Defensive Android Security

Security vulnerabilities make great headlines. Attackers need to find only one weakness, you need to defend against them all. Fortunately, you are not alone. Learn about the security mechanisms in the Android platform and Google Play services. How to evaluate your own app's security using checklists like OWASP MASVS (Mobile Application Security Verification Standard).

Transcript

1. Defensive Android Security Bolot Kerimbaev, Big Nerd Ranch
2. Headlines 143 million
3. Security Bulletins
4. Security Goals • Keep user data safe • Keep system integrity • Prevent unauthorized operations • Ensure communication integrity • Platform vs apps
5. Security Goals • Planning • Cost / Benefit • Threat Modeling • Evaluation Value Attack Defense
6. Defenses
7. Attack Surface • Linux kernel, forked, older version • Communication, SMS, NFC, Bluetooth, USB • Device drivers, GPU, modem • Web view, Chrome • Android architecture, sandbox, permissions • Networking libraries, CA trust • Storage • Third party libraries • Other apps • Your own app
8. Platform Security • Linux Security • Application Sandbox • Permissions • Software Updates • Application Signing • Secure IPC (Binder) • Keystore • Verified Boot • Google Play • Verify Apps • SafetyNet • ASLR, PIE, NX, SELinux
9. Platform Security
10. Oreo/Treble
11. APK Signature v2
12. Media Server Hardening
13. Fingerprint Auth
14. Platform Security • Android Security Year in Review • Security Bulletins • CDD, CTS
15. Network Security • Modern TLS, Good Ciphers • PKI and Certificate Authority • Network Security Configuration • Use Good Libraries • Tomorrow: These and Other Rules
16. Security Practices
17. Checklists • Android Security Checklist • Industry Specific: PCI, HIPAA • OWASP MASVS
18. Android Security Checklist
19. OWASP
20. App Security • Storage • Communication • Auth • Input Validation • IPC • WebView • Encryption • Keystore • Fingerprint • Auth
21. What Can Developers Do? • Practice security as a user • Optimize for best security practices • Training • Checklists • Audits, Reviews
22. Other Talks • DevNexus 2017 • Josh Skeen: Keeping Secrets Secure • What Android Developers Should Know About Security
23. Resources • https://source.android.com/security • https://github.com/OWASP/owasp-mstg • https://github.com/OWASP/owasp-masvs • https://github.com/b-mueller/android_app_security_checklist • https://www.nngroup.com/articles/security-and-human-factors/
24. Questions? • @bolot • @bignerdranch • BNR Security Courses - soon