Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Android Security Features
Search
Dave Smith
November 09, 2016
Programming
4
700
Android Security Features
Overview of the core platform elements that make up the Android security model for applications.
Dave Smith
November 09, 2016
Tweet
Share
More Decks by Dave Smith
See All by Dave Smith
ConstraintLayout, Inside and Out
devunwired
21
1.7k
Digging Into Android System Services
devunwired
8
1.6k
Flattening Layouts with Constraints
devunwired
3
290
Hello, Brillo: ELC Edition
devunwired
0
260
Mastering CoordinatorLayout Behaviors
devunwired
16
1.4k
Hello, Brillo
devunwired
1
2.1k
Google Proximity Beacons Overview
devunwired
4
240
Proximity Beacons and the Nearby API
devunwired
1
1.9k
Getting Your Act Together with CoordinatorLayout
devunwired
7
480
Other Decks in Programming
See All in Programming
あなたとKaigi on Rails / Kaigi on Rails + You
shimoju
0
170
デミカツ切り抜きで面倒くさいことはPythonにやらせよう
aokswork3
0
250
Range on Rails ―「多重範囲型」という新たな選択肢が、複雑ロジックを劇的にシンプルにしたワケ
rizap_tech
0
6.7k
釣り地図SNSにおける有料機能の実装
nokonoko1203
0
190
Cursorハンズオン実践!
eltociear
2
1.2k
フロントエンド開発のためのブラウザ組み込みAI入門
masashi
6
3.2k
エンジニアインターン「Treasure」とHonoの2年、そして未来へ / Our Journey with Hono Two Years at Treasure and Beyond
carta_engineering
0
370
スキーマ駆動で、Zod OpenAPI Honoによる、API開発するために、Hono Takibiというライブラリを作っている
nakita628
0
260
Devvox Belgium - Agentic AI Patterns
kdubois
1
130
CSC509 Lecture 04
javiergs
PRO
0
300
CSC305 Lecture 10
javiergs
PRO
0
170
コード生成なしでモック処理を実現!ovechkin-dm/mockioで学ぶメタプログラミング
qualiarts
0
180
Featured
See All Featured
Understanding Cognitive Biases in Performance Measurement
bluesmoon
31
2.7k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
667
120k
How STYLIGHT went responsive
nonsquared
100
5.8k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
31
2.5k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
37
2.6k
Building Applications with DynamoDB
mza
96
6.7k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
addyosmani
9
920
Optimising Largest Contentful Paint
csswizardry
37
3.5k
Practical Tips for Bootstrapping Information Extraction Pipelines
honnibal
PRO
23
1.5k
Fantastic passwords and where to find them - at NoRuKo
philnash
52
3.4k
The Cult of Friendly URLs
andyhume
79
6.6k
Designing Dashboards & Data Visualisations in Web Apps
destraynor
231
53k
Transcript
Android Security Features Dave Smith, PE @devunwired
App Code Sandbox Encryption Permissions
App Code
App Manifest Compiled Code Resources Signature Info Application Package (APK)
App Manifest Compiled Code Resources Signature Info Application Package (APK)
Authenticate Developer Identity Prevent APK Tampering
JAR Signer Hash Files Hash Hashes Sign w/ Private Key
APK Signature
JAR Signer APK Signature Hash Files Hash Hashes Sign w/
Private Key Hash 1MB Chunks Sign w/ Private Key Hash Hashes
Sandbox
Application Sandbox Process Isolation Unique App UID SELinux Domains
# ps USER PID PPID ... NAME ... system 1723
1240 ... com.android.settings u0_a10 1803 1240 ... android.ext.services u0_a32 1824 1240 ... com.android.deskclock u0_a1 1896 1240 ... android.process.acore u0_a55 1914 1240 ... com.android.printspooler u0_a13 1942 1240 ... com.android.launcher3 system 1974 1240 ... com.android.keychain u0_a8 2000 1240 ... android.process.media u0_a26 2064 1240 ... com.android.calendar u0_a66 2096 1240 ... com.android.quicksearchbox u0_a67 2123 1240 ... com.android.messaging u0_a6 2189 1240 ... com.android.dialer u0_a35 2209 1240 ... com.android.email u0_a65 2229 1240 ... com.android.gallery3d
# ps USER PID PPID ... NAME ... system 1723
1240 ... com.android.settings u0_a10 1803 1240 ... android.ext.services u0_a32 1824 1240 ... com.android.deskclock u0_a1 1896 1240 ... android.process.acore u0_a55 1914 1240 ... com.android.printspooler u0_a13 1942 1240 ... com.android.launcher3 system 1974 1240 ... com.android.keychain u0_a8 2000 1240 ... android.process.media u0_a26 2064 1240 ... com.android.calendar u0_a66 2096 1240 ... com.android.quicksearchbox u0_a67 2123 1240 ... com.android.messaging u0_a6 2189 1240 ... com.android.dialer u0_a35 2209 1240 ... com.android.email u0_a65 2229 1240 ... com.android.gallery3d
# cd /data/data/com.android.launcher3 # ls -l total 24 drwxrwx--x 2
u0_a13 u0_a13 4096 2016-09-15 22:23 cache drwxrwx--x 2 u0_a13 u0_a13 4096 2016-09-15 22:23 databases drwxrwx--x 2 u0_a13 u0_a13 4096 2016-11-01 22:13 shared_prefs # cd /data/data/ # ls -l ... drwxr-x--x 6 u0_a6 u0_a6 4096 2016-09-15 22:23 com.android.dialer drwxr-x--x 6 u0_a35 u0_a35 4096 2016-09-15 22:23 com.android.email drwxr-x--x 5 u0_a13 u0_a13 4096 2016-09-15 22:23 com.android.launcher3
