Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Safety first
Search
Ana Baotić
July 28, 2016
Programming
10
11k
Safety first
Best practices in app security presentation held at the 360AnDev conference in Denver, CO
Ana Baotić
July 28, 2016
Tweet
Share
More Decks by Ana Baotić
See All by Ana Baotić
Inhibiting the impostor
abaotic
2
290
Sign here, please!
abaotic
1
100
Sign here, please!
abaotic
0
150
Break your app before someone else does
abaotic
1
530
Other Decks in Programming
See All in Programming
チームのテスト力を総合的に鍛えて品質、スピード、レジリエンスを共立させる/Testing approach that improves quality, speed, and resilience
goyoki
5
1.1k
AIと”コードの評価関数”を共有する / Share the "code evaluation function" with AI
euglena1215
1
180
GPUを計算資源として使おう!
primenumber
1
220
Composerが「依存解決」のためにどんな工夫をしているか #phpcon
o0h
PRO
1
340
猫と暮らす Google Nest Cam生活🐈 / WebRTC with Google Nest Cam
yutailang0119
0
170
型で語るカタ
irof
0
680
Modern Angular with Signals and Signal Store:New Rules for Your Architecture @enterJS Advanced Angular Day 2025
manfredsteyer
PRO
0
260
リバースエンジニアリング新時代へ! GhidraとClaude DesktopをMCPで繋ぐ/findy202507
tkmru
3
890
RailsGirls IZUMO スポンサーLT
16bitidol
0
200
顧客の画像データをテラバイト単位で配信する 画像サーバを WebP にした際に起こった課題と その対応策 ~継続的な取り組みを添えて~
takutakahashi
4
1.3k
システム成長を止めない!本番無停止テーブル移行の全貌
sakawe_ee
1
340
“いい感じ“な定量評価を求めて - Four Keysとアウトカムの間の探求 -
nealle
2
12k
Featured
See All Featured
[RailsConf 2023] Rails as a piece of cake
palkan
55
5.7k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
50
5.5k
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
panda_program
108
19k
Six Lessons from altMBA
skipperchong
28
3.9k
Docker and Python
trallard
45
3.5k
Intergalactic Javascript Robots from Outer Space
tanoku
271
27k
The Cost Of JavaScript in 2023
addyosmani
51
8.6k
The Straight Up "How To Draw Better" Workshop
denniskardys
235
140k
Rails Girls Zürich Keynote
gr2m
95
14k
Building an army of robots
kneath
306
45k
GraphQLとの向き合い方2022年版
quramy
49
14k
The Art of Programming - Codeland 2020
erikaheidi
54
13k
Transcript
Safety first Best practices in app security ANA BAOTIĆ TECHNICAL
MANAGER, MOBILE BANKING @ INFINUM @ABAOTIC
We're an independent design & development agency.
None
HOW TO INCREASE SECURITY
BUILD INTEGRITY
ADD A RELEASE KEYSTORE TO YOUR PROJECT
KEYSTORE Can be used for ALL build types You should
NEVER lose it No one should EVER acquire it
KEEP IT SECRET, KEEP IT SAFE
signingConfigs { release { storeFile file("myapp.keystore") storePassword "password123" keyAlias "keyAlias"
keyPassword "password789" } } DO NOT!
ONE ALTERNATIVE local.properties KEYSTORE_PASSWORD=password123 KEY_PASSWORD=password789
try { storeFile file("myapp.keystore") storePassword KEYSTORE_PASSWORD keyAlias "keyAlias" keyPassword KEY_PASSWORD
} catch (ex) { throw new InvalidUserDataException(“…”) }
ENABLE OBFUSCATION
release { minifyEnabled true proguardFiles getDefaultProguardFile( 'proguard-android.txt'), ‘proguard-rules.txt'
signingConfig signingConfigs.release } PROGUARD
DOWNSIDES Disliked* Builds fail Staging vs Production
OTHER OPTIONS DexGuard DexProtector
None
public abstract class e { private int a = -1;
private String b = null; protected boolean k = false; public abstract void a(Intent var1); protected final void a(String var1) { this.b = var1; } public final void c() { this.a = -1; this.b = null; } public final boolean d() { return this.k; } }
WILL THIS KEEP THE APK SAFE?
