An Android-based Cellebrite UFED self-defense application

Last update: May 6, 2022

LockUp

An Android-based Cellebrite UFED self-defense application

LockUp is an Android application that will monitor the device for signs for attempts to image it using known forensic tools like the Cellebrite UFED. Here is a blog I wrote.

  • Proof-of-Concept. Not meant as an in-depth defense
  • Android API 28, Does not require root
  • Relies on RECEIVE_BOOT_COMPLETED to start a Service and AccessibilityService
  • Monitors USB events through ACTION_USB_DEVICE, package installations, and known exploit staging locations on the filesystem
  • Detects Logical Extractions, File System Extractions, and Physical Extractions leveraging ADB
  • Will automatically respond with a factory reset with DeviceAdminReceiver
  • Beginning steps to researching more robust anti-forensic techniques

Signature Detection

  • Exploit staging directories and known filenames
  • Known file hashes
  • Application names and certificate metadata

TODO Signatures

  • Binary-level identifiers
  • Hardcoded RSA keys used for ADB authentication (requires root)

Installation

I avoided including everything needed to build LockUp, making this application so accessible that it may be easily used to avoid criminal prosecution was not my goal. Instead, my goal was to help support my research into forensic tools in showing how they aren't immune to software issues.

Author

Matt Bergin, KoreLogic

History

Most recently I presented my research at Blackhat Asia 2021.

I've released security advisories for the Cellebrite UFED which you may also be interested in:

License

Creative Commons Zero 1.0

GitHub

https://github.com/levlesec/lockup
You might also like...

Book Parking is a demo application based on MVVM architecture. The app allows users to booking parking slots, the app uses firebase for the backend.

Book Parking is a demo application based on MVVM architecture. The app allows users to booking parking slots, the app uses firebase for the backend.

Book Parking is a demo application based on MVVM architecture. The app allows users to booking parking slots, the app uses firebase for the backend.

Apr 23, 2022

LeJournal is a news application based on The Guardian API.

LeJournal is a news application based on The Guardian API.

LeJournal Sample project, exploring yet another approach to implementing a clean architecture for an android application. LeJournal is a news applicat

Nov 19, 2021

This console based application calculates sales tax, import duty and provide a way to print the invoice

Sales Tax Problem This console based application calculates sales tax, import du

Dec 17, 2021

The Android Trivia application is an application that asks the user trivia questions about Android development

The Android Trivia application is an application that asks the user trivia questions about Android development

The Android Trivia application is an application that asks the user trivia questions about Android development. It makes use of the Navigation component within Jetpack to move the user between different screens. Each screen is implemented as a Fragment. The app navigates using buttons, the Action Bar, and the Navigation Drawer.

Feb 10, 2022

Android application compatible with ZX2C4's Pass command line application

Android application compatible with ZX2C4's Pass command line application

Password Store Download Documentation We're in the process of rewriting our documentation from scratch, and the work-in-progress state can be seen her

May 14, 2022

Android Phishing Application.This Project is for Educational purposes only.The Developer of this application is not responsible of any bad usage

Android Phishing Application.This Project is for Educational purposes only.The Developer of this application is not responsible of any bad usage

Android Phishing Application.This Project is for Educational purposes only.The Developer of this application is not responsible of any bad usage

Apr 25, 2022

Math World is an Android Application specialized in mathematics, where the application includes some sections related to arithmetic, unit conversion, scientific math laws and constants, as well as some mathematical questions that need some intelligence to reach the solution.

 Math World is an Android Application specialized in mathematics, where the application includes some sections related to arithmetic, unit conversion, scientific math laws and constants, as well as some mathematical questions that need some intelligence to reach the solution.

Math World is an Android Application specialized in mathematics, where the application includes some sections related to arithmetic, unit conversion, scientific math laws and constants, as well as some mathematical questions that need some intelligence to reach the solution.

Mar 12, 2022

Realtime SOS Android Application. Location (GPS + Cellular Network) tracing application by alerting guardians of the User.

WomenSaftey Women Safety Android Application: Realtime SOS Android Application. Designed a Location (GPS + Cellular Network) tracing application by al

Mar 2, 2022
Comments
  • 1. Smartphone got wiped

    Hello,

    my smartphone got wiped on the moment i opened 2 times a .py file in nekogramx(a telegram fork) with the app https://play.google.com/store/apps/details?id=com.rhmsoft.code&hl=gsw&gl=US

    Cant provide any logs due to wipe.

    Im using Blackview BV9700 Pro with Android 9 Security Patch 5. August 2019

    Reviewed by anon97945 at 2021-05-13 11:55
Related tags
Self hosted read and to-read list book tracker
Self hosted read and to-read list book tracker

JELU Official documentation Like Jelu or find it useful ? Offer me a coffee ☕ Purpose This app main purpose is to track what you have read, what you a

May 22, 2022
Application: SLA report This application calculates, based on an input, the average duration per service of Axon.

Application: SLA report This application calculates, based on an input, the average duration per service of Axon.

May 13, 2022
FDPClient-EDITED - A free mixin-based injection hacked-client for Minecraft using Minecraft Forge based on LiquidBounce

FDPClient A free mixin-based injection hacked-client for Minecraft using Minecra

Feb 16, 2022
NewsApp is a an android project based on modern Android application tech-stacks and MVVM architecture.

NewsApp NewsApp is a an android project based on modern Android application tech-stacks and MVVM architecture. This project is for focusing especially

Jan 14, 2022
Geoponics is an E-Commerce Android Based Application Designed for Farmers As Well As Normal Users to Buy and Sell Agricultural goods!
Geoponics is an E-Commerce Android Based Application Designed for Farmers As Well As Normal Users to Buy and Sell Agricultural goods!

Geoponics : E-Commerce Application Geoponics is an E-Commerce Android Based Aplication Designed for Farmers As Well As Normal Users to Buy and Sell Ag

Aug 31, 2021
Blockchain-based android application

Android-Blockchain Blockchain based android application For Reference https://drive.google.com/drive/folders/1w-nPrcIONq1s4RY9yRXSqxcU6gaaE-uN?usp=sha

Dec 23, 2021
Simple Android web-view-based application. The primary purpose is to show the website in Kiosk mode.

Kiosk mode app Simple Android web-view-based application. The primary purpose is to show the website in Kiosk mode. By default, the app works in Scree

Nov 15, 2021
☀️ Wheater is a small demo application based on modern Android tech-stacks and MVVM architecture. ⛅
☀️ Wheater is a small demo application based on modern Android tech-stacks and MVVM architecture. ⛅

Wheater is a small demo application based on modern Android tech-stacks and MVVM architecture. Tech stack & Open-source libraries Minimum SDK level 19

Jan 17, 2022
❤️ A sample Marvel heroes application based on MVVM (ViewModel, Coroutines, LiveData, Room, Repository, Koin) architecture.
❤️ A sample Marvel heroes application based on MVVM (ViewModel, Coroutines, LiveData, Room, Repository, Koin)  architecture.

MarvelHeroes MarvelHeroes is a demo application based on modern Android application tech-stacks and MVVM architecture. Fetching data from the network

May 12, 2022