Book Image

Android Security Cookbook

Book Image

Android Security Cookbook

Overview of this book

Android Security Cookbook discusses many common vulnerabilities and security related shortcomings in Android applications and operating systems. The book breaks down and enumerates the processes used to exploit and remediate these vulnerabilities in the form of detailed recipes and walkthroughs. The book also teaches readers to use an Android Security Assessment Framework called Drozer and how to develop plugins to customize the framework. Other topics covered include how to reverse-engineer Android applications to find common vulnerabilities, and how to find common memory corruption vulnerabilities on ARM devices. In terms of application protection this book will show various hardening techniques to protect application components, the data stored, secure networking. In summary, Android Security Cookbook provides a practical analysis into many areas of Android application and operating system security and gives the reader the required skills to analyze the security of their Android devices.

Related Content you might be interested in

Current Title:

Small book image
Android Security Cookbook
Dec, 2013 | 350 pages
No titles found
Table of Contents (16 chapters)
Android Security Cookbook
Android Security Cookbook
Credits
Credits
About the Authors
About the Authors
About the Reviewers
About the Reviewers
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
Android Development Tools
Android Development Tools
Introduction
Installing the Android Development Tools (ADT)
Installing the Java Development Kit (JDK)
Updating the API sources
Alternative installation of the ADT
Installing the Native Development Kit (NDK)
Emulating Android
Creating Android Virtual Devices (AVDs)
Using the Android Debug Bridge (ADB) to interact with the AVDs
Copying files off/onto an AVD
Installing applications onto the AVDs via ADB
2
Engaging with Application Security
Engaging with Application Security
Introduction
Inspecting application certificates and signatures
Signing Android applications
Verifying application signatures
Inspecting the AndroidManifest.xml file
Interacting with the activity manager via ADB
Extracting application resources via ADB
3
Android Security Assessment Tools
Android Security Assessment Tools
Introduction
Installing and setting up Santoku
Setting up drozer
Running a drozer session
Enumerating installed packages
Enumerating activities
Enumerating content providers
Enumerating services
Enumerating broadcast receivers
Determining application attack surfaces
Launching activities
Writing a drozer module – a device enumeration module
Writing an application certificate enumerator
4
Exploiting Applications
Exploiting Applications
Introduction
Information disclosure via logcat
Inspecting network traffic
Passive intent sniffing via the activity manager
Attacking services
Attacking broadcast receivers
Enumerating vulnerable content providers
Extracting data from vulnerable content providers
Inserting data into content providers
Enumerating SQL-injection vulnerable content providers
Exploiting debuggable applications
Man-in-the-middle attacks on applications
5
Protecting Applications
Protecting Applications
Introduction
Securing application components
Protecting components with custom permissions
Protecting content provider paths
Defending against the SQL-injection attack
Application signature verification (anti-tamper)
Tamper protection by detecting the installer, emulator, and debug flag
Removing all log messages with ProGuard
Advanced code obfuscation with DexGuard
6
Reverse Engineering Applications
Reverse Engineering Applications
Introduction
Compiling from Java to DEX
Decompiling DEX files
Interpreting the Dalvik bytecode
Decompiling DEX to Java
Decompiling the application's native libraries
Debugging the Android processes using the GDB server
7
Secure Networking
Secure Networking
Introduction
Validating self-signed SSL certificates
Using StrongTrustManager from the OnionKit library
SSL pinning
8
Native Exploitation and Analysis
Native Exploitation and Analysis
Introduction
Inspecting file permissions
Cross-compiling native executables
Exploitation of race condition vulnerabilities
Stack memory corruption exploitation
Automated native Android fuzzing
9
Encryption and Developing Device Administration Policies
Encryption and Developing Device Administration Policies
Introduction
Using cryptography libraries
Generating a symmetric encryption key
Securing SharedPreferences data
Password-based encryption
Encrypting a database with SQLCipher
Android KeyStore provider
Setting up device administration policies
Index
Index

About the Authors

Keith Makan is a former computer science and physics student, and a passionate hobbyist and security researcher. He spends most of his free time reading source code, performing reverse engineering and fuzz testing, and developing exploits for web application technology.

Keith works professionally as an IT security assessment specialist. His personal research has won him spots on the Google Application Security Hall of Fame numerous times. He has developed exploits against Google Chrome's WebKit XSSAuditor, Firefox's NoScript Add-on, and has often reported security flaws and developed exploits for WordPress plugins.

I would like to thank my mom, dad, and other family members for supporting my crazy ideas and always being a great motivation to me.

Scott Alexander-Bown is an accomplished developer with experience in financial services, software development, and mobile app agencies. He lives and breathes Android, and has a passion for mobile app security.

In his current role as senior developer, Scott specializes in mobile app development, reverse engineering, and app hardening. He also enjoys speaking about app security and has presented at various conferences for mobile app developers internationally.

Most importantly, I'd like to thank my wife Ruth. Your love and encouragement make everything I do possible. High five to my son Jake who keeps me going with his laughter and cute smiles.

Additionally, I would like to thank the following people:

Keith, Barbara and Kirk Bown, and Mhairi and Robert Alexander for your love and support.

Andrew Hoog and the viaForensics team for their support, insight, and expertise in mobile security.

Mark Murphy, Nikolay Elenkov, Daniel Abraham, Eric Lafortune, Roberto Tyley, Yanick Fratantonio, Moxie Marlinspike, the Guardian Project, and the Android Security team whose blog articles, papers, presentations, and/or code samples have been interesting and extremely useful when learning about Android security.

Keith Makan for his enthusiasm, guidance, and for welcoming me aboard the Android Security Cookbook ship.

The technical reviewers for their attention to detail and valuable feedback.

Finally, thanks to you, the reader—I hope you find this book useful and it allows you to create more secure apps.

Previous Section
Next Chapter