Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Safety first
Search
Ana Baotić
July 28, 2016
Programming
10
11k
Safety first
Best practices in app security presentation held at the 360AnDev conference in Denver, CO
Ana Baotić
July 28, 2016
Tweet
Share
More Decks by Ana Baotić
See All by Ana Baotić
Inhibiting the impostor
abaotic
2
190
Sign here, please!
abaotic
1
52
Sign here, please!
abaotic
0
100
Break your app before someone else does
abaotic
1
370
Other Decks in Programming
See All in Programming
GraphQLサーバの構成要素を整理する #ハッカー鮨 #tsukijigraphql / graphql server technology selection
izumin5210
4
840
Ruby GitHub Packages
bkuhlmann
0
630
新宿ダンジョンを可視化してみた
satoshi7190
2
260
Site Reliability Engineering for GMO
pyama86
8
1k
"config" ってなんだ? / What is "config"?
okashoi
0
240
dbtのドメイン分割による データ基盤の改善とDigdagとの連携
sakama
0
350
educure_カリキュラム生操作マニュアル.pdf
linew_official
0
810
Compose-View Interop in Practice (mDevCamp 2024)
stewemetal
0
140
Blue/Greenデプロイの導入による 運用フローの改善
kudoas
1
380
⼤規模⾔語モデルの拡張(RAG)が 終わったかも知れない件について
nearme_tech
23
15k
Node.js v22 で変わること
yosuke_furukawa
PRO
9
3.5k
Java 22 Overview
kishida
1
180
Featured
See All Featured
The World Runs on Bad Software
bkeepers
PRO
61
6.7k
Embracing the Ebb and Flow
colly
80
4.1k
How To Stay Up To Date on Web Technology
chriscoyier
782
250k
5 minutes of I Can Smell Your CMS
philhawksworth
199
19k
[RailsConf 2023] Rails as a piece of cake
palkan
23
4k
Code Reviewing Like a Champion
maltzj
514
39k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
14
1.5k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
17
1.4k
Why Our Code Smells
bkeepers
PRO
331
56k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
19
1.7k
Fireside Chat
paigeccino
21
2.6k
ParisWeb 2013: Learning to Love: Crash Course in Emotional UX Design
dotmariusz
104
6.6k
Transcript
Safety first Best practices in app security ANA BAOTIĆ TECHNICAL
MANAGER, MOBILE BANKING @ INFINUM @ABAOTIC
We're an independent design & development agency.
None
HOW TO INCREASE SECURITY
BUILD INTEGRITY
ADD A RELEASE KEYSTORE TO YOUR PROJECT
KEYSTORE Can be used for ALL build types You should
NEVER lose it No one should EVER acquire it
KEEP IT SECRET, KEEP IT SAFE
signingConfigs { release { storeFile file("myapp.keystore") storePassword "password123" keyAlias "keyAlias"
keyPassword "password789" } } DO NOT!
ONE ALTERNATIVE local.properties KEYSTORE_PASSWORD=password123 KEY_PASSWORD=password789
try { storeFile file("myapp.keystore") storePassword KEYSTORE_PASSWORD keyAlias "keyAlias" keyPassword KEY_PASSWORD
} catch (ex) { throw new InvalidUserDataException(“…”) }
ENABLE OBFUSCATION
release { minifyEnabled true proguardFiles getDefaultProguardFile( 'proguard-android.txt'), ‘proguard-rules.txt'
signingConfig signingConfigs.release } PROGUARD
DOWNSIDES Disliked* Builds fail Staging vs Production
OTHER OPTIONS DexGuard DexProtector
None
public abstract class e { private int a = -1;
private String b = null; protected boolean k = false; public abstract void a(Intent var1); protected final void a(String var1) { this.b = var1; } public final void c() { this.a = -1; this.b = null; } public final boolean d() { return this.k; } }
WILL THIS KEEP THE APK SAFE?
