Intro to Pre-Report "The Security"

In Google I/O 2016, new functionality "Pre-Report" was introduced in Google Play Developer Console. When alpha/beta apk is uploaded there, then various devices with different OS installs the apk and inspect the app by running it just like our users. Not only the result of manipulation including crash events will be reported on Pre-Report, but also vulnerability scan will be conducted. I was curious what type of scan will be done, and this presentation is the first report.

Transcript

1. *OUSP
   UP
   1SF3FQPSU
   l5IF
   
   4FDVSJUZz !LFOTDBM
   !LFOHPTDBM
2. "HFOEB w 4FMG
   *OUSPEVDUJPO
   w 4IPSU
   0WFSWJFX
   PG
   1SF3FQPSU
   w 0CKFDUJWF
   w )ZQPUIFTJT
   w "U
   MFBTU
   *
   USJFE
   w $PODMVTJPO
3. "CPVU
   .F w ໊લ
   w ླ໦ݚޗ
   w 5XJUUFS
   !LFOHPTDBM
   w (JUIVC
   LFOTDBM
   w ৬ྺ
   w ๭ηΩϡϦςΟاۀॴଐ ೥݄ʙ
   w ๭'JOUFDIܥελʔτΞοϓॴଐʢ೥݄ʙʣ
4. "HFOEB w 4FMG
   *OUSPEVDUJPO
   w 1SF3FQPSU
   4IPSU
   0WFSWJFX
   w 0CKFDUJWF
   w )ZQPUIFTJT
   w "U
   MFBTU
   *
   USJFE
   w $PODMVTJPO
5. 1SF3FQPSU w lΞϧϑΝ൛·ͨ͸ϕʔλ൛ͷ"1,
   ΛΞοϓϩʔυ ͯ͠ެ։͢Δͱɺςετ୺຤͕ࣗಈతʹΞϓϦΛى ಈͯ͠ɺΞϓϦΛ਺෼ؒΫϩʔϧ͠·͢z
   
   w Ϋϥογϡ
   w εΫϦʔϯγϣοτ
   w ηΩϡϦςΟ
   w ։ൃऀ͕࣮૷ʹ͚ͩूதͰ͖Δੈք ɾ㱼ɾ ŘŘŮ <Ҿ༻>ϦϦʔεલϨϙʔτΛ࢖ͬͯ໰୊Λಛఆ͢Δ
6. 5JQT w ηΩϡϦςΟςετ͸͕͔͔࣌ؒΔ NJO͘Β͍
   w (PPHMF
   "VUI࿈ܞΛ͍ͯ͠Ε͹αΠϯΠϯ΋উखʹ
   w ഑෍஍Ҭ͕ࠃͰ΋ώϯσΟʔޠͱΞϥϏΞޠͷςε τΛ͢ΔX
   w աڈʹΞοϓϩʔυͨ͠ΞϧϑΝɾϕʔλ൛΋ର৅ʹ ͯ͘͠ΕΔͬΆ͍
   w ͨͩ͠ΫϥογϡͱεΫϦʔϯγϣοτͷΈ
8. "HFOEB w 4FMG
   *OUSPEVDUJPO
   w 1SF3FQPSU
   4IPSU
   0WFSWJFX
   w 0CKFDUJWF
   w )ZQPUIFTJT
   w "U
   MFBTU
   *
   USJFE
   w $PODMVTJPO
9. 0CKFDUJWF w ։ൃऀ͕࣮૷ʹ͚ͩूதͰ͖Δੈք ɾ㱼ɾ ŘŘŮ
   w ࠓ͸༗ঈͷ΋ͷ͔͠ͳ͍ͷͰɺ ͕ۚͳ͍ͱ ݁ߏ͖ ͍ͭ
   w lཧ૝͸ฏ࿨͕ͩɺྺ࢙͸࢒ࠅͩz
   
   CZ
   ŲƄŽűƅ
10. 0CKFDUJWF w ։ൃऀ͕࣮૷ʹ͚ͩूதͰ͖Δੈք ɾ㱼ɾ ŘŘŮ
    w ࠓ͸༗ঈͷ΋ͷ͔͠ͳ͍ͷͰɺ݁ߏ͖͍ͭ
    w lཧ૝͸ฏ࿨͕ͩɺྺ࢙͸࢒ࠅͩz
    
