Androwarn

 ANDROWARN: AN ANROID TOOL

AndroWarn is a security tool and framework designed for analyzing and assessing the security of Android applications. It focuses on identifying potential security vulnerabilities and risks in Android apps. The name "AndroWarn" suggests its purpose: warning or alerting developers and security professionals about potential security issues in Android applications.

AndroWarn typically performs static analysis, which involves analyzing the source code or compiled code of an Android app without actually executing it. This allows it to identify security issues without running the app on a device or emulator. It can help detect vulnerabilities such as insecure storage of sensitive data, improper permission usage, code vulnerabilities, and potential privacy risks.

Androwarn works on mainly 3 modes i.e.

Essential Mode (-v 1)

Advanced Mode (-v 2)

Expert Mode (-v 3)

You can easily save your report in either plaintext or formatted HTML format.

CHARACTERISTICS:

Exfiltration of Telephony Identifiers: This involves the unauthorized extraction of sensitive telephony identifiers such as IMEI, IMSI, MCC, MNC, LAC, CID, and the operator's name.

Unauthorized Device Settings Access: The tool accesses and retrieves device settings without proper authorization, including software versions, usage statistics, system settings, and logs.

Leakage of Geo-location Information: The tool allows for the leakage of geo-location information, including GPS and Wi-Fi-based location data.

Exfiltration of Connection Interfaces Details: This involves the unauthorized extraction of connection interface details such as Wi-Fi credentials and Bluetooth MAC addresses.

Abuse of Telephony Services: The tool is capable of misusing telephony services for actions such as sending premium SMS messages or initiating unauthorized phone calls.

Interception of Audio/Video Streams: The tool enables the interception of audio and video streams, potentially facilitating actions like call recording and video capture without consent.

Establishment of Remote Connections: The tool can establish connections remotely through actions like initiating socket calls, Bluetooth pairing, and editing APN settings.

Leakage of Personal Information Management (PIM) Data: This refers to the unauthorized access and leakage of personal data such as contacts, calendar events, SMS messages, and emails.

Operations on External Memory: The tool enables unauthorized access and operations on external memory, such as accessing files on SD cards.

Modification of PIM Data: The tool allows for the unauthorized modification of PIM data, including actions like adding or deleting contacts and calendar events.

Execution of Arbitrary Code: The tool facilitates the execution of arbitrary code, which may include native code using JNI, UNIX commands, and actions that lead to privilege escalation.

Denial of Service Attacks: This involves actions that can disable or disrupt the normal functioning of the device, such as deactivating event notifications, deleting files, terminating processes, disabling virtual keyboards, and initiating shutdown or reboot operations.

STEPS FOR INSTALLATION

Step1: Open your terminal/command prompt and run the following command to clone the QARK repository:

git clone https://github.com/maaaaz/androwarn.git

Step2: To navigate change your working directory to the QARK folder that was created:

cd androwarn

Step3: The required dependencies are listed in the "requirements.txt" file. You can install these dependencies by executing the following commands.

pip install -r requirements.txt

Step4: This command will display information about how to use ANDROWARN and the available command-line options.

python androwarn.py –h

HOW TO USE IT:

You can analyse the target application using the provided format outlined below:

python androwarn.py –i <target .apk file> –r <desired report format> –v <desired report level>

Here, the flag -i signifies the INPUT, -r designates the REPORT, and -v represents the REPORT LEVEL. The -r option can be specified as either text, HTML, or JSON format. Similarly, -v can be set to 1 (for beginners), 2 (for advanced users), or 3 (for expert users).

In the example, we have analyzed the Faceapp application using Androwarn tool to see if it actually violates users’ privacy. Herer, the report is in HTML file.