How To Build Insecure Android Apps (feat. Sanitizers)

Android Security is often underestimated, with most assuming it's just a playground for hackers and Cyber Security wizards. What if I told you that the villains of Android Security are much simpler than a bunch of lines of code on a Linux terminal? This talk seeks to show the audience how the common and underrated practices in Android App Development impact Security. It will also teach the audience how they could be mitigated, with one of them being through Testing (That's where Sanitizers come in). It is based on a recent study by Google (The Android Team) that showed how more than 60% of bugs found in the Google Play Store are caused by Memory Safety. After this whirlwind journey, my audience should walk away with a newfound appreciation for Android Security. It will be a testament to how the craftiest villains often hide in plain sight, thanks to seemingly ordinary practices...

Transcript

1. How To Build Insecure Android Apps (feat. Sanitizers)
2. Disclaimer • FOR SARCASM USE ONLY… • DO NOT TRY THIS AT HOME, SCHOOL, WORK, YOU GET THE IDEA…
3. 1. Ignore Proper Memory Management… • Memory Leaks… • Infinite Allocations… • Avoid Garbage Collection…
4. 2. Bypass Language Safeguards… • Direct Memory Access… • Null Pointer Dereferences… • Unsafe Type Conversions…
5. 3. Mock Sanitizers… • Sanitizer Suppression… • Disregard Error Reports… • Intentional Buffer Overflows…
6. 4. Neglect Code Reviews… • Hide Memory Issues… • Ignore Feedback During Code Reviews… • Abscond Altogether…
7. 5. Embrace the YOLO Mindset… • Unapologetic Leaking… • Defensive Ignorance… • Zero Error Handling…
8. 6. Request ALL Permissions… • Permission Overload… • Permission Bloat… • Permission Garden…
9. 7. Integrate Overly Permissive Groups… • Group Infiltration... • Group Expansion… • Permission Parties…
10. 8. The “No” Means “Yes” Principle… • Automated Consent… • “Smart” Permission Manager… • Reverse Psychology UI…
11. 9. Provide Sketchy Permission Explanations… • Cryptic Permission Names… • Permission Poetry… • Permission Mysteries…
12. 10. Always Hardcode Your Credentials… • Insecure Constants… • The Universal “12345” password… • Share the users’ credentials on Social Media…
13. 11. Commit To Plaintext Storage… • Clear Text Passwords… • “Not-So-Secret Secrets”... • Public Diary Mode…
14. 12. Utilise Inadequate Encryption… • Weak Encryption Algorithms… • Encryption-Free Zones… • Caesar Cipher Confidence…
15. 13. Leaky Cache, Perhaps? • Eternal Caches… • Cache “Oops” Mode… • Cache Clearance Aversion…
16. 14. Reject Obfuscation! • Raw Data Revelation… • Data Colouring Book… • Obfuscation Phobia…
17. 15. Always Blame The User… • Key In The Open… • Key Pile-Up… • Key Museum…
18. Thank You!
19. Questions?
20. Emmanuel Muturia™ @emmanuelmuturia
21. References • Security Best Practices... • Android Sanitizers (AOSP) • Memory Error Debugging and Mitigation