At this point you can select the cluster name and then you'll need to copy the pull secret and paste that. It takes approximately 15 to 20 minutes to spin up the appropriate AWS resources to give you a three master, three worker cluster. We'll speed that up for the second brevity. Now that the cluster is installed you can feel free to explore the cluster via the OC command line interface or via the web console with the username Cubadmin and the password provided. To tear down the cluster you simply issue the OpenShift install command with destroy cluster variables and that tears down all of the associated AWS resources that were originally built.


Hello Columbia and welcome to This Week in the City, where we bring you highlights from the Public Relations Media and Marketing Department with the City of Columbia. In our highlights this week, on Tuesday, December 6th, Columbia City Council will hold a regular scheduled meeting at 4 p.m. at City Hall, located at 1737 Main Street. This meeting will be live streamed and it's also hybrid if you would like to attend in person. The meeting will be held at City Hall and Council Chambers. For agenda items, please visit our website at columbiasc.gov. On Wednesday, December 7th, join us for the All Access Resource Fair. On December 7th, the Community Development Department and the Office of Business Opportunities will host the All Access Columbia Resource Fair. It will also include a donation drive. This event will be held at the Busby Street Community Center at 1735 Busby Street from 5 p.m. until 8 p.m. No registration is required. This is a walk in and walk through event for the general public. Again, come out to see vendors and exhibitors and receive important resource information from various departments and other local agencies. For additional information, contact Community Development by calling 545-3373. On December 8th, the Planning Commission will meet at Columbia City Hall and Council Chambers on the third floor. The meeting will begin at 4 p.m. The meeting will be hybrid, which means you can watch the live stream from our website and the City's YouTube channel or you can attend the meeting in person. For agenda items, please visit our website at columbiasc.gov. And on Friday, December 9th, Friday, December 9th is the deadline date for accepting applications for students who would like to apply to receive a scholarship through the Dr. Martin Luther King Dreamkeeper Scholarship Awards Program. Again, all applications must be postmarked by Friday, December 9th, 2022. For additional information regarding these scholarship applications, please call Public Relations, Media and Marketing at 545-3020. Also on Friday, December 9th, it's time for Food Truck Fridays. On Friday, December 9th, Food Truck Fridays will be held from 11 a.m. until 3 p.m. in the parking lot of the REI co-op located at 2300 Bull Street. Vendors for December 9th include K&C's Kitchen, Bubbalicious, and Carolina Donut Diva. Well, that wraps up this week in the city. If you have any questions about any of the events or information that we've shared, please contact the Public Relations, Media and Marketing Department by calling<PHONE_NUMBER>. Or you may email us at pio at columbiasc.gov. Thank you for watching and make sure you stay connected by following us on social media, on Facebook, Twitter and Instagram, and also stay connected by watching us on city TV. Again, if you have any questions, contact us and remember we are Columbia.


Great. So how will you be sharing your learning, whether formally, informally, with your colleagues? Formally, I'm not really sure. We haven't been asked yet. Informally, I've kind of shared it with some of my great rival team, shared some of the graphic organizers, some of the ideas. So, so far that's pretty much all I've done. Yeah, that'll be the same for me with my teaching partner because we just share things about our science and social studies, so just sharing some of those organizers.