Okay.
Before we move on with our services, let's have some kind of bonus video regarding to our broadcast
receivers.
In the last video we have seen how to explode broadcast receiver based on the ADB shell, but this is
something the customer might not accept.
So the customer might think that the attacker needs access to the ADB shell.
So physical access to this device to exploit this broadcast receiver, which is definitely not the case.
Therefore, in this video over here, we want to write our own malicious application which is able to
trigger this broadcast receiver to arm and disarm the alarm system and to make this a fully proof of
concept that no physical access is required.
We would have some kind of network interaction.
So the malicious application needs to send a network request to our server so the the server of the
attacker and then the attacker has the control over the arming and disarming process based on a network
connection.
But then we would dive too deep into this.
Therefore, let's handle it with an within simple application right now.
All right, let's go.
All right, give me a packet Ubuntu VM.
And the part we're going to do right now is not really related to the course because now we are doing
some app development and we are here to hack those applications, not to develop them.
Okay.
So in case if this is now a little bit much input, don't worry, you do not need to notice stuff.
Nevertheless, I would like to show you how you can write simple applications to perform certain tasks.
So, for example, to make a simple demonstration app for this broadcast receiver, how to exploit it
already.
Okay, so simply relax, lean back a little bit and then yeah, then I can show you how to write this
application.
Okay.
In case if you want to join me, feel free to do so.
And in case of any questions also regarding to app development, write them in the comment section underneath.
Alrighty.
Okay, let's go.
So the first thing we need to do is we need to start our ID where we want to write our application.
And this is our Android studio.
So within two months, Android studio, Ben, we've got this studio dot as a script, this one.
And we're going to start this right now.
It's close, this one.
So the ID is loading and this might take a while.
So I will see you in a moment.
Alrighty.
So the ID has finished loading and this is our old project.
So we have simply included this one into the Android studio.
Okay.
Now we want to create a new one and we go into file.
New.
New project.
And then we are choosing empty activity.
So this is simply just creating an activity with no content, I guess simply just in helloworld or things
like this.
So we do not have overloaded code in our application.
Okay.
Next then we give this a name broadcast hacking and here we have to select Java.
You can also use Kotlin, but I like to use Java and then you have to make the decision our minimum
SDK in our case or in my case right now I go back to nougat, but we can also go back way further,
for example, to Android Marshmallow and things like this.
But then we have to download those SDK s.
So I will stay with nougat right now.
Okay.
We can also see this is running approximately on 90% of all devices.
So that's that's pretty compatible.
All right.
And then we simply use finish here.
This is all we have to set.
Yes.
Okay.
We can close this one, but we keep it in the background because we will need those information.
So now our project is being generated.
We can observe this at the Gradle build.
So it's now creating all those files, including the Android libraries, including our creating this
main activity, the layout for this and things like this.
So I will see you after this process has been finished.
Welcome back.
So the process has been finished and now we have our our application code.
We could already run this application because this is its working application right now.
Let's try this out.
Therefore, we're using the emulator and this one over here.
We are starting it.
Once again, this warning.
And here we now have the emulator.
So if you want to build and run this application, we have to select our emulator over here and then
we simply hit this play button.
Let's keep this in foreground.
So now the application is going to be built.
Then it will be connected.
Or the idea works.
The Android studio is connecting to our device and automatically installing this application.
So we do not need to do anything right now.
Okay, great invocation.
Finish.
And we have our application.
So this is the application we have created.
I guess it's the loading.
Yes, here we have it.
Broadcast hacking.
Hello world.
All right.
So now the question we asked is hello world text being defined because we cannot see it over here if
we are having an activity.
We also having an exam lay layout regarding to this activity.
So this this XML layout is describing what's, what's being shown over here.
We can find this within resources.
Layout and TV have it activity main.
Okay.
We got this this week, Ed, or we can use the XML structure.
I like to do it in a combination of both, so it's way easier to change the text over here, for example,
then doing this in the graphical output because it's a little bit laggy hitting broadcast receiver.
So now if we go back to the design, then we have changed this text over here.
Let's try zoom in a little bit.
Okay.
So now what we want to do is we want to include one button over here.
And every time we are pressing this button, the application is sending out an intent.
For example, what this are, we can also make it more complex with text input fields and stuff like
this.
But yeah, let's keep it simple at the beginning.
Okay, so on the left we've got now our our object.
So we simply take this button and click it into this one.
All right.
Here we have now our button.