None
ADD TAMPERING DETECTION
Verify signing certificate at runtime Verify the installer context.getPackageManager() .getInstallerPackageName(context.getPackageName())
.startsWith("com.android.vending") Check if app is debuggable (or run on emulator)
DATA PRIVACY
MY PRECIOUS
WAYS TO STORE (AND RETRIEVE) DATA Internal storage External storage
Content providers*
INTERNAL STORAGE Is (generally) sufficiently safe Private to your app
SHARED PREFERENCES Useful for primitive key-value based data
EXTERNAL STORAGE Globally readable and writable
CONTENT PROVIDERS Structured storage mechanism Can be exported (accessed by
other apps)
<provider android:name="com.example.android.datasync.provider.StubProvider" android:authorities="com.example.android.datasync.provider" android:exported=“false"/> android:protectionLevel="signature"
private readable safe Internal storage yes yes yes External storage
no yes no Content providers depends yes yes Shared prefs. yes yes yes
SO EVERYTHING IS FINE?
NOPE.
None
USE LIBRARIES Bouncy Castle Spongy Castle Keyczar AeroGear Crypto Conceal
ENCRYPT USING A PIN/PASSWORD
BCRYPT Slow Key derivation function Cost of hash function →
work factor
CAN DATA REMAIN PRIVATE?
Rooting your device allows access Not encrypting allows (mis)use
NETWORK SECURITY
None
HTTP
HTTPS
MAN IN THE MIDDLE
None
CERTIFICATE PINNING Defines which CAs are trusted Reduces effectiveness of
the attack
okhttpbuilder .pinClientCertificate(resources, R.raw.client_cert, "pass".toCharArray(), “PKCS12”) .pinServerCertificates(resources, R.raw.server_cert, "pass".toCharArray(), "BKS")
.build(); return new OkClient(client);
WHAT IF (WHEN) THE CERTIFICATES CHANGE?
INFORM YOUR USERS Implement a mechanism for notifying users (GCM)
and forcing updates
PLAN AHEAD Check server security’s impact on devices https://www.ssllabs.com/
None
USE THE PLATFORM TO YOUR ADVANTAGE
android:usesCleartextTraffic="false" ANDROID M StrictMode.setVmPolicy( new StrictMode.VmPolicy.Builder() .detectCleartextNetwork() .penaltyLog().build());
FINGERPRINTS
APP LINKING HTTPS://DOMAIN[:OPT_PORT]/.WELL-KNOWN/ASSETLINKS.JSON [{ "relation": ["delegate_permission/common.handle_all_urls"], "target": { "namespace": "android_app",
"package_name": "com.example", "sha256_cert_fingerprints": ["14:6D:E9:...44:E5"] } }]
ANDROID N Network Security Configuration feature
<?xml version="1.0" encoding="utf-8"?> <manifest ... > <application android:networkSecurityConfig=" @xml/network_security_config" ...
> ... </application> </manifest> ADD A SECURITY CONFIG FILE
<?xml version="1.0" encoding="utf-8"?> <network-security-config> <domain-config cleartextTrafficPermitted="false"> <domain includeSubdomains="true">example.com</domain> <trust-anchors>
<certificates src="@raw/my_ca"/> </trust-anchors> <pin-set expiration="2018-01-01"> <pin digest="SHA-256">7HIpa...BCoQYcRhJ3Y=</pin> <!-- backup pin --> <pin digest="SHA-256">fwza0...gO/04cDM1oE=</pin> </pin-set> </domain-config> </network-security-config> CONFIGURE IT
INCLUDE YOUR CLIENTS IN THE PROCESS Keep them up-to-date Help
them understand risks and advise them Insist on updates and security patches
THINGS TO REMEMBER Use internal storage if applicable Encrypt data
Use HTTPS Pin certificates Be aware of the update cycle
ANDROID IS NOT SECURE
BUT YOU CAN MAKE IT LESS EASY TO ABUSE
REFERENCES • Gradle configuration • http://developer.android.com/guide/topics/data/data- storage.html#db • https://codahale.com/how-to-safely-store-a-password/ •
http://www.developereconomics.com/android- cryptography-tools-for-beginners/ • https://www.airpair.com/android/posts/adding- tampering-detection-to-your-android-app
REFERENCES • https://www.ssllabs.com/ • http://developer.android.com/preview/features/security- config.html • https://www.ionic.com/mitm-attacks-ssl-pinning-what- is-it-and-why-you-should-care/
REFERENCES • Android fingeprint security • Infinum security articles •
Infinum Android newsletter • Keeping secrets in a Vault
Thank you! Visit www.infinum.co or find us on social networks:
infinum.co infinumco infinumco infinum
[email protected]
@ABAOTIC