Book Image

Android Security Cookbook

Book Image

Android Security Cookbook

Overview of this book

Android Security Cookbook discusses many common vulnerabilities and security related shortcomings in Android applications and operating systems. The book breaks down and enumerates the processes used to exploit and remediate these vulnerabilities in the form of detailed recipes and walkthroughs. The book also teaches readers to use an Android Security Assessment Framework called Drozer and how to develop plugins to customize the framework. Other topics covered include how to reverse-engineer Android applications to find common vulnerabilities, and how to find common memory corruption vulnerabilities on ARM devices. In terms of application protection this book will show various hardening techniques to protect application components, the data stored, secure networking. In summary, Android Security Cookbook provides a practical analysis into many areas of Android application and operating system security and gives the reader the required skills to analyze the security of their Android devices.
Table of Contents (16 chapters)
Android Security Cookbook
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Exploiting debuggable applications


Applications can be marked as debuggable to make functionality testing and error tracking a lot easier by allowing you to set breakpoints during app execution. To do this, view the VM stack and suspend and resume threads while the app is running on the device.

Unfortunately, some applications on the Google Play store are still flagged as debuggable. This may not always be the end of the world, but if the app hopes to protect any authentication data, passwords addresses, or any values stored in the applications memory, having it marked as debuggable means that attackers will be able to gain access to this data very easily.

This recipe discusses how to leak variable values from a debuggable application. Attackers may also be able to trigger remote-code execution via the app and run some code within the applications context.

The example being used here is the Android Wall Street Journal app and at the time of writing, it was one of the applications on the Google...