ANDROID APP SECURITY:
ON A BUDGET
SCOTT ALEXANDER-BOWN
ANDROID FREELANCER
@SCOTTYAB
Slide 2
Slide 2 text
DEVELOPER - ANDROID
AUTHOR - ANDROID SECURITY COOKBOOK
ORGANISER - SWMOBILE GROUP
@SCOTTYAB
SCOTT ALEXANDER-BOWN
Slide 3
Slide 3 text
TL;DR
STORY OF IMPROVING APP SECURITY.
MIN EFFORT. MAX IMPACT
@SCOTTYAB
Slide 4
Slide 4 text
APP: ACME CORP
DISCLAIMER:
ALL CHARACTERS APPEARING IN THIS
WORK ARE FICTITIOUS. ANY
RESEMBLANCE TO REAL PERSONS, LIVING
OR DEAD, IS PURELY COINCIDENTAL.
@SCOTTYAB
Slide 5
Slide 5 text
No content
Slide 6
Slide 6 text
No content
Slide 7
Slide 7 text
No content
Slide 8
Slide 8 text
No content
Slide 9
Slide 9 text
OUR REPUTATION!
@SCOTTYAB
Slide 10
Slide 10 text
WHAT CAN YOU DO?
@SCOTTYAB
Slide 11
Slide 11 text
@SCOTTYAB
Slide 12
Slide 12 text
3 Sneaky Sprints
1. Connection between app and api/server
2. Device integrity and Data
3. Apk integrity and protection.
@SCOTTYAB
Slide 13
Slide 13 text
SNEAK SPRINT 1:
NETWORK
@SCOTTYAB
Slide 14
Slide 14 text
Let’s make
SSL
Stronger!
@SCOTTYAB
Slide 15
Slide 15 text
SSL Connection spec
Use only strong cipher suites (128bit+)
TLS versions (TLS v1.2)
@SCOTTYAB
Slide 16
Slide 16 text
Patch against SSL exploits
• Android relies on a security ‘Provider’ to provide secure network
communications.
• Google Play Services provides a way to update the device security
provider
• ProviderInstaller.installIfNeeded(getContext());
@SCOTTYAB
Slide 17
Slide 17 text
SSL/TLS Pinning
Pinning limits the trusted root CA’s
Devices ship with 100+ Certificate Authorities (CA) and
users can install their own
Two types of pinning
* Certificate pinning
* Public Key pinning
What is SSL pinning?
@SCOTTYAB
Slide 18
Slide 18 text
SSL Pinning with OKhttp
SSL pin generator
http://bit.ly/sslpin
OKHttp Version
OkHttp 3.1.2+
OkHttp 2.7.4+
@SCOTTYAB
Slide 19
Slide 19 text
Let’s make Webview less shit
safer
Slide 20
Slide 20 text
Webview
Disable risky settings
Javascript
File access
White list urls / domains
https://gist.github.com/scottyab/6f51bbd82a0ffb08ac7a
@SCOTTYAB
Slide 21
Slide 21 text
SNEAK SPRINT 2:
DEVICE INTEGRITY AND DATA
@SCOTTYAB
Slide 22
Slide 22 text
No content
Slide 23
Slide 23 text
Device Integrity
Check the execution environment
Root Check
Root Beer - https://github.com/scottyab/rootbeer
SafteyNet API (Google Play services)
SafetyNet Wrapper - https://github.com/scottyab/safetynethelper
@SCOTTYAB
Slide 24
Slide 24 text
Encrypt (obfuscate) Data
Shared preferences - replaces with secure-preferences (or Hawk)
https://github.com/scottyab/secure-preferences
SQLlite - replaced with SQL Cipher for Android
https://github.com/sqlcipher/android-database-sqlcipher
Realm - has an encryption option
https://github.com/realm/realm-java/tree/master/examples/
encryptionExample
@SCOTTYAB
Tamper check
Android requires all apps to be
digitally signed
Consistent for life of app
Needed to publish app updates
@SCOTTYAB
Slide 28
Slide 28 text
Build time
1. Get you certificate signature
$keytool -list -v -keystore your_app.keystore
2. Embed in app
String CERTIFICATE_SHA1 = “71920AC9486E087DCBCF5C7F6F…”
@SCOTTYAB
Slide 29
Slide 29 text
Run time
3. Get the Signature from the
PackageManager
4. Hash the Signature
5. Compare the signature hashes strings
@SCOTTYAB
Slide 30
Slide 30 text
Obfuscation: ProGuard
Java code obfuscator
Part of the Android SDK (free!)
To turn on: minifyEnabled=true
@SCOTTYAB
Slide 31
Slide 31 text
No content
Slide 32
Slide 32 text
ProGuard tips
Add to config when you add a new lib
Strip Log statements
Crash stack traces
Gradle Proguard plugin
https://github.com/hotchemi/gradle-proguard-plugin
Consider: DexGuard (paid)
@SCOTTYAB
Slide 33
Slide 33 text
No content
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
No content
Slide 36
Slide 36 text
Cons
More code==more complexity
APK file size was larger
Slower to start up
Encrypted data is really only obfuscated
ProGuard config was time consuming
No credit for our hard work
@SCOTTYAB
Slide 37
Slide 37 text
Pros
Less vulnerable to MITM
Webviews are less vulnerable to XSS attacks
Curious rooted users cannot simply edit our db and pref data
Rooted users will struggle
Re-complication is hampered tamper check
Understanding the decompiled code is hampered by the obfuscation
@SCOTTYAB
Slide 38
Slide 38 text
DID WE WIN?
Slide 39
Slide 39 text
DID WE WIN?
Slide 40
Slide 40 text
DID WE WIN?
Slide 41
Slide 41 text
DID WE WIN?
Much
Win
wow
so security
Slide 42
Slide 42 text
WHAT CAN YOU DO?
@SCOTTYAB
Slide 43
Slide 43 text
@SCOTTYAB
STRENGTH SSL/TLS
SSL PINNING
WHITE LIST WEBVIEW
CHECK FOR ROOT
ENCRYPT DATA AT REST
TAMPER CHECK
OBFUSCATE
Slide 44
Slide 44 text
No content
Slide 45
Slide 45 text
No content
Slide 46
Slide 46 text
Resources
Secure mobile development best practices - https://github.com/
nowsecure/secure-mobile-development
OWASP Mobile security risks - http://bit.ly/owaspmobile
Android security cookbook - http://bit.ly/MscEFu
Best Practices for Security & Privacy - https://developer.android.com/
training/best-security.html
Adding Tamper detection to your apps - https://www.airpair.com/android/
posts/adding-tampering-detection-to-your-android-app
@SCOTTYAB