    CZ
    ŲƄŽűƅ
    w ແঈͷ΋ͷ͕ग़͔ͨΒඈͼ͍ͭͯΈͨ
    w ݱ࣌఺ͰͲΕ͚ͩ࢖͑Δͷ͔ݕূ
11. )ZQPUIFTJT w ੩తղੳ
    PS
    ಈతղੳʁ
    w ϦϦʔεલϨϙʔτͷઆ໌͔Βਪଌ͢ΔͱɺΞϓϦ Λ࣮ػಈ࡞֤ͤͯ͞Ϩϙʔτ͕࡞ΒΕͯΔͬΆ͍
    w ಈతղੳͬΆ͍આ໌
    w Ͱ΋ɺͦ͏͢ΔͱΞϓϦʹ߈ܸʢ৔߹ʹΑͬͯ͸ɺ αʔόଆʹ΋߈ܸʣͯ͠Δ͜ͱʹͳΔΞάϨογϒ ͳαʔϏε
12. )ZQPUIFTJT ʊਓਓਓਓਓਓਓਓਓʊ
    ʼ੩తղੳʹҧ͍ͳ͍ʻ
    ʉ:?:?:?:?:?:?:?:ʉ
13. "HFOEB w 4FMG
    *OUSPEVDUJPO
    w 1SF3FQPSU
    4IPSU
    0WFSWJFX
    w 0CKFDUJWF
    w )ZQPUIFTJT
    w "U
    MFBTU
    *
    USJFE
    w $PODMVTJPO
14. ݕূ߲໨ w ෆཁͳίϯϙʔωϯτͷެ։
    w -PH$BU΁ͷϩάग़ྗ
    w ੬ऑͳΞϧΰϦζϜʹΑΔ҉߸Խ
    w 44-ʹΑΔIUUQT઀ଓ
    w ϗετ໊ݕূແࢹ
    w 8FC7JFXશൠ
15. ෆཁͳίϯϙʔωϯτͷެ։
    -PH$BU΁ͷϩάग़ྗ w ಛʹQSPHVBSEͷઃఆ͸ͳ͠
16. ݁Ռ w ·͋ɺ੬ऑੑͰ͸ͳ͍ΑͶ
    w ͱ͍͏͜ͱͰೲಘ
17. ੬ऑͳΞϧΰϦζϜʹΑΔ҉ ߸Խ w %&4ʹΑΔ҉߸Խ
    ϒϧʔτϑΥʔεͰղಡͰ͖ͯ ͠·͏ऑ͍҉߸ͳͷͰɺ೥ʹҾୀࡁΈ
18. ݁Ռ w ΉΉΉ
    w ҉߸Խํࣜ·Ͱ͸ݟͳ͍ʁ
19. 44-ʹΑΔ)5514઀ଓ w 1PPEMF
    44-ͷ੬ऑੑ
    w Ұ෦ͷ௨৴͕ղಡՄೳͳ੬ऑੑ
    w $ISPNF͔Β44-Λແޮʹ͍ͯ͠Δ͕ɺ "OESPJEͰ͸ʜ
    <Ҿ༻>44-
    
