SECURE YOUR APP FIGHT THE LEAKS

SECURE YOUR APP
FIGHT THE LEAKS!
DROIDCON PARIS 2013

EYAL LEZMY
ANDROID PRESALES ENGINEER, SAMSUNG B2B
TREASURER AT PARIS ANDROID USER GROUP
ANDROID GOOGLE DEVELOPER EXPERT

Slides

http://bit.ly/droidcon-sec
http://eyal.fr

Company

THE USER

TRUSTS YOU

DON'T LET HIM DOWN

APPS HAVE TO RESPECT THE DATA

Different ways to unintentionally grant other apps access to the
data inside your application :
Exporting an unprotected component
Storing personal data in a world readable file
Logging personal data in logcat logs

Copyright © 1995-2012 SAMSUNG All rights reserved

CHECK YOUR ANDROIDMANIFEST.XML

It declares accessible app components
Activity, Service, Receive,...

Adding <intent-ﬁlter>
=> your element is exported by default
ContentProvider is always exported by default,
until android:targetSdkVersion="17"


Don't export app components unless you want to share their
content with other applications
<application android:label="@string/app_name">
…
<service android:name=".ServiceExample“
android:exported="false">
<intent-filter>
…
</intent-filter>
</service>
…
</application>


Don't export app components unless you want to share their
content with other applications

to
<application android:label="@string/app_name">
ity
itim
…
leg a?
ur at
yo e d
android:exported="false">
t is pos
<intent-filter>
ha ex
… W
</intent-filter>
</service>
…
</application>


PERMISIONS

There are different permission protection levels:
normal

Lower risk permission

dangerous

Higher risk, access to user private data,
potential negative impact

signature

Needs the same certificate signature


PERMISIONS

Lets look at the code:
<permission android:name="com.example.EXAMPLE_PERM“
android:label="@string/example_perm_l“
android:description="@string/example_perm_d“
android:icon="@drawable/example_perm_i“
android:protectionLevel="signature" />
...
android:permission="com.example.EXAMPLE_PERM">
<intent-filter>...</intent-filter>
</service>

PERMISIONS

Don't be the weakest link
Always check the permission of a caller if you use your permission

private boolean checkPermission(Context context)
{
String permission = "com.example.EXAMPLE_PERM";
int res = context.checkCallingPermission(permission);
return (res == PackageManager.PERMISSION_GRANTED);
}


DISABLE USELESS ACTIVITIES

Fit your components lifecycle to your application's lifecycle
If before configuration (login, account creation, ...) a service or
activity is not useful, disable it

If your application handles common implicit Intent's actions like
ACTION_VIEW or ACTION_SEND consider disabling it by default


DISABLE USELESS ACTIVITIES

Disabled:
<activity
android:name="com.example.Activity"
android:label="@string/app_name"
android:enabled="false">
</activity>

Enabled:
PackageManager.setComponentEnabledSetting(componentName,
newState, flags);


STORING DATA WISELY

Protect personal data using MODE_PRIVATE for data ﬁles,
shared preferences, and databases:
openFileOutput()
openSharedPreferences()
openOrCreateDatabase()

External storage (sdcard) is shared storage


PLEASE... SHUT THE FUCK UP!

Don't expose data through logcat on production
Detect the build mode with BuildConfig.DEBUG
public static final boolean SHOW_LOG = BuildConfig.DEBUG;

public static void d(final String tag, final String msg) {
if (SHOW_LOG)
Log.d(tag, msg);
}

Be careful about this subject and test it during QA

PROTECTING APP FROM USERS

No more android:debuggable on the manifest

Don't leave this enabled in release code!

ADT 8.0+ do it for you automatically


PROTECTING APP FROM USERS

$ adb shell
shell@android:/ $ run-as com.android.example sh
shell@android:/data/data/com.android.example $ id
uid=10060(app_60) gid=10060(app_60)
shell@android:/data/data/com.android.example $ ls
files/secret_data.txt
shell@android:/data/data/com.android.example $
cat files/secret_data.txt

IT'S NOT JUST ABOUT YOUR APP
INSECURE NETWORK
LOST OR STOLEN DEVICES

USE SAFE NETWORKING

HTTPS and SSL can protect against Man in the Middle attacks and
prevent casual snooping

Server certiﬁcate validity must be correctly checked
"15% of apps have weak or bad SSL implementation on the Play Store"

Free certified SSL: https://www.startssl.com/

DATA ENCRYPTION DOESN'T SOLVE ALL PROBLEMS

...but it may help discouraging curious.
Use a peer-reviewed library like KeyCzar

Take care of the key :
Create it at first start, with true random
Or grab a user key from your server
Or ask the user for a passphrase you won't store


DEVICE ADMINISTRATION

On a corporate environment, device administration can be
considered
Password management
Device encryption
Disable camera
Lock the device
Remote wipe


BEHIND THE STAGE

The APK's content is always world readable, take care about
what you put inside
Sensitive files should be kept out of the APK
Java is open source, your code too
Using Proguard takes a single line of code
Or...
Dex encryption
AAPT modified
Logic on server

IT'S NOT JUST ABOUT SECURITY
THINK ABOUT POLITICS...

THE SECURITY PARADOX


NEVER FORGET THE USER, NEVAAAAA!

"The more secure you make something,
the less secure it becomes"

Level the security following the user acceptance or...
Users will find workarounds
Users won't use your service


REFERENCES

Google I/O 2012 Sessions
Android Developpers Live Youtube channel
Android Developement
Android Developement: Using Cryptography
The Commons Blog
InformationWeek: Security Paradox
ThreatPost: SLL implementation on Android apps
StartSSL Free certificates


SAMSUNG SMART APP CHALLENGE 2013

SAMSUNG SMART APP CHALLENGE 2013
A Global app challenge
Apps for the Galaxy S4
Use of Samsung Chord SDK
Apply June 20 - August 31

$800,000 for 10 winners

www.smartappchallenge.com

SAMSUNG DEVELOPERS

http://developer.samsung.com
SDKs and Documentation
Samsung Chord SDK
Bluetooth Low Energy SDK

S Pen & Multi Window SDK
AllShare Framework

Remote Test Lab
Test your applications on real devices through the internet

Free
24H 365 Days

Real Device,
NOT emulator

Multiple
Devices

THANK YOU!

Slides

http://bit.ly/droidcon-sec
http://eyal.fr

SECURE YOUR APP FIGHT THE LEAKS

Recomendados

Recomendados

Más contenido relacionado

Similar a SECURE YOUR APP FIGHT THE LEAKS

Similar a SECURE YOUR APP FIGHT THE LEAKS (20)

Último

Último (20)

SECURE YOUR APP FIGHT THE LEAKS