android secure coding

© Blueinfy Solutions

Secure Coding For Android Applications


Local Storage - Example

• Remember me option – NOT SECURE WAY


Token stored

• On local file – NOT SECURE WAY


Shared Preferences• SHARED PREFERENCE – NOT SECURE WAY


Writing to file

• When opening file for writing, make sure to open it in private mode as shown below –

String FILENAME = “temp";String string = “token”;

FileOutputStream fos = openFileOutput(FILENAME, Context.MODE_PRIVATE);

fos.write(string.getBytes());fos.close();


Local Storage – Secure Method

• Encrypt the data using strong encryption, possibly AES

• Do not decrypt the data at client side• Send Encrypted Data to the server• Server decrypts the data before validating it


Securing Secrets

• AES encryption to store secret information and making secure storage.

• APIs and Libs for it.• Random cookies and keys.• Not to open and shared storage.• Cache and File writing is not enough.• Design level strategy for it.


Secure Method – Sample Code


Sending Encrypted in JSON


Secure


Cache with WebView

• By default, webView control caches all request and response

• Some of the filenames are – – webviewCache.db– webview.db-shm– webview.db-wal– webviewCookiesChromium.db– webviewCookiesChromiumPrivate.db– imagecache.db


Sample code to clear the cache


SSL Implementation

• Application sends request to server over SSL (Secure Way)

• Most application fails to handle SSL certificate validation error on the client side

• Only certificate from the OWNER server and sub-domain should be allowed


Verify SSL Server – Sample Code


Copy/Paste in the text fields

• Services are shared between all the applications

• Attacker can write malicious program to monitor clipboard to get access to sensitive data if copy/paste is not disabled

• Copy/Paste must be disabled on the sensitive fields


Screenshot in temporary files

• Pressing HOME button takes screenshot of the last screen and saves it in local storage

• To disable this, manifest file needs to be updated under Activity Tag


Protecting IP

• Unlike iOS, there is no encryption supported by android platform

• Possible to Decompile binary and get access to source code

• “ProGuard” can be leveraged to protect against Decompile


Code Analysis with AppCodeScan

• Semi automated tool• Ability to expand with custom rules• Simple tracing utility to verify and track

vulnerabilities• Simple HTML reporting which can be

converted to PDF


Sample Rules - Android


Conclusion

android secure coding

Software