Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Android Security Tips

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Merab Tato Kutalia Merab Tato Kutalia
May 15, 2019
Technology
74
1

Android Security Tips

Android Security Tips

Avatar for Merab Tato Kutalia

Merab Tato Kutalia

May 15, 2019

More Decks by Merab Tato Kutalia

See All by Merab Tato Kutalia
What's new in Android 14?
Avatar for Merab Tato Kutalia tatocaster
0
240
Migrate to Gradle version catalog and convention plugins
Avatar for Merab Tato Kutalia tatocaster
3
2k
Make Codebases Secure with OWASP
Avatar for Merab Tato Kutalia tatocaster
0
230
Secure Coding Standards
Avatar for Merab Tato Kutalia tatocaster
0
210
ტანგო ანდროიდთან
Avatar for Merab Tato Kutalia tatocaster
0
370
Adopting Huawei Mobile Services
Avatar for Merab Tato Kutalia tatocaster
0
100
Android UI Testing & Challenges
Avatar for Merab Tato Kutalia tatocaster
1
150
Reverse & Inject - droidcon
Avatar for Merab Tato Kutalia tatocaster
3
360
mobile DevOps
Avatar for Merab Tato Kutalia tatocaster
1
180

Other Decks in Technology

See All in Technology
デザインレビューは自動化できるのか？─ Flutter × Figma で UI 品質保証を考える
Avatar for Hirokazu Tanaka techiro
2
810
慶應義塾大学 AI実践05 論文執筆の仕組み化
Avatar for Semantic Machine Intelligence Lab., Keio Univ. keio_smilab
PRO
7
3.7k
Sizing, Benchmarking and Performance Tuning Apache Flink Clusters
Avatar for Robert Metzger rmetzger
0
130
分析作業をどこまで任せるか自分で決められる
AIネイティブBI『Golden Analytics』が
良さげな話 /golden-analytics-is-ai-native-bi
Avatar for shinyaa31 shinyaa31
0
130
レガシーコードに対する loop engineering的なAI開発プロセス導入について
Avatar for kubell kubell_hr
0
280
並列度を下げたら速くなった — go build の重複コンパイルを実測で見る
Avatar for Tomoaki tomoaki25
1
740
SLOを阻む不安
Avatar for sraku sraku2159
0
230
In-Context Learning再入門。ICLの勾配降下的解釈の研究動向を追ってみる。
Avatar for Fukushima Daisuke dai08srhg
1
690
ライフワーク「猫でもわかるDirectConnect」
Avatar for Hiroo Katoh kentapapa
0
270
Deep Data Security 機能解説
Avatar for oracle4engineer oracle4engineer
PRO
3
1k
AI時代に求められる優秀なTechLeadの振る舞い
Avatar for pospome pospome
11
15k
AIエージェントの監視、思考を見るか行動を見るか / Monitoring AI Agents: Thoughts or Actions
Avatar for Yusuke Shimizu yusukeshimizu
2
170

Featured

See All Featured
Money Talks: Using Revenue to Get Sh*t Done
Avatar for Nikki Halliwell nikkihalliwell
0
550
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
7.1k
Are puppies a ranking factor?
Avatar for Jono Alderson jonoalderson
2
4.1k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
Avatar for Chris Coyier chriscoyier
508
140k
Statistics for Hackers
Avatar for Jake VanderPlas jakevdp
799
230k
The SEO Collaboration Effect
Avatar for Kristina Bergwall kristinabergwall1
1
620
Collaborative Software Design: How to facilitate domain modelling decisions
Avatar for Kenny Baas-Schwegler baasie
1
370
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
12k
Building an army of robots
Avatar for Kyle Neath kneath
307
47k
From π to Pie charts
Avatar for Rasagy Sharma rasagy
1
440
Facilitating Awesome Meetings
Avatar for Lara Hogan lara
57
7.2k
Six Lessons from altMBA
Avatar for Skipper Chong Warson skipperchong
29
4.6k

Transcript

  1. Android App Security Tips Merabi Kutalia

  2. Tato Kutalia tatocaster tatocaster.me github.com/tatocaster twitter.com/@TatoKutalia

  3. None

  4. Topics • data storage • app permissions • networking •

    webview(javascript) • dynamically loaded code

  5. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17)

  6. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable

  7. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q)

  8. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection)

  9. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection) • Shared preferences + leak

  10. app permissions • data leak caused by misused permissions

  11. networking • HTTPS (it’s 2019!)

  12. networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352)

  13. networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352) •

    GCM/FCM/SMS (Sensitive Data)

  14. webview • setJavascriptEnabled - No!

  15. webview • setJavascriptEnabled - No!

  16. webview • setJavascriptEnabled - No! • webkit

  17. dynamically loaded code • Yes you can (https://stackoverflow.com/q/ 6857807/6845290 )

  18. Proguard/R8

  19. Proguard • rules

  20. Tools • Apktool • Dex2Jar • JD-GUI

  21. Nomrebi .com

  22. Nomrebi .com

  23. None

  24. Thank you