Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Safety first
Search
Ana Baotić
July 28, 2016
Programming
10
11k
Safety first
Best practices in app security presentation held at the 360AnDev conference in Denver, CO
Ana Baotić
July 28, 2016
Tweet
Share
More Decks by Ana Baotić
See All by Ana Baotić
Inhibiting the impostor
abaotic
2
300
Sign here, please!
abaotic
1
100
Sign here, please!
abaotic
0
160
Break your app before someone else does
abaotic
1
530
Other Decks in Programming
See All in Programming
マイコンでもRustのtestがしたい その2/KernelVM Tokyo 18
tnishinaga
2
2.3k
物語を動かす行動"量" #エンジニアニメ
konifar
14
5.4k
UbieのAIパートナーを支えるコンテキストエンジニアリング実践
syucream
2
670
AI OCR API on Lambdaを Datadogで可視化してみた
nealle
0
170
バイブコーディングの正体——AIエージェントはソフトウェア開発を変えるか?
stakaya
5
1k
WebAssemblyインタプリタを書く ~Component Modelを添えて~
ruccho
1
900
tool ディレクティブを導入してみた感想
sgash708
1
150
kiroでゲームを作ってみた
iriikeita
0
180
オホーツクでコミュニティを立ち上げた理由―地方出身プログラマの挑戦 / TechRAMEN 2025 Conference
lemonade_37
2
490
Infer入門
riru
4
1.6k
令和最新版手のひらコンピュータ
koba789
14
8k
自作OSでDOOMを動かしてみた
zakki0925224
1
1.4k
Featured
See All Featured
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
32
1.4k
Being A Developer After 40
akosma
90
590k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.4k
Building an army of robots
kneath
306
46k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
26
3k
Faster Mobile Websites
deanohume
309
31k
Code Review Best Practice
trishagee
70
19k
Side Projects
sachag
455
43k
Measuring & Analyzing Core Web Vitals
bluesmoon
9
560
Designing Experiences People Love
moore
142
24k
Learning to Love Humans: Emotional Interface Design
aarron
273
40k
jQuery: Nuts, Bolts and Bling
dougneiner
64
7.9k
Transcript
Safety first Best practices in app security ANA BAOTIĆ TECHNICAL
MANAGER, MOBILE BANKING @ INFINUM @ABAOTIC
We're an independent design & development agency.
None
HOW TO INCREASE SECURITY
BUILD INTEGRITY
ADD A RELEASE KEYSTORE TO YOUR PROJECT
KEYSTORE Can be used for ALL build types You should
NEVER lose it No one should EVER acquire it
KEEP IT SECRET, KEEP IT SAFE
signingConfigs { release { storeFile file("myapp.keystore") storePassword "password123" keyAlias "keyAlias"
keyPassword "password789" } } DO NOT!
ONE ALTERNATIVE local.properties KEYSTORE_PASSWORD=password123 KEY_PASSWORD=password789
try { storeFile file("myapp.keystore") storePassword KEYSTORE_PASSWORD keyAlias "keyAlias" keyPassword KEY_PASSWORD
} catch (ex) { throw new InvalidUserDataException(“…”) }
ENABLE OBFUSCATION
release { minifyEnabled true proguardFiles getDefaultProguardFile( 'proguard-android.txt'), ‘proguard-rules.txt'
signingConfig signingConfigs.release } PROGUARD
DOWNSIDES Disliked* Builds fail Staging vs Production
OTHER OPTIONS DexGuard DexProtector
None
public abstract class e { private int a = -1;
private String b = null; protected boolean k = false; public abstract void a(Intent var1); protected final void a(String var1) { this.b = var1; } public final void c() { this.a = -1; this.b = null; } public final boolean d() { return this.k; } }
WILL THIS KEEP THE APK SAFE?
