Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Androidセキュアな開発について考えてみた(明日敗訴しないためのセキュアコーディングver.2)

 Androidセキュアな開発について考えてみた(明日敗訴しないためのセキュアコーディングver.2)

Kengo Suzuki

March 13, 2016
Tweet

More Decks by Kengo Suzuki

Other Decks in Programming

Transcript

  1. "CPVU.F w ໊લ w 5XJUUFS!LFOHPTDBM w (JUIVCLFOTDBM w ৬ྺ w

    ηΩϡϦςΟܥ ೥݄ʙ  w .POFZ'PSXBSEॴଐʢ೥݄ʙʣ
  2. ૌু w ొ৔ਓ෺ w "ࣾൃ஫ଆɻ&ίϚʔεͷड஫γεςϜΛઃܭʙอकࠐΈͰܖ໿ w #ࣾ։ൃଆʢड஫ଆ  w ࣄ݅

    w ίʔυϨϕϧͰͷηΩϡϦςΟରࡦෆ଍ʹΑΓΫϨΧ৘ใ͕ྲྀग़ w "ࣾ͸#ࣾΛz࠴຿ෆཤߦͱଛ֐ഛঈͰຽࣄૌু w ͨͩ͠ܖ໿ʹ͸ຊ݅΢ΣϒαΠτͷηΩϡϦςΟରࡦΛߨ͡Δٛ ຿Λෛ͏͜ͱ͸نఆ͞Ε͍ͯͳ͔ͬͨ <Ҿ༻>IUUQXXXTPGUJDPSKQTFNJ@PQQEG
  3. ͳʹΑΓ w Ϣʔβʔʂɹ w ࣗ෼ͷ৘ใ͕ྲྀग़͢Δͱ͍͏ଛ w ࿙Ӯൃ֮࣌ͷରԠΛ͠ͳ͚Ε͹͍͚ͳ͍ଛ w ຊ౰ʹϝϯυ͍͘͞Ͱ͢ʢ࣮ମݧʣ w

    ࿙Ӯ༗ແͷ֬ೝɺ࿙Ӯൣғͷ֬ೝɺ࿙Ӯ಺༰ͷ֬ೝɺ ࿙Ӯ৘ใͷӨڹͷ൑அɺ࿙Ӯ৘ใͷมߋґཔɺ࿙Ӯ ରࡦͷ֬ೝ FUDFUD
  4. ر๬ʢॻ੶ʣͦͷ w ࠷ڧ w ߋʹηΩϡΞʹ͍ͨ͠ਓ޲͚ w έʔεʹԠͨ͡ΨΠυ͕خ͍͠ w αϯϓϧίʔυ΋๛෋ w

    ࠷৽ͷόʔδϣϯΛ௥ै w ແྉ w ۀքج४Ͱ͸ͳ͍ w "OESPJEΞϓϦͷηΩϡΞઃܭɾηΩϡΞίʔσΟ ϯάΨΠυ ஶ+44&$
  5. ׬

  6. ׬

  7. "OESPJEͷηΩϡϦςΟൣғ w ൣғ w ϑΝΠϧΞΫηεݖݶɺ"1,ϑΝΠϧอޢɺύʔ ϛογϣϯɺ"DUJWJUZ #SPBEDBTU 4FSWJDF  $POUFOU1SPWJEFSɺΠϯςϯτɺ҉߸Խɺ

    42-JUFɺ-PHDBU 8FC7JFX "DDPVOU.BOHFS  IUUQT ϓϥΠόγʔ৘ใɺύεϫʔυೖྗը໘  ΞϓϦέʔγϣϯอޢ ূ໌ॻ ৽͍͠ 1FSNJTTJPO $MJQCPBSE FUD FUD
  8. "OESPJEͷηΩϡϦςΟൣғ w ൣғ w ϑΝΠϧΞΫηεݖݶɺ"1,ϑΝΠϧอޢɺύʔ ϛογϣϯɺ"DUJWJUZ #SPBEDBTU 4FSWJDF  $POUFOU1SPWJEFSɺΠϯςϯτɺ҉߸Խɺ

    42-JUFɺ-PHDBU 8FC7JFX "DDPVOU.BOHFS  IUUQT ϓϥΠόγʔ৘ใɺύεϫʔυೖྗը໘  ΞϓϦέʔγϣϯอޢ ূ໌ॻ ৽͍͠ 1FSNJTTJPO $MJQCPBSE FUD FUD ɾɾɾώϩ͘Ͷ
  9. ։ൃऀͷ੹೚ൣғ w ηΩϡϦςΟൣғ w ϑΝΠϧΞΫηεݖݶɺ"1,ϑΝΠϧอޢɺύʔϛογϣϯɺ"DUJWJUZ  #SPBEDBTU 4FSWJDF $POUFOU1SPWJEFSɺΠϯςϯτɺ҉߸Խɺ42-JUFɺ -PH$BU

