DroidCon Poland - Secure Development with Android

Presentation at the DroidCon Poland 2015

Transcript

1. Secure Development with Android Enrique López-Mañas Nick Skelton
2. Ego Slide • IT Consultor • Google Developer Expert • @eenriquelopez
3. Ego Slide • Software Manager @ Sixt Germany • @nshred • Not very egotistical
4. Agenda • Introduction • Securing network communications • File Storage • Reverse Engineering and Obfuscation • Demo
5. HTTP Sniffing with Chuck • HTTP proxies: • Charles (Mac) • Fiddler (Windows) • Great for debugging dodgy backends • Great for simulating dodgy connections • Works with SSL
6. External Storage vs Internal Storage • getExternalStorageDirectory() is like parking your car on the street • All apps can access your files • Files may not be removed on uninstall • SD Card can be removed • getFilesDir() is like parking in your own garage • Other apps are generally not able to get in your sandbox • Rooted phones and emulators can access it
7. File Encryption • Facebook Conceal encryption • Simple • Secure out of the box (AES-GCM) • Small payload (85kb) • https://github.com/facebook/conceal
8. File Encryption • IOCypher and SQLCypher • Great for encrypting a complete filesystem or database • More complicated in terms of setup, keygen and error handling
9. Reverse Engineering • Obtaining source code from a compiled binary
10. Why Java? • Java is partially compiled, and then interpreted • JVM and opcodes are fixed • Few instructions • No real protection
11. Why Android? • APKs are easily downloadable • Obfuscation does not happen by default • APK to Jar Translation is easy
12. Legal issues recipes • Don’t decompile, recompile, and pass it off as your own • Don’t try to sell it as your own • If License Agreement forbids decompiling, do not decompile • Don’t decompile to remove protection mechanisms
13. Legal issues recipes YES • Understand interoperatibility • Create a program interface NO • Create a copy and sell it
14. Purpose
15. Purpose
16. Obtain APKs • Pulling from device • Using GooglePlay Python API • Alternative sources • Sniffer transfers
17. Protecting against Reverse Engineering 1. Writing two versions of the app 2. Obfuscation (When obfuscation is outlawed, only outlaws will sifjdifdm wofiefiemfeifm) 3. Webservices 4. FingerPrinting code 5. Native methods for storing strings
18. Code • HTTP Sniffing • Securing files & credentials • Reverse Engineering
19. We love feedback! • http://bit.ly/feedbackDroidconPL • https://github.com/kikoso/DroidCon-Poland
20. #dfist