None
ADD TAMPERING DETECTION
Verify signing certificate at runtime Verify the installer context.getPackageManager() .getInstallerPackageName(context.getPackageName())
.startsWith("com.android.vending") Check if app is debuggable (or run on emulator)
DATA PRIVACY
MY PRECIOUS
WAYS TO STORE (AND RETRIEVE) DATA Internal storage External storage
Content providers*
INTERNAL STORAGE Is (generally) sufficiently safe Private to your app
SHARED PREFERENCES Useful for primitive key-value based data
EXTERNAL STORAGE Globally readable and writable
CONTENT PROVIDERS Structured storage mechanism Can be exported (accessed by
other apps)
<provider android:name="com.example.android.datasync.provider.StubProvider" android:authorities="com.example.android.datasync.provider" android:exported=“false"/> android:protectionLevel="signature"
private readable safe Internal storage yes yes yes External storage
no yes no Content providers depends yes yes Shared prefs. yes yes yes
SO EVERYTHING IS FINE?
NOPE.
None
USE LIBRARIES Bouncy Castle Spongy Castle Keyczar AeroGear Crypto Conceal
ENCRYPT USING A PIN/PASSWORD
BCRYPT Slow Key derivation function Cost of hash function →
work factor
CAN DATA REMAIN PRIVATE?
Rooting your device allows access Not encrypting allows (mis)use
NETWORK SECURITY
None
HTTP
HTTPS
MAN IN THE MIDDLE
None
CERTIFICATE PINNING Defines which CAs are trusted Reduces effectiveness of
the attack
okhttpbuilder .pinClientCertificate(resources, R.raw.client_cert, "pass".toCharArray(), “PKCS12”) .pinServerCertificates(resources, R.raw.server_cert, "pass".toCharArray(), "BKS")
.build(); return new OkClient(client);
WHAT IF (WHEN) THE CERTIFICATES CHANGE?
INFORM YOUR USERS Implement a mechanism for notifying users (GCM)
and forcing updates
PLAN AHEAD Check server security’s impact on devices https://www.ssllabs.com/
None
USE THE PLATFORM TO YOUR ADVANTAGE
android:usesCleartextTraffic="false" ANDROID M StrictMode.setVmPolicy( new StrictMode.VmPolicy.Builder() .detectCleartextNetwork() .penaltyLog().build());
FINGERPRINTS
APP LINKING HTTPS://DOMAIN[:OPT_PORT]/.WELL-KNOWN/ASSETLINKS.JSON [{ "relation": ["delegate_permission/common.handle_all_urls"], "target": { "namespace": "android_app",
"package_name": "com.example", "sha256_cert_fingerprints": ["14:6D:E9:...44:E5"] } }]
ANDROID N Network Security Configuration feature
<?xml version="1.0" encoding="utf-8"?> <manifest ... > <application android:networkSecurityConfig=" @xml/network_security_config" ...
> ... </application> </manifest> ADD A SECURITY CONFIG FILE
<?xml version="1.0" encoding="utf-8"?> <network-security-config> <domain-config cleartextTrafficPermitted="false"> <domain includeSubdomains="true">example.com</domain> <trust-anchors>
<certificates src="@raw/my_ca"/> </trust-anchors> <pin-set expiration="2018-01-01"> <pin digest="SHA-256">7HIpa...BCoQYcRhJ3Y=</pin> <!-- backup pin --> <pin digest="SHA-256">fwza0...gO/04cDM1oE=</pin> </pin-set> </domain-config> </network-security-config> CONFIGURE IT
INCLUDE YOUR CLIENTS IN THE PROCESS Keep them up-to-date Help
them understand risks and advise them Insist on updates and security patches
THINGS TO REMEMBER Use internal storage if applicable Encrypt data
Use HTTPS Pin certificates Be aware of the update cycle
ANDROID IS NOT SECURE
BUT YOU CAN MAKE IT LESS EASY TO ABUSE
REFERENCES • Gradle configuration • http://developer.android.com/guide/topics/data/data- storage.html#db • https://codahale.com/how-to-safely-store-a-password/ •
http://www.developereconomics.com/android- cryptography-tools-for-beginners/ • https://www.airpair.com/android/posts/adding- tampering-detection-to-your-android-app
REFERENCES • https://www.ssllabs.com/ • http://developer.android.com/preview/features/security- config.html • https://www.ionic.com/mitm-attacks-ssl-pinning-what- is-it-and-why-you-should-care/
REFERENCES • Android fingeprint security • Infinum security articles •
Infinum Android newsletter • Keeping secrets in a Vault
Thank you! Visit www.infinum.co or find us on social networks:
infinum.co infinumco infinumco infinum ANA@INFINUM.CO @ABAOTIC