Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Android Security Tips

Avatar for Merab Tato Kutalia Merab Tato Kutalia
May 15, 2019
Technology
1
38

Android Security Tips

Android Security Tips
Avatar for Merab Tato Kutalia

Merab Tato Kutalia

May 15, 2019
Tweet

More Decks by Merab Tato Kutalia

See All by Merab Tato Kutalia
What's new in Android 14?
Avatar for Merab Tato Kutalia tatocaster
0
150
Migrate to Gradle version catalog and convention plugins
Avatar for Merab Tato Kutalia tatocaster
3
1.8k
Make Codebases Secure with OWASP
Avatar for Merab Tato Kutalia tatocaster
0
180
Secure Coding Standards
Avatar for Merab Tato Kutalia tatocaster
0
130
ტანგო ანდროიდთან
Avatar for Merab Tato Kutalia tatocaster
0
220
Adopting Huawei Mobile Services
Avatar for Merab Tato Kutalia tatocaster
0
55
Android UI Testing & Challenges
Avatar for Merab Tato Kutalia tatocaster
1
87
Reverse & Inject - droidcon
Avatar for Merab Tato Kutalia tatocaster
3
280
mobile DevOps
Avatar for Merab Tato Kutalia tatocaster
1
110

Other Decks in Technology

See All in Technology
白金鉱業Meetup_Vol.18_AIエージェント時代のUI/UX設計
Avatar for BrainPad brainpadpr
1
270
AI駆動で進化する開発プロセス ～クラスメソッドでの実践と成功事例～ / aidd-in-classmethod
Avatar for tomoki10 tomoki10
1
800
C++26アップデート 2025-03
Avatar for Akira Takahashi faithandbrave
0
1.2k
バクラクの認証基盤の成長と現在地 / bakuraku-authn-platform
Avatar for convto convto
4
880
ガバクラのAWS長期継続割引 ～次の4/1に慌てないために～
Avatar for ひよこインフラエンジニア hamijay_cloud
1
580
Microsoft の SSE の現在地
Avatar for skmkzyk skmkzyk
0
280
更新系と状態
Avatar for uhyo uhyo
8
2.2k
日経電子版 for Android の技術的課題と取り組み(令和最新版)/android-20250423
Avatar for 日本経済新聞社 エンジニア採用事務局 nikkei_engineer_recruiting
1
610
Goの組織でバックエンドTypeScriptを採用してどうだったか / How was adopting backend TypeScript in a Golang company
Avatar for 株式会社カミナシ kaminashi
12
9.1k
2025-04-14 Data & Analytics 井戸端会議 Multi tenant log platform with Iceberg
Avatar for kamijin_fanta kamijin_fanta
0
180
製造業向けIoTソリューション提案資料.pdf
Avatar for h.uriu haruki_uiru
0
140
SREからゼロイチプロダクト開発へ ー越境する打席の立ち方と期待への応え方ー / Product Engineering Night #8
Avatar for itkq itkq
2
1.1k

Featured

See All Featured
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
126
17k
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
45
7.2k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
Avatar for Rebecca Miller-Webster rmw
34
2.9k
How GitHub (no longer) Works
Avatar for Zach Holman holman
314
140k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
94
13k
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.1k
Code Review Best Practice
Avatar for Trisha Gee trishagee
67
18k
KATA
Avatar for Megan Lloyd mclloyd
29
14k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
344
40k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
179
53k
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
54
13k
Stop Working from a Prison Cell
Avatar for Chris Michel hatefulcrawdad
268
20k

Transcript

  1. Android App Security Tips Merabi Kutalia

  2. Tato Kutalia tatocaster tatocaster.me github.com/tatocaster twitter.com/@TatoKutalia

  3. None

  4. Topics • data storage • app permissions • networking •

    webview(javascript) • dynamically loaded code

  5. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17)

  6. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable

  7. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q)

  8. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection)

  9. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection) • Shared preferences + leak

  10. app permissions • data leak caused by misused permissions

  11. networking • HTTPS (it’s 2019!)

  12. networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352)

  13. networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352) •

    GCM/FCM/SMS (Sensitive Data)

  14. webview • setJavascriptEnabled - No!

  15. webview • setJavascriptEnabled - No!

  16. webview • setJavascriptEnabled - No! • webkit

  17. dynamically loaded code • Yes you can (https://stackoverflow.com/q/ 6857807/6845290 )

  18. Proguard/R8

  19. Proguard • rules

  20. Tools • Apktool • Dex2Jar • JD-GUI

  21. Nomrebi .com

  22. Nomrebi .com

  23. None

  24. Thank you