The Android security jungle: pitfalls, threats and survival tips. Scott

Transcription

1 The Android security jungle: pitfalls, threats and survival tips Scott

2 The Jungle Ecosystem Google s protection Threats Risks

3 Survival Network Data protection (encryption) App/device integrity App binary security Testing

4 Scott Alexander-Bown Lead Android Dev (remote) at Intohand Co-Author - Android Security Cookbook Co-Founder of SWmobile

5 1.4 Billion users

6 OpenSignals.com

7

8 Security Services Google Play Approval process (human approval since 2015) Developer security notifications Android Bouncer Android device manager (Device security) Safety net (intrusion detection) Android at Work

9 Slide Adrian Ludwig s - Android Security State of the Union

10 Newer version of Android are more secure 1.5 stack buffer, integer overflow protection 2.3+ null pointer dereference mitigation, NX 4.0+ ASLR 4.1+ ASLR strengthened 4.3 Security-Enhanced Linux 5.0 Security-Enhanced Linux - enforcing Updatabled Webview (via playstore)

11 Threats

12 Threats: App Hijacking Taking an app and adding malware Concerns Reversing Android apps is easy No need for certificate authority Sideload

13 I ain t got time to (heart)bleed

14

15

16 OWASP Mobile Security Project ios and Android Top 10 risks attack vectors threat agents impacts

17 OWASP top 10 risks M1: Weak Server Side M6: Broken Cryptography Controls M7: Client Side Injection M2: Insecure Data Storage M8: Security Decisions Via M3: Insufficient Transport Untrusted Inputs Layer Protection M9: Improper Session Handling M4: Unintended Data Leakage M10: Lack of Binary Protections M5: Poor Authorization and Authentication

18 Survival kit

19 Survival tips 1. Harden the network communications 2. Protect stored data (encryption) 3. Validate the device and app integrity 4. Increase binary security

20 Network communications Use SSL / TLS! Use the platform SSL/TLS validation (i.e don t disable it!) Use only strong cipher suites (128bit+) and TLS versions (TLS v1.2) OkHttp

21 Looks like you re not using SSL pinning? Devices ship with 100+ Certificate Authorities (CA) and users can install their own Pinning limits the trusted root CA s Two types Certificate pinning Public Key pinning

22 Public key pinning

23 Patch against SSL exploits Google Play Services provides a dynamic security provider ProviderInstaller.installIfNeeded(getContext());

24 Tips

25 Code in a slide : ( Password based encryption

26 Encryption libraries Conceal SQL cipher Secure-Preferences (or Hawk)

27 Hardcoded encryption key

28 Verifying App integrity Debuggable check Apk Checksum Signing certificate verification

29 Signing Certificate Verification Build-time Runtime 1. Get you certificate signature 3. Get the Signature from the PackageManager $keytool -list -v -keystore your_app.keystore 4. Hash the Signature 2. Embed in app String CERTIFICATE_SHA1 = 71920AC9486E087DCBCF5C7F6F ; 5. Compare the signature hashes strings

30 Verifying device integrity Emulator check nti-emulator Google SafteyNet test fetynethelper

31 # Root apps / Dangerous apps Suspect system properties SU/BusyBox binaries RW /system

32 Obfuscation

33 ProGuard Java code obfuscator Part of the Android SDK Free as in Beer! ReTrace - Supported by Error handling services such as Crashlytics

34 DexGuard Commercial version of ProGuard Designed for Android and protection Useful security utils - SSL Pinning, Root check, logging removal etc My favourite features String Encryption API hiding

35

36 Quick Android Review Kit (Quak) Python script Works with.apk or source code Automated tests weaknesses exploits Creates exploit.apks

37

38 Click here for more! 42+ Secure mobile development tips OWASP Mobile security risks Android security cookbook [book] Android security internals [book] Droidsec (whitepapers) droidsec.org/wiki

39

40

41 Thanks 20th Century Fox Android security team

42 Please github.com/scottyab Remember to rate this session Thank you

43

44

45 WebView Before getsettings().setjavascriptenabled(false) getsettings().setallowfileaccess(false) During WebViewClient.shouldOverrideUrlLoading() enforce local content or Https Whitelisted hosts/urls.shouldinterceptrequest() to intercept XmlHttpRequests After webview.clearcache(true)