Book Image

Android Security Cookbook

Book Image

Android Security Cookbook

Overview of this book

Android Security Cookbook discusses many common vulnerabilities and security related shortcomings in Android applications and operating systems. The book breaks down and enumerates the processes used to exploit and remediate these vulnerabilities in the form of detailed recipes and walkthroughs. The book also teaches readers to use an Android Security Assessment Framework called Drozer and how to develop plugins to customize the framework. Other topics covered include how to reverse-engineer Android applications to find common vulnerabilities, and how to find common memory corruption vulnerabilities on ARM devices. In terms of application protection this book will show various hardening techniques to protect application components, the data stored, secure networking. In summary, Android Security Cookbook provides a practical analysis into many areas of Android application and operating system security and gives the reader the required skills to analyze the security of their Android devices.
Table of Contents (16 chapters)
Android Security Cookbook
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Inserting data into content providers


Like any database-orientated application, content providers may also facilitate the ability to insert data into their SQLite databases or file stores; should any content provider not restrict this functionality using the appropriate write permissions, an attacker may be able to insert data into the SQLite database maliciously. This tutorial discusses how you can perform this kind of attack; in the next chapter, we will look at the actual code that causes these vulnerabilities and discuss some remedies.

How to do it...

Before we go inserting data into the content providers, we need to know what the schema or column set up for the database looks like; you can enumerate this information using the following command from your drozer console:

dz> run app.provider.columns [URI]

In the preceding command [URI] is the URI you wish to find out about. For instance, if you want to run it against Sieve, you would execute the following command:

dz> run app.provider...