The button has this this arrow, because this button has not been constrained to layout, which means
the application doesn't know where to put this pattern right now.
I mean, for this resolution, it would work that it might appear like this one.
But if we're having different display sizes, it's unclear where this button has to be placed.
And therefore, we have to tell this to the 2D layout.
So we have to make it fixed at a certain position.
We can do this super easily.
We simply go into this bubble.
We hold the left mouse button and then simply click this arrow underneath this one.
So it's floating around a little bit, but do not get distracted by this one.
This means now the button is under this this text view.
All right?
So far so good.
But the application still doesn't know.
Is, is it in the middle?
Is it more left or more right?
To do this, we simply have to put the left corner here, the round button and drag and drop it to the
left.
Now it would be underneath this text on the left.
And if you're doing the same for the right, then it will be perfectly aligned in the middle.
It's now a little bit too too near to this hacking broadcast receiver.
So therefore, let's add some margin over here, for example, 40.
All right.
This is now our button.
Let's go back into the code part.
I would like to increase the text size a little bit so we can do this with Android and then text size
on let's say 28 DPI.
And so DPI or I guess earlier it was named deep which was density density independent pixel, I guess.
So please don't quote me on this one.
It's simply just another format regarding to pixel.
So if we are having pixels, then those pixels are they are changing regarding to the resolution of
our screen.
They might be smaller or larger, but those density independent pixels, they stay the same.
So if you're having text size 28, we're having the same the same large font on every display.
So it's not changing in the in the layout.
So yeah, I guess now you know why we are doing app hacking and not an app development.
I hope this explanation is fine for you right now.
Okay, so now we've made this text a little bit larger and if you go back into the design.
Yes.
Oh, it's a little bit too large.
Maybe.
Let's go back to 24.
All right.
This looks good over here.
We've got the the text for this button, and we can simply say, let's hack.
Or we can also say, for example, let's give it a meaningful name, this.
All right.
Design.
Yes.
This looks okay.
To make this a little bit more hawkish, we can also provide an black background.
So Android background black.
And we can also apply some new color to this text view.
Oh, I didn't mention this.
Sorry for this.
So this one over here, I mean, that's the text view tech.
We can define all those attributes for this text view over here.
Now the text is black and also the background.
And this one over here, that's the tech for the button.
I'm sorry if I haven't mentioned this.
Okay, so android text color and now we've got some predefined colors and for example, purple, if
you click on this one, then we've got this.
Yeah.
This purple color match looks, I guess.
Okay.
But I mean, it has to be some kind of green, right?
So let's see, green.
Green is not defined.
Those colors are being defined and values, by the way.
So if we go into values, then we've got those colors and let's see, what do we have?
Teal to 100.
This looks absolutely hawkish.
So let's take this one here we have the name and that's the hexadecimal representation of this one.
So we have to insert the name OC.
Now we've got this one.
OC looks good so far.
So now we've got our text, we've got this button, and now let's do the, let's connect this button
to our code.
Because if he now pressing this button, the button doesn't know what to trigger.
And this is now a little bit complicated at the beginning, but later on it will be yeah, it is super
easy if we once have understood the concept behind this.
Don't worry if this is now a little bit much for you right now.
So we are doing some heavily app development regarding two core concepts of an Android application in
just a few minutes.
So don't worry, you do not need to know anything of this.
Regarding to the app hacking course, we will move on with the app hacking like this one over here has
never happened.
All right.
Okay, perfect.
So let's go back into our application code.
We have now defined a little bit of layout.
And over here we are now creating a new function.
The function is simply named this alarm system.
This is the function we want to trigger if are pressing this button and now we have to do following.
The function needs to have a parameter which is in view.
We need to include this view so we we can use all to enter.
Then this view will be imported over here.
And now we can connect this button to this function and that this function knows where it gets triggered.
We have to apply this as a parameter, this view.
So this view will be our button.
And if we click this button, then this button will execute this function.
So the only thing we have to tell our button is to execute this function.
When the button gets pressed and we can do this in the following, we have to go back into our activity
main layout and then we have to go into the code path and then we have to apply Android Colon on click.
And here we have now the method.
We have provided this view.
Therefore this can be triggered by this button and this is all.
So now if you are pressing this button, the button is executing the text over here so we can do a lock
output or we can already insert our code.
Let's first do some lock output.
So System.out.println, button pressed.
The nice thing is we do not have to build install it once again so we can simply hit this this play
button.
