The Android Security Jungle: Pitfalls, Threats & Survival Tips

1fa9cb8c7997c8c4d3d251fb5e41f749?s=47 Realm
October 06, 2015

The Android Security Jungle: Pitfalls, Threats & Survival Tips

Presented by Scott Alexander-Bown at GOTO Copenhagen 2015

1fa9cb8c7997c8c4d3d251fb5e41f749?s=128

Realm

October 06, 2015
Tweet

Transcript

  1. 4.

    • Lead Android Dev (remote) at Intohand • Co-Author -

    Android Security Cookbook • Co-Founder of SWmobile Scott Alexander-Bown
  2. 7.
  3. 8.

    Security Services • Google Play • Approval process (human approval

    since 2015) • Developer security notifications • Android Bouncer • Android device manager (Device security) • Safety net (intrusion detection) • Android at Work
  4. 10.

    Newer version of Android are more secure 1.5 stack buffer,

    integer overflow protection 2.3+ null pointer dereference mitigation, NX 4.0+ ASLR 4.1+ ASLR strengthened 4.3 Security-Enhanced Linux 5.0 Security-Enhanced Linux - enforcing Updatabled Webview (via playstore)
  5. 11.
  6. 12.

    Threats: App Hijacking • Taking an app and adding malware

    • Concerns • Reversing Android apps is easy • No need for certificate authority • Sideload
  7. 14.
  8. 15.
  9. 16.

    OWASP • Mobile Security Project • iOS and Android •

    Top 10 risks • attack vectors • threat agents • impacts
  10. 17.

    OWASP top 10 risks • M1: Weak Server Side Controls

    • M2: Insecure Data Storage • M3: Insufficient Transport Layer Protection • M4: Unintended Data Leakage • M5: Poor Authorization and Authentication • M6: Broken Cryptography • M7: Client Side Injection • M8: Security Decisions Via Untrusted Inputs • M9: Improper Session Handling • M10: Lack of Binary Protections
  11. 19.

    Survival tips 1. Harden the network communications 2. Protect stored

    data (encryption) 3. Validate the device and app integrity 4. Increase binary security
  12. 20.

    Network communications • Use SSL / TLS! • Use the

    platform SSL/TLS validation (i.e don’t disable it!) • Use only strong cipher suites (128bit+) and TLS versions (TLS v1.2) • OkHttp 2.1 - https://publicobject.com/2014/11/12/okhttp-2-1/
  13. 21.

    Looks like you’re not using SSL pinning? • Devices ship

    with 100+ Certificate Authorities (CA) and users can install their own • Pinning limits the trusted root CA’s • Two types • Certificate pinning • Public Key pinning
  14. 23.

    Patch against SSL exploits • Google Play Services provides a

    dynamic security provider • ProviderInstaller.installIfNeeded(getContext()); • https://developer.android.com/training/articles/security-gms- provider.html#patching
  15. 24.
  16. 29.

    Signing Certificate Verification Build-time Runtime 1. Get you certificate signature

    $keytool -list -v -keystore your_app.keystore 2. Embed in app String CERTIFICATE_SHA1 = “71920AC9486E087DCBCF5C7F6F…”; 3. Get the Signature from the PackageManager 4. Hash the Signature 5. Compare the signature hashes strings
  17. 30.

    Verifying device integrity • Emulator check • https://github.com/strazzere/a nti-emulator •

    Google SafteyNet test • https://github.com/scottyab/sa fetynethelper
  18. 31.

    root@android:/ # • Root apps / Dangerous apps • Suspect

    system properties • SU/BusyBox binaries • RW /system • https://github.com/scottyab/rootbeer
  19. 33.

    ProGuard • Java code obfuscator • Part of the Android

    SDK • Free as in Beer! • ReTrace - Supported by Error handling services such as Crashlytics
  20. 34.

    DexGuard • Commercial version of ProGuard • Designed for Android

    and protection • Useful security utils - SSL Pinning, Root check, logging removal etc • My favourite features • String Encryption • API hiding
  21. 35.
  22. 36.

    Quick Android Review Kit (Quak) • Python script • Works

    with .apk or source code • Automated tests • weaknesses • exploits • Creates exploit .apks • https://github.com/linkedin/qark
  23. 37.
  24. 38.

    Click here for more! • 42+ Secure mobile development tips

    http://bit.ly/viafor42 • OWASP Mobile security risks http://bit.ly/owaspmobile • Android security cookbook [book] http://bit.ly/MscEFu • Android security internals [book] http://bit.ly/andsecint • Droidsec (whitepapers) droidsec.org/wiki
  25. 39.
  26. 40.
  27. 43.
  28. 44.
  29. 45.

    WebView • Before • getSettings().setJavaScriptEnabled(false) • getSettings().setAllowFileAccess(false) • During •

    WebViewClient.shouldOverrideUrlLoading() • enforce local content or Https • Whitelisted hosts/urls • .shouldInterceptRequest() to intercept XmlHttpRequests • After • webview.clearCache(true)