DroidKex: Fast extraction of ephemeral TLS keys from the memory of Android apps. (July 2018)

• Record Type: Journal Article
• Authors: Taubmann, Benjamin; Alabduljaleel, Omar; Reiser, Hans P.
• Is Part Of: Digital investigation. Volume 26(2018)Supplement
• Page Start: S67
• Page End: S76
• Publication Date: 2018-07
• Subjects: Memory forensics -- Semantic gap -- TLS -- Android; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2018.04.013
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: Fast extraction of ephemeral data from the memory of a running process without affecting the performance of the analyzed program is a problem when the location and data structure layout of the information is not known. In this paper, we introduce DroidKex, an approach for partially reconstructing the semantics of data structures in order to minimize the overhead required for extracting information from the memory of applications. We demonstrate the practicability of our approach by applying it to 86Android applications in order to extract the cryptographic key material of TLS connections.