Well, first we have to stop this and then we.
We can run it once again.
I guess we should be able to rerun this.
So you might not have to stop this, but nevertheless.
So if I said yes, we simply could play.
Yes, sorry for this.
You can simply run this button once again, run up this one, and then it would.
Yeah, it would refresh.
Okay, cool.
Now we've got our broadcast hacking and looks absolutely hackers and let's see if we are opening now
the ADB logcat.
We should see our text being printed out.
And so let's see.
And 3 to 1.
Button pressed.
Here we have it.
Maybe let's make this a little bit larger.
Then we can see this better.
Okay.
Perfect.
So we can see it's working.
All right.
Now we want to check out this broadcast event.
So we can delete this one Mitch broadcast event.
Let's see.
We have to go into the other application.
This one.
With main activity.
This is our broadcast event we want to trigger, and all we need to do is we need to create new intent,
set the action at this one and send out this intent.
And we can do this all in our function right now.
So over here we can do for the following intent.
Intent is new intent.
Okay.
Then we include our intent and then we are saying, intent, set action.
Now we are providing the action that we want to send.
And of course, something I have missed so far.
We also have to apply our our extra string, extra key values.
So how can we do this?
Well, intent.
And then let's see.
Here we have Kitestring Extra, but I guess we would like to set it so set.
And no, it's not set.
Was it put.
Yes.
Put extra.
Perfect.
So here we have put.
Oh, well, we have to select the correct one.
This one put extra string name and character array and character is the same little string.
And therefore, we we should be probably fine with this one.
Okay.
So we, we want to set our status and then we want to set this on.
All right.
And then we simply have to send this broadcast.
So sent broadcast.
Yes.
We can also see we've got this order broadcast over here.
But in this case right now, we simply want to send out our intent.
All right.
This is all.
Yes.
So now we're having an application which is triggering this broadcast.
It sets the status to disarm.
And if our application is running and receiving it, it will be disarmed based on our malicious application.
Let's find out if this one is working.
So let's save this and let's let's see.
First, let's start our other application first.
So this one over here, I mean, it doesn't it doesn't matter if you're using the SDK 25 or 26 version
because both approaches are working over here.
All right.
So now it's disarmed.
Therefore, let's try it with.
Okay.
So now we are starting this application.
Let's observe the smartphone.
I mean, now our activity will be put into foreground like we see this over here.
And yes, if you are now sending this.
Let's see, adb logcat.
I think there's a large chunk.
All right.
Let's disarm the system in 3 to 1.
Alarms or sorry, we have armed it.
Alarm system armed.
Okay.
I guess regarding to customer presentation, you need a little bit more prepared like I am right now.
Okay.
So now we have armed this alarm system if you are switching back.
Oops.
This was not a switchback.
There we go.
Here we have it.
Now the alarm system has been out.
All right.
We could also do this now.
Based on some inputs.
So we can use an input field and we can say and disarm.
Okay, so for now, this was a lot of input.
So we have created a button we have played around with in layout.
We made it more hackers.
We we created an intent and broadcast intent.
We have put some, some extra string into this one and send it out based on Click Event.
So this was really a lot of input.
Well, however, I mean, the point was not to show you how to write this application that you can now
do this on your own.
I mean, if you have no experience with Android app development, this is definitely not possible by
only seeing it once.
For me, it took weeks to understand the concepts behind this, but as already mentioned, this wasn't
the point.
The point was to show you how you can trigger this event without having ADB access so that you have
a malicious application running on the smartphone.
Like this one over here, not this one.
Our amazing looking hack is broadcast hacking application that can trigger certain events.
For example, starting activities, starting services, starting broadcast receivers interact with them
and things like this.
I mean, we could also do this even more, try hard so we could make a network request, be that the
application is fetching every 10 seconds in certain state from our web server and then triggering this,
this intent, for example, this or this alarm system, then we do not require any user interaction,
but including this is really heavily app development right now.
In case if you are curious about this and you definitely want to have an and video regarding to this
approach, I will extend this bonus video regarding to this one.
But I guess we we are now already too deep into this app development part.
So in this video we had a little bonus section regarding to app development, which is, I mean, it's
not a topic of our course, but I guess it's nice to see.
Nevertheless, we do not have to understand it right now.
We have seen it okay?
We do not have to understand it.
And now we can move on with our core concepts.
All righty.
Okay.
So I'm looking forward to see you in the next section.