None
ADD TAMPERING DETECTION
Verify signing certificate at runtime Verify the installer context.getPackageManager() .getInstallerPackageName(context.getPackageName())
.startsWith("com.android.vending") Check if app is debuggable (or run on emulator)
DATA PRIVACY
MY PRECIOUS
WAYS TO STORE (AND RETRIEVE) DATA Internal storage External storage
Content providers*
INTERNAL STORAGE Is (generally) sufficiently safe Private to your app
SHARED PREFERENCES Useful for primitive key-value based data
EXTERNAL STORAGE Globally readable and writable
CONTENT PROVIDERS Structured storage mechanism Can be exported (accessed by
other apps)
<provider android:name="com.example.android.datasync.provider.StubProvider" android:authorities="com.example.android.datasync.provider" android:exported=“false"/> android:protectionLevel="signature"
private readable safe Internal storage yes yes yes External storage
no yes no Content providers depends yes yes Shared prefs. yes yes yes
SO EVERYTHING IS FINE?
NOPE.
None
USE LIBRARIES Bouncy Castle Spongy Castle Keyczar AeroGear Crypto Conceal
ENCRYPT USING A PIN/PASSWORD
BCRYPT Slow Key derivation function Cost of hash function →
work factor
CAN DATA REMAIN PRIVATE?
Rooting your device allows access Not encrypting allows (mis)use
NETWORK SECURITY
None
HTTP
HTTPS
MAN IN THE MIDDLE
None
CERTIFICATE PINNING Defines which CAs are trusted Reduces effectiveness of
the attack
okhttpbuilder .pinClientCertificate(resources, R.raw.client_cert, "pass".toCharArray(), “PKCS12”) .pinServerCertificates(resources, R.raw.server_cert, "pass".toCharArray(), "BKS")
.build(); return new OkClient(client);
WHAT IF (WHEN) THE CERTIFICATES CHANGE?
INFORM YOUR USERS Implement a mechanism for notifying users (GCM)
and forcing updates
PLAN AHEAD Check server security’s impact on devices https://www.ssllabs.com/
None
USE THE PLATFORM TO YOUR ADVANTAGE
android:usesCleartextTraffic="false" ANDROID M StrictMode.setVmPolicy( new StrictMode.VmPolicy.Builder() .detectCleartextNetwork() .penaltyLog().build());
FINGERPRINTS
APP LINKING HTTPS://DOMAIN[:OPT_PORT]/.WELL-KNOWN/ASSETLINKS.JSON [{ "relation": ["delegate_permission/common.handle_all_urls"], "target": { "namespace": "android_app",
"package_name": "com.example", "sha256_cert_fingerprints": ["14:6D:E9:...44:E5"] } }]
ANDROID N Network Security Configuration feature
<?xml version="1.0" encoding="utf-8"?> <manifest ... > <application android:networkSecurityConfig=" @xml/network_security_config" ...
> ... </application> </manifest> ADD A SECURITY CONFIG FILE
<?xml version="1.0" encoding="utf-8"?> <network-security-config> <domain-config cleartextTrafficPermitted="false"> <domain includeSubdomains="true">example.com</domain> <trust-anchors>
<certificates src="@raw/my_ca"/> </trust-anchors> <pin-set expiration="2018-01-01"> <pin digest="SHA-256">7HIpa...BCoQYcRhJ3Y=</pin> <!-- backup pin --> <pin digest="SHA-256">fwza0...gO/04cDM1oE=</pin> </pin-set> </domain-config> </network-security-config> CONFIGURE IT
INCLUDE YOUR CLIENTS IN THE PROCESS Keep them up-to-date Help
them understand risks and advise them Insist on updates and security patches
THINGS TO REMEMBER Use internal storage if applicable Encrypt data
Use HTTPS Pin certificates Be aware of the update cycle
ANDROID IS NOT SECURE
BUT YOU CAN MAKE IT LESS EASY TO ABUSE
REFERENCES • Gradle configuration • http://developer.android.com/guide/topics/data/data- storage.html#db • https://codahale.com/how-to-safely-store-a-password/ •
http://www.developereconomics.com/android- cryptography-tools-for-beginners/ • https://www.airpair.com/android/posts/adding- tampering-detection-to-your-android-app
REFERENCES • https://www.ssllabs.com/ • http://developer.android.com/preview/features/security- config.html • https://www.ionic.com/mitm-attacks-ssl-pinning-what- is-it-and-why-you-should-care/
REFERENCES • Android fingeprint security • Infinum security articles •
Infinum Android newsletter • Keeping secrets in a Vault
Thank you! Visit www.infinum.co or find us on social networks:
infinum.co infinumco infinumco infinum
[email protected]
@ABAOTIC