5. Data Storage and Its Security | Hacking Android

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Hacking Android

By : Mohammed A. Imran, Rao Kotipalli

4.4 (5)

Hacking Android

4.4 (5)

By: Mohammed A. Imran, Rao Kotipalli

Overview of this book

With the mass explosion of Android mobile phones in the world, mobile devices have become an integral part of our everyday lives. Security of Android devices is a broad subject that should be part of our everyday lives to defend against ever-growing smartphone attacks. Everyone, starting with end users all the way up to developers and security professionals should care about android security. Hacking Android is a step-by-step guide that will get you started with Android security. You’ll begin your journey at the absolute basics, and then will slowly gear up to the concepts of Android rooting, application security assessments, malware, infecting APK files, and fuzzing. On this journey you’ll get to grips with various tools and techniques that can be used in your everyday pentests. You’ll gain the skills necessary to perform Android application vulnerability assessment and penetration testing and will create an Android pentesting lab.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Setting Up the Lab

1. Setting Up the Lab

Installing the required tools

Android Studio

Setting up an AVD

Configuring the AVD

ADB Primer

Summary

2. Android Rooting

2. Android Rooting

What is rooting?

Locked and unlocked boot loaders

Stock recovery and Custom recovery

Rooting Process and Custom ROM installation

Rooting a Samsung Note 2

Flashing the Custom ROM to the phone

Summary

3. Fundamental Building Blocks of Android Apps

3. Fundamental Building Blocks of Android Apps

Basics of Android apps

Android app components

Building DEX files from the command line

What happens when an app is run?

Understanding app sandboxing

Summary

4. Overview of Attacking Android Apps

4. Overview of Attacking Android Apps

Introduction to Android apps

Understanding the app's attack surface

Threats at the client side

Threats at the backend

Guidelines for testing and securing mobile apps

Automated tools

Identifying the attack surface

QARK (Quick Android Review Kit)

Summary

5. Data Storage and Its Security

5. Data Storage and Its Security

What is data storage?

Shared preferences

SQLite databases

Internal storage

External storage

User dictionary cache

Insecure data storage – NoSQL database

Backup techniques

Being safe

Summary

6. Server-Side Attacks

6. Server-Side Attacks

Different types of mobile apps and their threat model

Mobile applications server-side attack surface

Strategies for testing mobile backend

Summary

7. Client-Side Attacks – Static Analysis Techniques

7. Client-Side Attacks – Static Analysis Techniques

Attacking application components

Static analysis using QARK:

Summary

8. Client-Side Attacks – Dynamic Analysis Techniques

8. Client-Side Attacks – Dynamic Analysis Techniques

Automated Android app assessments using Drozer

Introduction to Cydia Substrate

Runtime monitoring and analysis using Introspy

Hooking using Xposed framework

Dynamic instrumentation using Frida

Logging based vulnerabilities

WebView attacks

Summary

9. Android Malware

9. Android Malware

What do Android malwares do?

Writing Android malwares

Registering permissions

Malware analysis

Tools for automated analysis

Summary

10. Attacks on Android Devices

10. Attacks on Android Devices

MitM attacks

Dangers with apps that provide network level access

Using existing exploits

Malware

Bypassing screen locks

Pulling data from the sdcard

Summary

Index

Index

Customer Reviews

4.4 (5)

5 star

80%

4 star

0%

3 star

0%

2 star

20%

1 star

0%

SQLite databases

SQLite databases are light weight file based databases. They usually have the extension .db or .sqlite. Android provides full support for SQLite databases. Databases we create in the application will be accessible to any class in the application. Other apps cannot access them.

The following code snippet shows a sample application storing username and password in an SQLite database user.db:

String uName=editTextUName.getText().toString();
String passwd=editTextPasswd.getText().toString();

context=LoginActivity.this;
dbhelper = DBHelper(context, "user.db",null, 1);
dbhelper.insertEntry(uName, password);

Programmatically, we are extending the SQLiteOpenHelper class to implement the insert and read method. We are inserting the values from the user into a table called USER:

import android.database.sqlite.SQLiteDatabase;
import android.database.sqlite.SQLiteDatabase.CursorFactory;
import android.database.sqlite.SQLiteOpenHelper;
 
public class DBHelper extends SQLiteOpenHelper
...

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Hacking Android

Search

Your notes and bookmarks