    ͷ੬ऑੑରࡦʹ͍ͭͯ $7&
20. 5SVTU.BOBHFS্ॻ͖ w શূ໌ॻड෇
21. ϗετ໊ݕূແࢹ
22. ݁Ռ w ΉΉΉʜ
    w ϗετ໊ݕূແࢹ͸ݕग़ͯ͠΄͔ͬͨ͠
    w ͜͜ΒลͰɺݕূํ๏ʹ໰୊͕͋Δ͔ෆ҆ʹͳͬͯ
23. 8FC7JFXͬͨࠞͥ͝
24. 8FC7JFXͬͨࠞͥ͝ w 44-ݕূແࢹ
    w ෆཁͳTFU+BWBTDSJQU&OBCMFE USVF
    w "1*ະຬͰ!+BWBTDSJQU*OUFSGBDF͕ͳ͍ϝιο υΛ࣋ͭΞϓϦʹɺ+BWB4DSJQUܦ༝Ͱ޷͖ʹϦϑ ϨΫγϣϯͰ৭ʑͰ͖ͪΌ͏੬ऑੑ
    w ͳͲ
25. ݁Ռ
26. ݁Ռ ੬ऑੑͷ಺༰ͱӨڹ मਖ਼ํ๏ ϦϑΝϨϯε
27. ݁Ռ w 44-ݕূແࢹͷΈݕ஌
    w "1*ʹΑͬͯ੬ऑੑϙΠϯτ͕ҟͳΔ৔߹͸ݕࠪ͞ Εͳ͍ʁ
    w "1*ະຬΛUBSHFUʹͯ͠ςετͯ͠ΈΔ
    w ςʔϚͱ͔ͷमਖ਼͕ΊΜͲͯ͘΍Βͳ͔ͬͨ
    w ๬·͘͠ͳͯ͘΋ɺۀ຿্ඞཁʹͳΓͦ͏ͳ࣮૷͸ ΞϥʔτΛ͋͛ͳ͍Α͏ʹͯ͠Δͷ͔΋
28. मਖ਼ͯ͠Έͨ w ࡶX
29. ݁Ռ w ௚ͬͨX
    w ੩తղੳͰ͋Δ͜ͱ͕൑໌
30. 1FSNJTTJPOશ৐ͤ
31. ݁Ռ w ෆࣗવͳ1FSNJTTJPO͔ͷ൑அ͸͠ͳ͍ͬΆ͍
    w ΍ͬͺΓ੩తղੳͬΆ͍
32. "HFOEB w 4FMG
    *OUSPEVDUJPO
    w 1SF3FQPSU
    4IPSU
    0WFSWJFX
    w 0CKFDUJWF
    w )ZQPUIFTJT
    w "U
    MFBTU
    *
    USJFE
    w $PODMVTJPO
33. $PODMVTJPO w ·ͩԿΛݕ஌ͯ͘͠ΕΔͷ͔Θ͔Βͳ͍
    w ๬·͘͠ͳͯ͘΋ɺۀ຿্ඞཁʹͳΓͦ͏ͳ࣮૷ ͸ΞϥʔτΛ͋͛ͳ͍Α͏ʹͯ͠Δͷ͔΋
    w ๬·͘͠ͳͯ͘΋ۀ຿্ඞཁͳ΋ͷྫ
    w 44-W
    JO
    ൃల్্ࠃ
34. ωοτ؀ڥ͕੔͍ͬͯΔΞϝϦΧͱ͸໎࿭ͷ࣍ݩ͕ҧ͏ɻຫੑ తͳࢿۚෆ଍Ͱݻఆճઢ΋ͳ͘ɺωοτ઀ଓ͸ߴֹͷӴ੕௨৴ ʹཔ͍ͬͯΔ/(0ʹͱͬͯ͸ࢮ׆໰୊ͩɻ΋͠μ΢ϯϩʔυ ͕࠷ޙ·ͰऴΘ͍ͬͯΕ͹ɺ௨৴ྉ͸ສυϧʹ্ͬͯ ͍ͨͱ͍͏ࢼࢉ΋͋Δɻ <Ҿ༻>8JOEPXTͷࣗಈߋ৽ϓϩάϥϜɺΞϑϦΧͷ/(0Λةݥʹ͞Β͢ ۀ຿্ඞཁͳྫΛߟྀ͠ͳ͍ ͱ͜͏ͳΔ
35. $PODMVTJPO w ੩తղੳͰ͋Δ͜ͱ͕൑໌
    w ԿΛݕ஌ͯ͘͠ΕΔͷ͔Θ͔Βͳ͍
    w ๬·͘͠ͳͯ͘΋ɺۀ຿্ඞཁʹͳΓͦ͏ͳ࣮૷͸ΞϥʔτΛ ͋͛ͳ͍Α͏ʹͯ͠Δͷ͔΋
    w ৭ʑɺະ஌਺
    w ͦ΋ͦ΋Զͷ࣮૷ɾςετख๏͋ͬͯΔ͔ʁ
    w ˣ΋ࢼͯ͠ΈΔ
    w ϥΠϒϥϦʹ͓͚Δ੬ऑੑ
    w ྫ
    0L)UUQະຬͷ)551ϔομΠϯδΣΫγϣϯ
36. Զͨͪͷઓ͍͸͜Ε͔Βͩʂ
37. ΞΠσΟΞืूதʂ
38. 5IBOL
    :PV