Mobile applications collect a wealth of data about our customers. How are we protecting this data from infiltration? Let's look at some common vulnerabilities and how to identify them.

1. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks
contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a specific company or
entity is not an endorsement by AT&T.
Doug Sillars
Being a Socially Responsible Social
Developer: How Secure is Your
App?
Technical Architect
AT&T
@Dougsillars

2. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Security: An Analogy

3. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Gain Customers

4. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Keep Them Happy

5. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Receive Payments

6. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
If We Forget to Protect Our Customers
• Data Breaches happen every day
• Few are publically announced
• Announcements seem to occur several times a
week

7. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Are You Protecting Your Customer’s Data?
http://www.geograph.org.uk/photo/2958201
https://www.flickr.com/photos/emdot/145432

8. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Securing Mobile Apps is Hard
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
Easy Moderate Hard
http://ibm.co/1EPVh8i
https://www.flickr.com/photos/mscheltgen/219606006

9. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
How Do you Test Your App?
http://ibm.co/1EPVh8i
25%
14%
13%
10%
38%
0% 10% 20% 30% 40%
Proprietary
software/…
Open
Souce…
Cloud
Services
Pen testing
Do Not
Test…

10. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
App Security is a Problem
http://ibm.co/1EPVh8i
52% of apps are NOT tested
63% of those tested HAVE issues

11. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
What Do We Need to Secure Our App?
• Knowledge
• What are common issues?
• Tooling?
• How do I learn about new
vulnerabilities?

12. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Giving up too much information
• Exposing data in logs
• Not locking down Activities/Intents
• Encryption
• Network Transmissions
• Local Data Storage
• Secure Encryption
• Heartbleed
• POODLE
• Third Party Code
What Are Common Issues?
3rd Party SDKs
too!

13. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Logs are not protected
• Ice Cream Sandwich
• Rooted devices
• Data seen in logs:
• Lat/Lon
• Logins/passwords
• Credit Card numbers
• Passport numbers
Giving Up Too Much Information
Exposing Data in Logs
https://www.flickr.com/photos/knowmybackyard/5314941146
Leak of Privileged data!

14. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Exposing Data in Logs
Example
(18468): Preference updated:com.analytics.MIN_BATCH_INTERVAL
(18468): PushService startService
(18468): *Received GCM Registration ID: <Yes, the GCM Cloud registration ID was here>*
(18468): Saving preference: com.analytics.push.APP_VERSION value: 22
(18468): Adding event: {"data":{"push_enabled":true,"carrier":"AT&T",
"session_id":"240d5059-c976-4fb3-b59d-44553649b08c",
"transport":"GCM","connection_type":"wifi","apid":”xxxxxx-xxxx-xxx-xxxx-xxxxxxxx"},
"type":"push_service_started","event_id":"171da614-50f9-468c-b60a-
1a97d39e226c","time":"1424166468"}
3rd Party
SDK!
Try it on your phone:
Adb logcat –v thread
Search for terms like your lat/lon (“48.”) or
usernames: “dougsillars”

15. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Ensure that you remove logging in Proguard when
you perform your final build:
-assumenosideeffects class android.util.Log {
<methods>;
}
• Protect your Customer’s data
Exposing Data in Logs
Solution

16. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Activities, processes, Intents
should be locked to your
application, and not publically
accessible
• Publically accessible activities
can be accessed without
authentication.
You built a fence, but your data
can still pass through it.
Giving Up Too Much Information
Locking Down Activities

17. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Drozer: Free/Open Source Penetration testing tool
• PC tool with agent on Android device
• https://www.mwrinfosecurity.com/products/drozer/
• Finds potential attack surfaces in your app
Locking Down Activities
Example

18. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Sample app Sieve: Password manager app with 3
exposed activities:
Locking Down Activities
Example

19. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Sample app Sieve: Password manager app with 3
exposed activities:
Locking Down Activities
Example

20. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• PWList seems interesting…
Locking Down Activities
Example/Solution
Lock Down Your Activities!
AndroidManifest.xml:
android:exported="false"

21. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Encryption
Communicating to a Remote Server
OR: Why did the chicken cross the road?

22. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Encryption
Communicating to a Remote Server
• HTTP: Not secure. Any eavesdropping tool can read
• Sports League sending login/password/DOB unencrypted
https://www.flickr.com/photos/compujeramey/244345344/

23. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Encryption
Communicating to a Remote Server
• HTTP Connection every 15 minutes
with Lat/Lon
3rd Party
SDK
https://en.wikipedia.org/wiki/Wolf_Chess#/media/File:Grey_wolf_P1130270.jpg

24. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Communicating to a Remote Server
Solution
• HTTPS
• Secure for 99% of activities
• Port 443: data encrypted from basic infiltration
https://www.flickr.com/photos/compujeramey/244345344/

25. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Communicating over HTTPS
https://en.wikipedia.org/wiki/Heartbleed
Even with HTTPS, you may have exposed vulnerabilities
Nogotofail: Man in the Middle Server in Google Cloud
Inspects traffic for many common HTTPS vulnerabilities
http://bit.ly/nogotofailblog
https://github.com/google/nogotofail

26. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Android local storage is
sandboxed
• Only accessible to the
application for use
• UNLESS
• Device is rooted
• Backup of user data is made
Encryption
Keeping Stored Data Safe
https://pixabay.com/en/garbage-can-dustbin-waste-garbage-231881/
https://www.flickr.com/photos/photocindy/4301171521
https://commons.wikimedia.org/wiki/File:Brown_wood_fence.JPG

27. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• App sandbox is
/data/data/<yourappname>
• Generally secure
• Applications with Root access can
read or write in your app’s
sandbox
• Application Backups store all app
data
Keeping Stored Data Safe
No file system is 100% safe
from hiding login data/keys

28. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Adb backup –all
• Android Backup Extractor
• https://github.com/nelenkov/android-backup-extractor
Keeping Stored Data Safe
Backups

29. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• SQLite Database
• Easily readable
• Encrypt sensitive
data
Keeping Stored Data Safe
Databases
No file system is 100% safe
from hiding login data/keys

30. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Key stores in sandbox are not safe
• Key manipulation in apps are not safe: Apps can be decompiled
• Ex. Tools: Dex2jar, APKtool
Keeping Stored Data Safe
App Decompilation

31. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Your code can be decompiled.
• Make it harder to read – Obfuscation
• Proguard tools in Android Studio
App Decompilation
Obfuscation
NOTE: This will not stop a hacker,
but you will slow him/her down

32. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Read the Terms and Conditions:
• Verify the Terms and Conditions:
3rd Party SDKs
“encrypted values of your email address and phone
number. We encrypt such information on your device
before collecting it, so we do not ever collect your actual
email address or phone number. We will maintain such
information in encrypted form and will not attempt to re-
identify it.”
&longitude=-122.1232254&latitude=47.6694187&
<snip>
&email=drstest1%40gmail.com&phonenumber=1425xxxxxxxx
&language=English&country=United+States&zip=98052&
Your customer’s
data MAY be at
risk!

33. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Open Source is Awesome
• 11% of top npm packages carry known vulnerabilities.
• 59% of Maven vulnerabilities remain unfixed.
• Mean time to resolution is 390 days.
3rd Party Code
https://snyk.io/

34. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Data Loss and Testing Schedules
No Matter how safe your Coop is – if the hens are escaping…
Coop
Run
Barn
Goat
field

35. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
• Usernames/Passwords
• Location
• Contacts
• Read Phone logs
• Read SMS
• Biometrics – step
counts/heart rate
• Use camera/Microphone
• Photo gallery
Commonly Collected Customer Data

36. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Security Testing
Test Early – And Often
http://ibm.co/1EPVh8i

37. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Test Early – And Often

38. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Test Early – And Often
http://ibm.co/1EPVh8i

39. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Protect Your Customers

40. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
You Will Be Rewarded

41. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
http://bit.ly/HighPerfAndroidApps

42. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other
marks contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a
specific company or entity is not an endorsement by AT&T.
Q&A
http://developer.att.com/application-resource-optimizer
http://bit.ly/HighPerfAndroidApps

43. © 2015 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks
contained herein are the property of their respective owners. Information contained herein is not an offer, commitment, representation or warranty by AT&T and is subject to change. Mention of a specific company or
entity is not an endorsement by AT&T.
Thank You