Commonly Overlooked Areas of Security Revisited

From AndroidMakers 2018 in Paris, France.

(Revised content from the Droidcon London 2017!)

Transcript

1. Commonly Overlooked Areas of Security Revisited @CliveLeeHere
2. https://www.oviahealth.com/careers
4. Maintainability affects Security
5. What We’ll Cover Logging
6. What We’ll Cover Logging Obfuscation
7. What We’ll Cover Logging Obfuscation Quick Reminders
8. Logging
9. Logging
10. Log.i("Tag", "Hi");
11. adb logcat Tag:I *:S Log.i("Tag", "Hi");
12. I/Tag: Hi adb logcat Tag:I *:S Log.i("Tag", "Hi");
13. Hi!
14. Ways to Remove?
15. Option 1: Proguard
16. Option 1: Proguard / R8
17. -assumenosideeffects class_specification
18. -assumenosideeffects class_specification Specifies methods that don't have any side effects (other than maybe returning a value). With some care, you can also use the option to remove logging code.
19. build.gradle
20. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 ‘proguard-android-optimize.txt'),
 'your-proguard-rules.pro'
 }
21. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 ‘proguard-android-optimize.txt'),
 'your-proguard-rules.pro'
 }
22. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 ‘proguard-android-optimize.txt'),
 'your-proguard-rules.pro'
 }
23. your-proguard-rules.pro -assumenosideeffects build.gradle
24. your-proguard-rules.pro -assumenosideeffects class
 android.util.Log { public static *** d(...); public static *** v(...); public static *** i(...); } build.gradle
25. your-proguard-rules.pro -assumenosideeffects class
 android.util.Log { public static *** d(...); public static *** v(...); public static *** i(...); } build.gradle
26. adb logcat Tag:I *:S
27. adb logcat Tag:I *:S
28. Option 1: Proguard / R8
29. Maintainability affects Security
31. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 'proguard-android-optimize.txt'),
 'your-proguard-rules.pro'
 }
32. proguard-android-optimize.txt Adding optimization introduces certain risks.... The following flags turn off various optimizations known to have issues, but the list may not be complete or up to date. ... Make sure you test thoroughly if you go this route.
33. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 'proguard-android-optimize.txt'),
 'your-proguard-rules.pro'
 }
34. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 'proguard-android.txt'),
 'your-proguard-rules.pro'
 }
35. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 'proguard-android.txt'),
 'your-proguard-rules.pro'
 }
36. build.gradle proguard-android.txt -dontoptimize
37. proguard-android.txt -assumenosideeffects class_specification
 Only applicable when optimizing.
38. proguard-android.txt -assumenosideeffects class_specification
 [Use] with some care…
39. proguard-android.txt -assumenosideeffects class_specification
 Only applicable when optimizing.
40. -assumenosideeffects your-proguard-rules.pro -assumenosideeffects
41. adb logcat Tag:I *:S
42. adb logcat Tag:I *:S I/Tag: Hi
43. I’m back!
44. Maintainability affects Security
45. your-proguard-rules.pro proguard-android- optimize.txt build.gradle
46. your-proguard-rules.pro build.gradle
47. Quick ‘Fix’ #1
48. build.gradle release {
 proguardFiles getDefaultProguardFile(
 ‘proguard-android.txt'),
 ‘your-proguard-rules.pro'
 }
49. build.gradle release {
 proguardFiles 
 //ONLY USE THIS PROGUARD FILE
 ‘your-proguard-rules.pro'
 }
50. build.gradle your-proguard-rules.pro # from proguard-android-optimize.txt ... # NEVER ADD -dontoptimize
51. build.gradle your-proguard-rules.pro # from proguard-android-optimize.txt ... # NEVER ADD -dontoptimize
52. Quick Fix #2
53. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 ‘proguard-android-optimize.txt’),
 'your-proguard-rules.pro'
 }
54. build.gradle release {
 proguardFiles 
 //DON'T CHANGE THIS LINE
 getDefaultProguardFile(
 ‘proguard-android-optimize.txt’),
 'your-proguard-rules.pro'
 }
55. build.gradle release {
 proguardFiles 
 //DON'T CHANGE THIS LINE
 getDefaultProguardFile(
 ‘proguard-android-optimize.txt’),
 'your-proguard-rules.pro'
 }
57. Big Scary Warnings
58. Big Scary Warnings = Not Enforced by Tools
59. Big Scary Warnings = Ignored Later
60. Quick Fix #1, #2
61. Option 2: BuildConfig & Timber
62. MyApplication
63. MyApplication if (BuildConfig.DEBUG) { Timber.plant(new DebugTree()); }
64. timber/build.gradle
65. timber/build.gradle apply plugin 'com.android.library'
66. android-module java-module
67. java-module apply plugin: ‘java-library' android-module
68. java-module android-module
70. Option 3: dependency injection
71. java-lib
72. java-lib public interface Logger { void d(); }
73. java-lib slf4j
74. java-lib android-lib public class MyLogger implements Logger { @Override public void d(String msg) { Timber.d(msg); } }
75. java-lib android-lib app public class MyApp { @Inject Logger myLogger; }
