HAcking an android based OS

[STRM]

hey all ,

New to the forums

Im working on an android based Operation System (basically a beefed up Androind OS)

and im looking for a way to test it's security

how would you guys go about trying to hack the system

Note that it has an encrypted kernel

and password protection on the recovery, uboot and the shell (A VERY LONG PASSWORD)

with very limited access in shell even after you pass the password (although that's not the issue here)

rooting applications can do nothing against it

its not a mobile device so its not connected to any of the plays stores out there but it has an Ethernet and Wi-Fi connection

any ideas ?

Note that I cant give you any more information 

I also cant give you access to it so the whole thing has to be an intellectual debate i'm afraid

I will check in to see if you have anything for me in a few days

Thanks in advance guys and girls (and vise versa )

p.s I like the forums so far , i got some good insight

[bmxer13]

You could possibly throw metasploit at it. That is also depending on what firmware you have on it. Or try to get a rat to see if you can get passed the security also. Androrat is an older rat but its free if you dig for it. You can also see if the stagefright exploit is still open on your phone also. The possibilities are endless just have to do some digging

[metasploitable]

Using metasploit you can create .apk payloads but it will work when the phone is rooted as i know.

[novaccainne]

Hi,

First, you should read the best practices which are usually used by testers :

- http://resources.infosecinstitute.com/search/?s=android
- https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
- https://groups.google.com/a/owasp.org/forum/#!forum/owasp-mobile-top-10-risks
- https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-2015_Scratchpad
- https://drive.google.com/file/d/0BxOPagp1jPHWRksxQlVWN1hodkE/view
- google : android site:http://resources.infosecinstitute.com/
- https://www.owasp.org/images/0/04/Security_Testing_Guidelines_for_mobile_Apps_-_Florian_Stahl%2BJohannes_Stroeher.pdf
- http://www.enck.org/pubs/enck-sec11.pdf