Secure Development - Lviv IT Arena

Secure Development - Lviv IT Arena

September 2016.

Transcript

1. Secure Development with Android Enrique López-Mañas
2. Ego Slide • IT Consultor • Google Developer Expert • @eenriquelopez
3. Agenda • File Storage • Securing network communications • Reverse Engineering and Obfuscation • Databases • Demo • Misc
4. External Storage vs Internal Storage • getExternalStorageDirectory() is like parking your car on the street • All apps can access your files • Files may not be removed or uninstalled • SD Card can be removed
5. External Storage vs Internal Storage • getFilesDir() is like parking in your own garage • Other apps are generally not able to get in your sandbox • Root phones and emulator can access it • Files get removed during uninstall
6. Other considerations No MODE_WORLD_READABLE ! No MODE_WORLD_WRITEABLE! 
 

7. Reverse Engineering • Obtaining source code from a compiled binary
8. Why Java? • Java is partially compiled, and then interpreted • JVM and opcodes are fixed • Few instructions • No real protection
9. Why Android? • APKs are easily downloadable • Obfuscation does not happen by default • APK to Jar Translation is easy
10. Why Android?
11. Legal issues recipes • Don’t decompile, recompile, and pass it off as your own • Don’t try to sell it as your own • If License Agreement forbids decompiling, do not decompile • Don’t decompile to remove protection mechanisms
12. Legal issues recipes YES • Understand interoperatibility • Create a program interface NO • Create a copy and sell it
13. Purpose
14. Purpose
15. Purpose
16. Purpose http://bit.ly/leakingWhatsapp
17. Obtain APKs • Pulling from device • Using GooglePlay Python API • Alternative sources • Sniffer transfers
18. Protecting against Reverse Engineering 1. Writing two versions of the app 2. Obfuscation (When obfuscation is outlawed, only outlaws will sifjdifdm wofiefiemfeifm) 3. Webservices 4. FingerPrinting code 5. Native methods
19. ProGuard
20. SQL Databases
21. SQL Databases
22. SQL Databases
23. SQL Databases
24. SQL Databases Use an ORM!
25. Demo • HTTP Sniffing • Securing files & credentials • Reverse Engineering
26. Native Code
27. Native Code
28. Native Code
29. Native Code
30. Misc • Minimize permission usage • Perform Input Validation (buffer overflow, etc) • Do not load code dynamically
31. We love feedback! • bit.ly/feedbackLVIV