76. app @Module public abstract class SomeModule { @Binds abstract Logger bindLogger( MyLogger logger); } public class MyApp { @Inject Logger myLogger; }
77. app if (BuildConfig.DEBUG) {...} @Module public abstract class SomeModule { @Binds abstract Logger bindLogger( MyLogger logger); } public class MyApp { @Inject
78. android-lib/release public class MyLogger implements Logger { @Override public void d(String msg) { //no-op } } app
79. android-lib public class MyLogger implements Logger { @Override public void d(String msg) { //no-op } } app/release
80. android-lib app/release @Module public abstract class SomeModule { @Binds abstract Logger bindLogger( MyLogger logger); }
83. app public class MyApplication { @Override public void onCreate() { //after planting... Timber.i("LOGGING ENABLED”); }
85. Obfuscation
86. Obfuscation
87. Obfuscation
88. Obfuscation Security
89. Obfuscation Proguard
90. Obfuscation R8
91. Obfuscation Libraries
92. Obfuscation Libraries Keep Narrowly
94. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 'proguard-android-optimize.txt'),
 'your-proguard-rules.pro'
 }
95. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 'proguard-android.txt'),
 'your-proguard-rules.pro'
 }
96. build.gradle release {
 proguardFiles 
 getDefaultProguardFile(
 'proguard-android.txt'),
 'your-proguard-rules.pro'
 }
97. your-proguard-rules.pro -keep class com.some.library.**
98. your-proguard-rules.pro -keep class com.some.library.OneClass
99. your-proguard-rules.pro -keep class com.some.library.OneClass -keep class * implements com.some.library.SomeInterface
100. your-proguard-rules.pro -keep class com.some.library.OneClass -keep class * implements com.some.library.SomeInterface -keepclasseswithmembers class * { @com.some.library.* <methods>;
101. Obfuscation Libraries
102. Obfuscation Your Own Code?
103. Obfuscation Your Own Code? @Keep
104. @Keep
105. @Keep ? ? ? ?
106. @Keep ? ? ? ?
107. Maintainability affects Security
108. • Maintainability @Keep
109. • Maintainability • Refactoring @Keep
110. • Maintainability • Refactoring • Organization @Keep
111. SomeClass.java @Keep public class SomeClass { } Refactoring with @Keep
112. CoolClass.java @Keep public class CoolClass { } Refactoring with @Keep
113. com.yo.CoolClass.java @Keep public class CoolClass { } Refactoring with @Keep
114. SomeClass.java Refactoring with .pro
115. SomeClass.java Refactoring with .pro your-proguard-rules.pro -keep class com.your.code.SomeClass
116. CoolClass.java Refactoring with .pro your-proguard-rules.pro -keep class com.your.code.SomeClass
117. “Occurrences found in comments, strings and non-code files”
118. com.yo.SomeClass.java Refactoring with .pro your-proguard-rules.pro -keep class com.your.code.SomeClass
119. Refactoring with .pro
120. com.some.package public class SomeClass1 {} public class SomeClass2 {} public class SomeClass3 {} Organization with .pro
121. Organization with .pro your-proguard-rules.pro -keep class com.some.package.** com.some.package
122. Organization with .pro com.feature1.model com.feature2.model
123. Organization with .pro your-proguard-rules.pro -keep class com.feature1.model.** -keep class com.feature2.model.**
124. Organization with @Keep com.feature1.model @Keep public class SomeClass1 {} @Keep public class SomeClass2 {} @Keep public class SomeClass3 {}
125. Organization with @Keep com.feature1.model com.feature2.model
126. Organization with @Keep com.feature1.model com.feature2.model public class CoolClass1 {} public class CoolClass2 {} public class CoolClass3 {}
127. Organization with @Keep com.feature1.model com.feature2.model @Keep public class CoolClass1 {} @Keep public class CoolClass2 {} @Keep public class CoolClass3 {}
128. Organization with @Keep
129. @Keep
130. @Keep Encourages Narrower Rules
132. Obfuscation
133. Obfuscation Android NDK
134. Obfuscation Android NDK
135. Maintainability affects Security
136. NDK Maintainability C / C++ / JNI
137. NDK Maintainability C / C++ / JNI Documentation
138. NDK Maintainability C / C++ / JNI Documentation Development Tools
139. NDK Maintainability C / C++ / JNI Documentation Development Tools Build Times
140. NDK Maintainability C / C++ / JNI Documentation Development Tools Build Times Automated Testing
141. NDK Maintainability C / C++ / JNI Documentation Development Tools Build Times Automated Testing CI
143. Quick Reminders
144. Build Process / CI Don’t Trust the Interwebz
145. Build Process / CI Don’t Trust the Interwebz
146. Build Process / CI Don’t Trust the Interwebz Use Google Play App signing
147. Build Process / CI Don’t Trust the Interwebz Use Google Play App signing Don’t Add Your Key in Source Control
148. Build Process / CI Don’t Trust the Interwebz Use Google Play App signing Don’t Add Your Key in Source Control Encrypt if Needed for CI
149. Manage Up & Down
150. Libraries
151. Thanks! @CliveLeeHere