Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Android Security Tips
Search
Merab Tato Kutalia
May 15, 2019
Technology
1
31
Android Security Tips
Android Security Tips
Merab Tato Kutalia
May 15, 2019
Tweet
Share
More Decks by Merab Tato Kutalia
See All by Merab Tato Kutalia
What's new in Android 14?
tatocaster
0
130
Migrate to Gradle version catalog and convention plugins
tatocaster
3
1.7k
Make Codebases Secure with OWASP
tatocaster
0
170
Secure Coding Standards
tatocaster
0
120
ტანგო ანდროიდთან
tatocaster
0
170
Adopting Huawei Mobile Services
tatocaster
0
45
Android UI Testing & Challenges
tatocaster
1
66
Reverse & Inject - droidcon
tatocaster
3
230
mobile DevOps
tatocaster
1
81
Other Decks in Technology
See All in Technology
四国のあのイベントの〇〇システムを45日間で構築した話 / cloudohenro2024_tachibana
biatunky
0
300
App Router を実プロダクトで採用して見えてきた勘所をちょっとだけ紹介
marokanatani
0
760
LLVM/ASMを使った有限体の高速実装
herumi
0
110
Road to Single Activity
yurihondo
1
140
ロボットアームを遠隔制御の話 & LLMをつかったIoTの話もしたい
soracom
PRO
1
260
効果的なオンコール対応と障害対応
ryuichi1208
5
2.5k
忙しい人のためのLangGraph概要まとめ
__ymgc__
1
140
タイミーのBraze活用 ~PUSH通知を活用したレコメンド~
ozeshun
2
150
Oracle Base Database Service:サービス概要のご紹介
oracle4engineer
PRO
0
13k
「家族アルバム みてね」における運用管理・ オブザーバビリティの全貌 / Overview of Operation Management and Observability in FamilyAlbum
isaoshimizu
4
140
Evolving DevOps Teams and Flexible Organizational Culture
kakehashi
1
250
Tricentisにおけるテスト自動化へのAI活用ご紹介/20240910Shunsuke Katakura
shift_evolve
0
170
Featured
See All Featured
Optimising Largest Contentful Paint
csswizardry
29
2.8k
WebSockets: Embracing the real-time Web
robhawkes
59
7.3k
A designer walks into a library…
pauljervisheath
201
24k
Writing Fast Ruby
sferik
623
60k
How to Ace a Technical Interview
jacobian
275
23k
Teambox: Starting and Learning
jrom
131
8.7k
Thoughts on Productivity
jonyablonski
66
4.2k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
43
2k
The World Runs on Bad Software
bkeepers
PRO
64
11k
Infographics Made Easy
chrislema
239
18k
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
354
29k
Fashionably flexible responsive web design (full day workshop)
malarkey
401
65k
Transcript
Android App Security Tips Merabi Kutalia
Tato Kutalia tatocaster tatocaster.me github.com/tatocaster twitter.com/@TatoKutalia
None
Topics • data storage • app permissions • networking •
webview(javascript) • dynamically loaded code
data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17)
data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •
External Storage is globally readable
data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •
External Storage is globally readable • Scoped Storage(Android Q)
data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •
External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection)
data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •
External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection) • Shared preferences + leak
app permissions • data leak caused by misused permissions
networking • HTTPS (it’s 2019!)
networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352)
networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352) •
GCM/FCM/SMS (Sensitive Data)
webview • setJavascriptEnabled - No!
webview • setJavascriptEnabled - No!
webview • setJavascriptEnabled - No! • webkit
dynamically loaded code • Yes you can (https://stackoverflow.com/q/ 6857807/6845290 )
Proguard/R8
Proguard • rules
Tools • Apktool • Dex2Jar • JD-GUI
Nomrebi .com
Nomrebi .com
None
Thank you