IEEE Consumer Electronics Magazine - May 2018 - 49

User Credential
Cloning Attacks
in Android Applications
Exploiting automatic login on Android apps and mitigating strategies.
By Junsung Cho, Dayeon Kim, and Hyoungshick Kim

utomatic login is a commonly used feature
of smartphones, because their small keyboards
make it difficult to key in user credential information. However, this feature may pose a serious risk
to smartphone users' privacy. The stored data for
automatic login could be stolen by an attacker, resulting in
identity theft. In this article, we demonstrate an execution of
this attack in a systematic manner through two real-world
Android application case studies by implementing a prototype. We also discuss five possible defense strategies to mitigate the risk of user credential data being stolen from the
application files.

AUTOMATIC LOGIN VULNERABILITY
Automatic login is a feature for user authentication whereby
user credentials are stored locally and used when verification
is required. It is frequently provided as a common means to
enhance convenience by avoiding the necessity of keying a
user name and password into an application (e.g., a web
page) each time it is accessed.
Automatic login is useful, but it can be harmful as well; the
stored user credentials can be stolen or misused by unauthorized parties. For example, many websites offer the opportunity
to remain logged in to a website via a browser-saved cookie
that caches the user credential information. However, cookies
can simply be stolen [1] and used by an attacker to impersonate someone. In the worst-case scenario, if the stored credential is used for a single sign-on authentication system (e.g., a
Google account), then the attacker would have access to all
the services it protects. Also, anyone having physical access to
a system using an automatic login could unlock it without a
victim's password even when it cannot be stolen.

In this article, we revisit this problem, focusing on a different domain of the Android platform and present a generic
attack strategy called a user credential cloning attack, which
might be a serious threat to Android applications that support
the automatic login feature. This attack is an attempt by a
malefactor to steal a victim's credential data from his or her
Android app and log in to the victim's account using these
stolen access rights via the attacker's Android application. In
practice, people tend to prefer the automatic login feature in
small-touchscreen smartphones in particular, as opposed to
personal computer (PC) environments, because of its quickness and convenience [2], [3]. The majority of existing
Android apps (e.g., Facebook, Twitter, and Skype) support
the automatic login feature by default. We show how the user
credential cloning attack can be effectively devised against
such Android applications.
To show the feasibility of the proposed attack strategy, we
implemented the user credential cloning attack against two
Android applications, Starbucks and MOCI. The Starbucks
application provides various services, such as paying for orders,
earning loyalty rewards, and finding stores. MOCI is a wellknown anonymous social networking application (https://www
.moci.kr/) in South Korea. For Starbucks, we can see that a
user's authentication credentials are stored in an Extensible
Markup Language file called Shared Preferences
(com.starbucks.co_preferences.xml) to manage
an application's private primitive data in key-value pairs. For
MOCI, a user's authentication credentials are stored in SQLite
Databases (moci.sqlite). If an attacker obtains this kind
of file from a victim's app and replaces his or her own file with
the victim's, the attacker can log in to the victim's account via
the automatic login feature.
MAy 2018

IEEE Consumer Electronics Magazine

http://www.moci.kr/ http://www.moci.kr/

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - May 2018