Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Android Security Tips

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Merab Tato Kutalia Merab Tato Kutalia
May 15, 2019
Technology
65
1

Android Security Tips

Android Security Tips

Avatar for Merab Tato Kutalia

Merab Tato Kutalia

May 15, 2019

More Decks by Merab Tato Kutalia

See All by Merab Tato Kutalia
What's new in Android 14?
Avatar for Merab Tato Kutalia tatocaster
0
210
Migrate to Gradle version catalog and convention plugins
Avatar for Merab Tato Kutalia tatocaster
3
1.9k
Make Codebases Secure with OWASP
Avatar for Merab Tato Kutalia tatocaster
0
220
Secure Coding Standards
Avatar for Merab Tato Kutalia tatocaster
0
190
ტანგო ანდროიდთან
Avatar for Merab Tato Kutalia tatocaster
0
340
Adopting Huawei Mobile Services
Avatar for Merab Tato Kutalia tatocaster
0
86
Android UI Testing & Challenges
Avatar for Merab Tato Kutalia tatocaster
1
130
Reverse & Inject - droidcon
Avatar for Merab Tato Kutalia tatocaster
3
340
mobile DevOps
Avatar for Merab Tato Kutalia tatocaster
1
170

Other Decks in Technology

See All in Technology
複数プロダクトで進めるAI機能実装 ── 実践から得たリアルな学びとロードマップ実現への挑戦 / AICon2026_yanari
Avatar for Rakus_Dev rakus_dev
1
270
“それは自分の仕事じゃない"を 越えて行け
Avatar for yuukiyo yuukiyo
1
520
Playwright × AI Agent でE2Eテストはどう変わるか AI駆動テストの可能性と実用検証の結果
Avatar for Taiga Oyu taiga7543
2
810
JAWS_ICEBERG_BASECAMP
Avatar for IQBocchi iqbocchi
2
110
GoでCコンパイラを作った話
Avatar for repunit11 repunit
0
150
なぜ、あなたのエージェントは言うことを聞かないのか
Avatar for segavvy segavvy
1
370
インシデント事例と
パッケージの全量解析に学ぶ
ソフトウェアサプライチェーンの守り方 / supply-chain-attack-defense
Avatar for GMO Flatt Security flatt_security
0
890
Amplify Gen2でbackend.tsにCDKを定義する/しない事によるCDKの挙動の違いとユースケース
Avatar for Makky12 smt7174
1
490
OpenTelemetryにおけるGoのゼロコード・コンパイル時計装について #fukuokago
Avatar for quiver quiver
0
210
CDKで書くECSのベストプラクティス、 改めて考え直す2026 #cdkconf2026
Avatar for maki makies
3
940
AIとハーネスで育てるトランスコンパイラ / 20260722 Yasushi Katayama
Avatar for SHIFT EVOLVE shift_evolve
PRO
3
780
第67回コンピュータビジョン勉強会CVPR2026読会前編
Avatar for TSUKAMOTO Kenji tsukamotokenji
0
160

Featured

See All Featured
Believing is Seeing
Avatar for Spiro Bolos oripsolob
1
170
Ethics towards AI in product and experience design
Avatar for Skipper Chong Warson skipperchong
2
330
Navigating Algorithm Shifts & AI Overviews - #SMXNext
Avatar for Aleyda Solis aleyda
1
1.5k
The Mindset for Success: Future Career Progression
Avatar for Greg Gifford greggifford
PRO
0
430
First, design no harm
Avatar for Per Axbom axbom
PRO
2
1.2k
Game over? The fight for quality and originality in the time of robots
Avatar for Wayne Barker wayneb77
1
230
Typedesign – Prime Four
Avatar for Hannes Fritz hannesfritz
42
3.1k
The browser strikes back
Avatar for Jono Alderson jonoalderson
0
1.4k
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1370
210k
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
97
6.7k
Organizational Design Perspectives: An Ontology of Organizational Design Elements
Avatar for Dr. Kim W Petersen kimpetersen
PRO
1
770
Visualization
Avatar for Eitan Lees eitanlees
152
17k

Transcript

  1. Android App Security Tips Merabi Kutalia

  2. Tato Kutalia tatocaster tatocaster.me github.com/tatocaster twitter.com/@TatoKutalia

  3. None

  4. Topics • data storage • app permissions • networking •

    webview(javascript) • dynamically loaded code

  5. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17)

  6. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable

  7. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q)

  8. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection)

  9. data storage • Internal Storage(MODE_WORLD_WRITABLE (deprecated in API 17) •

    External Storage is globally readable • Scoped Storage(Android Q) • Content Providers(Sql Injection) • Shared preferences + leak

  10. app permissions • data leak caused by misused permissions

  11. networking • HTTPS (it’s 2019!)

  12. networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352)

  13. networking • HTTPS (it’s 2019!) • localhost! (https://twitter.com/ fs0c131y/status/1085460755313508352) •

    GCM/FCM/SMS (Sensitive Data)

  14. webview • setJavascriptEnabled - No!

  15. webview • setJavascriptEnabled - No!

  16. webview • setJavascriptEnabled - No! • webkit

  17. dynamically loaded code • Yes you can (https://stackoverflow.com/q/ 6857807/6845290 )

  18. Proguard/R8

  19. Proguard • rules

  20. Tools • Apktool • Dex2Jar • JD-GUI

  21. Nomrebi .com

  22. Nomrebi .com

  23. None

  24. Thank you