$ ps -Z LABEL USER ... NAME ... u:r:system_app:s0 system
... com.android.settings u:r:platform_app:s0:c512,c768 u0_a10 ... android.ext.services u:r:untrusted_app:s0:c512,c768 u0_a32 ... com.android.deskclock u:r:priv_app:s0:c512,c768 u0_a1 ... android.process.acore u:r:untrusted_app:s0:c512,c768 u0_a55 ... com.android.printspooler u:r:priv_app:s0:c512,c768 u0_a13 ... com.android.launcher3 u:r:system_app:s0 system ... com.android.keychain u:r:priv_app:s0:c512,c768 u0_a8 ... android.process.media u:r:untrusted_app:s0:c512,c768 u0_a26 ... com.android.calendar u:r:untrusted_app:s0:c512,c768 u0_a66 ... com.android.quicksearchbox u:r:platform_app:s0:c512,c768 u0_a67 ... com.android.messaging u:r:priv_app:s0:c512,c768 u0_a6 ... com.android.dialer u:r:untrusted_app:s0:c512,c768 u0_a35 ... com.android.email u:r:untrusted_app:s0:c512,c768 u0_a65 ... com.android.gallery3d
Data Encryption + Verified Boot
Disk Encryption Encrypts All Writable Data No Passcode Required /data
dm-crypt Android
Verified Boot Halt Boot on Error Protect Runtime Reads /system
dm-verity Android Hash System Blocks
Permissions
<manifest package="com.android.browser"> … <uses-permission android:name="android.permission.INTERNET" /> <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" /> …
</manifest>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="android"> ... <permission android:name="android.permission.INTERNET" android:description="@string/permdesc_createNetworkSockets" android:label="@string/permlab_createNetworkSockets" android:protectionLevel="normal"
/> ... <permission android:name="android.permission.ACCESS_FINE_LOCATION" android:permissionGroup="android.permission-group.LOCATION" android:label="@string/permlab_accessFineLocation" android:description="@string/permdesc_accessFineLocation" android:protectionLevel="dangerous" /> ... </manifest> frameworks/base/core/res/AndroidManifest.xml
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="android"> ... <permission android:name="android.permission.INTERNET" android:description="@string/permdesc_createNetworkSockets" android:label="@string/permlab_createNetworkSockets" android:protectionLevel="normal"
/> ... <permission android:name="android.permission.ACCESS_FINE_LOCATION" android:permissionGroup="android.permission-group.LOCATION" android:label="@string/permlab_accessFineLocation" android:description="@string/permdesc_accessFineLocation" android:protectionLevel="dangerous" /> ... </manifest> frameworks/base/core/res/AndroidManifest.xml
Permissions Enforcement Kernel Groups Binder IPC
<permissions> … <permission name="android.permission.INTERNET" > <group gid="inet" /> </permission> …
</permissions> … #define AID_INET 3003 /* can create AF_INET and AF_INET6 sockets */ … static const struct android_id_info android_ids[] = { … { "inet", AID_INET, }, … }; … frameworks/base/data/etc/platform.xml system/core/include/private/android_filesystem_config.h
# ps | grep browser u0_a17 2276 1212 ... com.android.browser
# cat /proc/2276/status Name: android.browser State: S (sleeping) Tgid: 2276 Pid: 2276 PPid: 1212 TracerPid: 0 Uid: 10017 10017 10017 10017 Gid: 10017 10017 10017 10017 FDSize: 256 Groups: 3003 9997 50017 ...
Application System Server Manager Service Binder IPC
Application System Server Manager Service Binder IPC Binder.getCallingUid() Binder.getCallingPid()
Vibrator vib = (Vibrator) getSystemService(VIBRATOR_SERVICE); vib.vibrate(500); public class VibratorService extends
IVibratorService.Stub { … public void vibrate(int uid, String packageName, long milliseconds, IBinder token) { if (mContext.checkCallingOrSelfPermission(android.Manifest.permission.VIBRATE) != PackageManager.PERMISSION_GRANTED) { throw new SecurityException("Requires VIBRATE permission"); } … } … }
public class VibratorService extends IVibratorService.Stub { … public void vibrate(int
uid, String packageName, long milliseconds, IBinder token) { if (mContext.checkCallingOrSelfPermission(android.Manifest.permission.VIBRATE) != PackageManager.PERMISSION_GRANTED) { throw new SecurityException("Requires VIBRATE permission"); } … } … } Vibrator vib = (Vibrator) getSystemService(VIBRATOR_SERVICE); vib.vibrate(500);
Protect code integrity Prohibit unauthorized access Preserve data integrity Provide
user control
@devunwired +DaveSmithDev milehighandroid.com wiresareobsolete.com