Book Image

Android Security Cookbook

Book Image

Android Security Cookbook

Overview of this book

Android Security Cookbook discusses many common vulnerabilities and security related shortcomings in Android applications and operating systems. The book breaks down and enumerates the processes used to exploit and remediate these vulnerabilities in the form of detailed recipes and walkthroughs. The book also teaches readers to use an Android Security Assessment Framework called Drozer and how to develop plugins to customize the framework. Other topics covered include how to reverse-engineer Android applications to find common vulnerabilities, and how to find common memory corruption vulnerabilities on ARM devices. In terms of application protection this book will show various hardening techniques to protect application components, the data stored, secure networking. In summary, Android Security Cookbook provides a practical analysis into many areas of Android application and operating system security and gives the reader the required skills to analyze the security of their Android devices.

Related Content you might be interested in

Current Title:

Small book image
Android Security Cookbook
Dec, 2013 | 350 pages
No titles found
Table of Contents (16 chapters)
Android Security Cookbook
Android Security Cookbook
Credits
Credits
About the Authors
About the Authors
About the Reviewers
About the Reviewers
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
Android Development Tools
Android Development Tools
Introduction
Installing the Android Development Tools (ADT)
Installing the Java Development Kit (JDK)
Updating the API sources
Alternative installation of the ADT
Installing the Native Development Kit (NDK)
Emulating Android
Creating Android Virtual Devices (AVDs)
Using the Android Debug Bridge (ADB) to interact with the AVDs
Copying files off/onto an AVD
Installing applications onto the AVDs via ADB
2
Engaging with Application Security
Engaging with Application Security
Introduction
Inspecting application certificates and signatures
Signing Android applications
Verifying application signatures
Inspecting the AndroidManifest.xml file
Interacting with the activity manager via ADB
Extracting application resources via ADB
3
Android Security Assessment Tools
Android Security Assessment Tools
Introduction
Installing and setting up Santoku
Setting up drozer
Running a drozer session
Enumerating installed packages
Enumerating activities
Enumerating content providers
Enumerating services
Enumerating broadcast receivers
Determining application attack surfaces
Launching activities
Writing a drozer module – a device enumeration module
Writing an application certificate enumerator
4
Exploiting Applications
Exploiting Applications
Introduction
Information disclosure via logcat
Inspecting network traffic
Passive intent sniffing via the activity manager
Attacking services
Attacking broadcast receivers
Enumerating vulnerable content providers
Extracting data from vulnerable content providers
Inserting data into content providers
Enumerating SQL-injection vulnerable content providers
Exploiting debuggable applications
Man-in-the-middle attacks on applications
5
Protecting Applications
Protecting Applications
Introduction
Securing application components
Protecting components with custom permissions
Protecting content provider paths
Defending against the SQL-injection attack
Application signature verification (anti-tamper)
Tamper protection by detecting the installer, emulator, and debug flag
Removing all log messages with ProGuard
Advanced code obfuscation with DexGuard
6
Reverse Engineering Applications
Reverse Engineering Applications
Introduction
Compiling from Java to DEX
Decompiling DEX files
Interpreting the Dalvik bytecode
Decompiling DEX to Java
Decompiling the application's native libraries
Debugging the Android processes using the GDB server
7
Secure Networking
Secure Networking
Introduction
Validating self-signed SSL certificates
Using StrongTrustManager from the OnionKit library
SSL pinning
8
Native Exploitation and Analysis
Native Exploitation and Analysis
Introduction
Inspecting file permissions
Cross-compiling native executables
Exploitation of race condition vulnerabilities
Stack memory corruption exploitation
Automated native Android fuzzing
9
Encryption and Developing Device Administration Policies
Encryption and Developing Device Administration Policies
Introduction
Using cryptography libraries
Generating a symmetric encryption key
Securing SharedPreferences data
Password-based encryption
Encrypting a database with SQLCipher
Android KeyStore provider
Setting up device administration policies
Index
Index

Installing the Java Development Kit (JDK)

Android uses a customized version of the Java runtime to support its applications. This means, before we can get going with Eclipse and developing Android applications, we actually need to install the Java runtime and development tools. These are available in the Java Development Kit (JDK).

How to do it...

Installing the JDK on Windows works as follows:

  1. Grab a copy of the JDK from Oracle's Downloads page, http://www.oracle.com/technetwork/java/javase/downloads/index.html. Click on DOWNLOAD. The following screenshot shows the Downloads page:

  2. Make sure to select the appropriate version for your system type; see the previous walkthrough to find out how to check your system type. The following screenshot highlights the Windows system types supported by the Oracle Java JDK:

  3. After downloading the JDK, run the jdk-[version]-[platform version].exe file. For instance, you could have an EXE file named something like jdk-7u21-windows-i586.exe. All you need to do now is follow the prompts until the installation of all the setups is completed. The following screenshot is what the install wizard should look like once it's launched:

Once the install wizard has done its job, you should see a fresh install of your JDK and JRE under C:\Program Files\Java\jdk[version] and should now be able to launch Eclipse.

There's more…

Installing the Java Runtime and Development tools on Ubuntu Linux is somewhat simpler. Seeing that Ubuntu has a sophisticated package and repository manager, all you need to do is make use of it by firing off a few simple commands from the terminal window. You need to execute the following steps:

  1. Open a terminal, either by searching for the terminal application via your Unity, KDE, or Gnome desktop or by pressing Ctrl + Alt + T.

  2. You may need to update your package list before installation, unless you've already done that a couple of minutes ago. You can do this by executing either of the following commands:

    sudo aptitude update //If you have aptitude installed

    Or:

    sudo apt-get update

    You should see your terminal print out all the downloads it's performing from your repositories as shown in the following screenshot:

  3. Once that's done, execute the following command:

    sudo apt-get install openjdk-[version]-jdk apt-get

    You will need to enter your password if you have been added to your sudoers file correctly. Alternatively, you could borrow root privileges to do this by executing the following command, assuming that you have the root user's password:

    su root

    This is displayed in the following screenshot:

Once your JDK is installed properly, you should be able to launch Eclipse and get going with your Android development. When you launch Eclipse, you should see the following screenshot:

After successful installation, the toolbar in your Eclipse installation should look something like the one in the following screenshot:

Previous Section
End of Section 4
Next Section