    8FC7JFX "DDPVOU.BOHFS IUUQT ϓϥΠόγʔ৘ใɺύεϫʔυ ೖྗը໘ ΞϓϦέʔγϣϯอޢ ূ໌ॻͷ؅ཧํ๏ ৽͍͠1FSNJTTJPO  $MJQCPBSE FUD FUD w ʹՃ͑ͯ ࣗ෼ͷମݧྫ  w ৽ن։ൃʢ໿̎ϲ݄ʣɺαʔϏεͷ,1*ʹԊ࣮ͬͨ૷ͷఏҊ શମͷઃܭ ίϯ ϙʔωϯτͷϥΠϑαΠΫϧΛߟྀͨ͠σʔλͷ΍ΓऔΓ ΧελϜ7JFXͷ࡞ ੒ σβΠφʔͱͷࣗࣾϒϥϯυͱ.BUFSJBM%FTJHOΨΠυʹԊͬͨσβΠϯͷ ݕ౼ɺ8FCଆ୲౰ऀͱͷ"1*࢓༷ݕ౼ ΧελϚʔαϙʔτ͔ΒͷόάใࠂରԠ  $*؀ڥͷ੔උɺςετͷ࡞੒ɺ"404&0ରࡦ FUD FUD
  10. ։ൃऀͷ੹೚ൣғ w ηΩϡϦςΟൣғ w ϑΝΠϧΞΫηεݖݶɺ"1,ϑΝΠϧอޢɺύʔϛογϣϯɺ"DUJWJUZ  #SPBEDBTU 4FSWJDF $POUFOU1SPWJEFSɺΠϯςϯτɺ҉߸Խɺ42-JUFɺ -PH$BU

    8FC7JFX "DDPVOU.BOHFS IUUQT ϓϥΠόγʔ৘ใɺύεϫʔυ ೖྗը໘ ΞϓϦέʔγϣϯอޢ ূ໌ॻͷ؅ཧํ๏ ৽͍͠1FSNJTTJPO  $MJQCPBSE FUD FUD w ʹՃ͑ͯ ࣗ෼ͷମݧྫ  w ৽ن։ൃʢ໿̎ϲ݄ʣɺαʔϏεͷ,1*ʹԊ࣮ͬͨ૷ͷఏҊ શମͷઃܭ ίϯ ϙʔωϯτͷϥΠϑαΠΫϧΛߟྀͨ͠σʔλͷ΍ΓऔΓ ΧελϜ7JFXͷ࡞ ੒ σβΠφʔͱͷࣗࣾϒϥϯυͱ.BUFSJBM%FTJHOΨΠυʹԊͬͨσβΠϯͷ ݕ౼ɺ8FCଆ୲౰ऀͱͷ"1*࢓༷ݕ౼ ΧελϚʔαϙʔτ͔ΒͷόάใࠂରԠ  $*؀ڥͷ੔උɺςετͷ࡞੒ɺ"404&0ରࡦ FUD FUD ɾɾɾΩπ͘Ͷ
  11. #VJME4FDVSJUZ*Oͷ঺հ w ࠷ۙηΩϡϦςΟۀքͰ੝Γ্͕ͬͯΔ w l#VJME4FDVSJUZ*OJTBDPMMBCPSBUJWFF⒎PSUUIBU QSPWJEFTQSBDUJDFT UPPMT HVJEFMJOFT SVMFT QSJODJQMFT

     BOEPUIFSSFTPVSDFTUIBUTPGUXBSFEFWFMPQFST  BSDIJUFDUT BOETFDVSJUZQSBDUJUJPOFSTDBOVTFUPCVJME TFDVSJUZJOUPTPGUXBSFJOFWFSZQIBTFPGJUT EFWFMPQNFOUz w CZ64$&35 ถࠃࠃ౔҆શอোলʢ%)4ʣ഑Լͷ৘ใηΩϡϦςΟରࡦ૊৫ <Ҿ༻>IUUQXXXTPGUJDPSKQTFNJ@PQQEG
  12. "OESPJEઃܭ࣌ͷϙΠϯτ w ίίΒ΁Μʹ͍ͭͯಛʹ஫ҙΛ෷͍͍ͨʢLFOHPTDBMతʹʣ w ख໭Γ޻਺ɾӨڹ͕େ͖͍΋ͷ w σʔλͷอ؅ํ๏ w ηογϣϯͷอ࣋ͷ͔ͨ͠ w

    1FSNJTTJPO w SE1BSUZ੡ͷ޿ࠂϞδϡʔϧ w 8FC7JFXͰԿॲͰ࢖ͬͯɺԿΛ͍͔ͨ͠ w ҉߸Խํࣜ w ࿈ܞΞϓϦͷ༗ແʢίϯϙʔωϯτؒͷ࿈ܞʣ
  13. ϔομͷೖྗ஋νΣοΫ <Ҿ༻4RVBSF>IUUQTHJUIVCDPNTRVBSFPLIUUQCMPCNBTUFSPLIUUQTSDNBJOKBWB private void checkNameAndValue(String name, String value) { if

    (name == null) throw new NullPointerException("name == null"); if (name.isEmpty()) throw new IllegalArgumentException("name is empty"); for (int i = 0, length = name.length(); i < length; i++) { char c = name.charAt(i); if (c <= '\u001f' || c >= '\u007f') { throw new IllegalArgumentException(String.format( "Unexpected char %#04x at %d in header name: %s", (int) c, i, name)); } } if (value == null) throw new NullPointerException("value == null"); for (int i = 0, length = value.length(); i < length; i++) { char c = value.charAt(i); if (c <= '\u001f' || c >= '\u007f') { throw new IllegalArgumentException(String.format( "Unexpected char %#04x at %d in %s value: %s", (int) c, i, name, value)); } } } w ରࡦࡁΈͷPLIUUQ͔Βίϐϖ
  14. ϩʔΧϧ։ൃ؀ڥ "༻ 'FUDI1VTI #༻ $༻ 'FUDIPS)PPL #VJME%FQMPZ #BDLVQ ϦϦʔεϏϧυ͸$*πʔϧͷδϣϒ͔ΒͷΈ LFZ4UPSFΛू໿

    ։ൃऀ͸جຊ8FC$IBU͔ΒδϣϒΛΩοΫ͢ΔͷΈ TTIͳͲͷϦϞʔτૢ࡞͸ݶఆ͞Εͨ໾৬ͷΈ