Recently, a coworker of mine approached me regarding an Android application that was using the SQLCipher library. For those unfamiliar with SQLCipher, it provides "transparent, secure 256-bit AES encryption" of Android SQLite3 databases, which is something that many security professionals recommend (myself included). In order to see the actual data inside the database, it is often necessary to obtain the password used to perform the encryption, which can be tricky if it is not just in plain-text in the APK.
@MDSecLabs wrote a blog post a little over a year ago that describes how the SQLCipher library works, and how it is possible to obtain database encryption keys using the CydiaSubstrate, a hooking framework. They also provide a Cydia "tweak" that can be used to steal the SQLCipher encryption key used by an application (for testing purposes), which is exactly what my coworker was interested in!
Unfortunately, the CydiaSubstrate doesn't always work on all devices (in my experience), and doesn't overall seem as maintained as the Xposed framework, which accomplishes roughly the same goal. After downgrading his test device from Lollipop (to Jelly Bean) and installing the MDSec Cydia tweak, he was still unable to get the secret key to print in the log buffers, even though the test application provided by MDSec worked fine. What gives?
It turns out that the SQLCipher library has changed a bit since MDSec created their tweak, and there are now new overloaded variants of the "openOrCreateDatabase" method, which is what MDSec is attempting to hook (you can see the current methods here). Depending on how the application you're testing uses the SQLCipher API, you may see the key printed in the logs.
I did some quick Googling and did not see an Xposed version of the MDSec tweak, so I decided to write my own variation. To use it, you'll need a rooted device and the Xposed framework installed. You can download the APK from my GitHub.
Now, you can install the APK, reboot your device, and use your SQLCipher enabled app as you normally would. In a different window, check the logcat buffers for the secret key used by the application. Here are the contents of the log buffers when running the MDSec MyEncryptedApp test application.
Thanks to MDSec for doing the research in determine the appropriate method to hook and for creating the Cydia tweak. If anyone has any questions or feature requests, feel free to reach out to me!
@MDSecLabs wrote a blog post a little over a year ago that describes how the SQLCipher library works, and how it is possible to obtain database encryption keys using the CydiaSubstrate, a hooking framework. They also provide a Cydia "tweak" that can be used to steal the SQLCipher encryption key used by an application (for testing purposes), which is exactly what my coworker was interested in!
Unfortunately, the CydiaSubstrate doesn't always work on all devices (in my experience), and doesn't overall seem as maintained as the Xposed framework, which accomplishes roughly the same goal. After downgrading his test device from Lollipop (to Jelly Bean) and installing the MDSec Cydia tweak, he was still unable to get the secret key to print in the log buffers, even though the test application provided by MDSec worked fine. What gives?
It turns out that the SQLCipher library has changed a bit since MDSec created their tweak, and there are now new overloaded variants of the "openOrCreateDatabase" method, which is what MDSec is attempting to hook (you can see the current methods here). Depending on how the application you're testing uses the SQLCipher API, you may see the key printed in the logs.
I did some quick Googling and did not see an Xposed version of the MDSec tweak, so I decided to write my own variation. To use it, you'll need a rooted device and the Xposed framework installed. You can download the APK from my GitHub.
Now, you can install the APK, reboot your device, and use your SQLCipher enabled app as you normally would. In a different window, check the logcat buffers for the secret key used by the application. Here are the contents of the log buffers when running the MDSec MyEncryptedApp test application.
Thanks to MDSec for doing the research in determine the appropriate method to hook and for creating the Cydia tweak. If anyone has any questions or feature requests, feel free to reach out to me!
Links
- MDSec - SQLCipher Crypto Keys with CydiaSubstrate
- Xposed APK installer
- SqlCipherHook [APK] [source]