Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Android Security Tips

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for Merab Tato Kutalia Merab Tato Kutalia
May 15, 2019
Technology
65
1

Android Security Tips

Android Security Tips

Avatar for Merab Tato Kutalia

Merab Tato Kutalia

May 15, 2019

More Decks by Merab Tato Kutalia

See All by Merab Tato Kutalia
What's new in Android 14?
Avatar for Merab Tato Kutalia tatocaster
0
220
Migrate to Gradle version catalog and convention plugins
Avatar for Merab Tato Kutalia tatocaster
3
1.9k
Make Codebases Secure with OWASP
Avatar for Merab Tato Kutalia tatocaster
0
220
Secure Coding Standards
Avatar for Merab Tato Kutalia tatocaster
0
190
ტანგო ანდროიდთან
Avatar for Merab Tato Kutalia tatocaster
0
340
Adopting Huawei Mobile Services
Avatar for Merab Tato Kutalia tatocaster
0
86
Android UI Testing & Challenges
Avatar for Merab Tato Kutalia tatocaster
1
130
Reverse & Inject - droidcon
Avatar for Merab Tato Kutalia tatocaster
3
340
mobile DevOps
Avatar for Merab Tato Kutalia tatocaster
1
170

Other Decks in Technology

See All in Technology
『三匹の子ぶた』から学ぶネットワークセキュリティの昔と今 / Network Security: Then and Now Through the Lens of The Three Little Pigs
Avatar for NTT docomo Business nttcom
1
1.8k
ガバメントクラウドでのランサムウェア対策
Avatar for 高橋広和 techniczna
2
990
Forza Horizon 6 のテレメトリ機能で 自動運転に使えそうな学習データを集める話
Avatar for henjin0 henjin0
0
150
Issue設計から始める仕様駆動開発 / 20260731 Mizuki Hirata
Avatar for SHIFT EVOLVE shift_evolve
PRO
1
150
クラウドセキュリティ入門　～安全なクラウド利用のための基礎知識～
Avatar for LHazy lhazy
11
8.3k
え？フロントエンドエンジニアの ワイがインフラも！？
Avatar for puku0x puku0x
1
430
強化学習「理論」入門
Avatar for Etsuji Nakai enakai00
3
3.6k
PLATEAU で バーチャル花火大会
Avatar for tatsuya1970 tatsuya1970
0
110
【Google Cloud Next Tokyo'26】Gemini Enterprise と Oracle AI Database で実現する、 業務データ活用を実現する AI エージェント実装
Avatar for KoheiOgawa shisyu_gaku
0
230
研究開発部の紹介 / Sansan R&D Profile
Avatar for Sansan, Inc. sansan33
PRO
4
24k
修正PRを食べてレビュースキルが賢くなる：Claude Codeによる自己改善サイクル
Avatar for um(うめ) yuyaumetsu
5
1.4k
攻撃と防御で学ぶAI時代のプロダクトセキュリティ演習
Avatar for Recruit recruitengineers
PRO
6
2.1k

Featured

See All Featured
What the history of the web can teach us about the future of AI
Avatar for Ines Montani inesmontani
PRO
1
650
Building Adaptive Systems
Avatar for Chris Keathley keathley
44
3.2k
jQuery: Nuts, Bolts and Bling
Avatar for Doug Neiner dougneiner
66
8.5k
Building Experiences: Design Systems, User Experience, and Full Site Editing
Avatar for Michelle Schulp Hunt marktimemedia
0
570
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
97
6.7k
[SF Ruby Conf 2025] Rails X
Avatar for Vladimir Dementyev palkan
2
1.2k
Leo the Paperboy
Avatar for Maya Tellez mayatellez
8
2.1k
Navigating the moral maze — ethical principles for Al-driven product design
Avatar for Skipper Chong Warson skipperchong
2
470
Exploring anti-patterns in Rails
Avatar for Elle Meredith aemeredith
3
460
Ecommerce SEO: The Keys for Success Now & Beyond - #SERPConf2024
Avatar for Aleyda Solis aleyda
1
2.1k
The agentic SEO stack - context over prompts
Avatar for schlessera schlessera
0
860
The untapped power of vector embeddings
Avatar for Frank van Dijk frankvandijk
2
1.8k

Transcript

  1. Android App Security Tips Merabi Kutalia

  2. Tato Kutalia tatocaster tatocaster.me github.com/tatocaster twitter.com/@TatoKutalia

  3. None

  4. Topics • data storage • app permissions • networking •

    webview(javascript) • dynamically loaded code

  5. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17)

  6. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable

  7. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q)

  8. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection)

  9. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection) • Shared preferences + leak

  10. app permissions • data leak caused by misused permissions

  11. networking • HTTPS (it’s 2019!)

  12. networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352)

  13. networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352) •

    GCM/FCM/SMS (Sensitive Data)

  14. webview • setJavascriptEnabled - No!

  15. webview • setJavascriptEnabled - No!

  16. webview • setJavascriptEnabled - No! • webkit

  17. dynamically loaded code • Yes you can (https://stackoverflow.com/q/ 6857807/6845290 )

  18. Proguard/R8

  19. Proguard • rules

  20. Tools • Apktool • Dex2Jar • JD-GUI

  21. Nomrebi .com

  22. Nomrebi .com

  23. None

  24. Thank you