The document discusses security in Android applications. It begins by introducing the speaker and their background in security and Android development. It then outlines the agenda which includes discussing the Android security model, realities that differ from the model, common vulnerabilities, and additional strategies with one concluding sentence. The appendix provides additional resources on various security topics.

1. SECURITY
IN ANDROID APPLICATION
31/05/2016
ALEXANDER SMIRNOV

2. - 3+ years Android dev
- 6+ years commercial dev
- 1 year bank app dev
- Addicted to info security since 2007
- DC7499 member
WhoAmI

3. Why?

4. - Android Security Model
- Reality
- Vulnerabilities
- One more sentence
- Appendix
Agenda

5. Security
• I •
Android Security Model

7. Application Isolation
- isolate CPU, RAM, devices, files in
private directory

8. Application Isolation
- isolate CPU, RAM, devices, files in
private directory
- every app run in own process

9. Application Isolation
- isolate CPU, RAM, devices, files in
private directory
- every app run in own process
- every app has own UserID and
GroupID

10. Application Isolation
- isolate CPU, RAM, devices, files in
private directory
- every app run in own process
- every app has own UserID and
GroupID
- every app run in own instance of
Dalvik VM

11. Application Isolation

12. Application Isolation

13. Application Isolation

14. Application Isolation

15. Application Isolation

16. - Is the parent of all App processes
Zygote
App 1
App 2
App 3
Zygote
fork()
fork()
fork()
start new
App

17. - Is the parent of all App processes
Zygote
App 1
App 2
App 3
Zygote
fork()
fork()
fork()
start new
App
- COW(Copy On Write) strategy

18. - Is the parent of all App processes
Zygote
App 1
App 2
App 3
Zygote
fork()
fork()
fork()
start new
App
- COW(Copy On Write) strategy
- /dev/socket/zygote

19. - Before M
- After M
- Custom permissions
- Protection level
Permissions

20. - Protect user data
Android Security Overview

21. - Protect user data
Android Security Overview
- Protect system resources

22. - Protect user data
Android Security Overview
- Protect system resources
- Provide application isolation

23. • II •
Android Security Model
Reality
Security

24. Root

25. Triada

26. Security
• III•
Vulnerabilities

27. - Memory Cache
Data Storage

28. - Memory Cache
Data Storage
- Internal Storage

29. - Memory Cache
Data Storage
- Internal Storage
- SharedPreference + MODE_PRIVATE + Cipher

30. - Memory Cache
Data Storage
- Internal Storage
- SharedPreference + MODE_PRIVATE + Cipher
- DB + SQLCipher

31. - Memory Cache
Data Storage
- Internal Storage
- SharedPreference + MODE_PRIVATE + Cipher
- DB + SQLCipher
- 21+ setStorageEncryption

32. - Memory Cache
Data Storage
- Internal Storage
- SharedPreference + MODE_PRIVATE + Cipher
- DB + SQLCipher
- 21+ setStorageEncryption
- KeyStore

33. - MITM Has You
Transport

34. - MITM Has You
Transport
- Check network – why?

35. - MITM Has You
Transport
- Check network – why?
- Diffie–Hellman key exchange

36. - MITM Has You
Transport
- Check network – why?
- Diffie–Hellman key exchange
- Certificate Pinning == SSL Pinning
(okhttp 2.7.4 || 3.1.2)

37. Intent
- Use explicit intents

38. Intent
- Use explicit intents
- Validate Input

39. Intent
- Use explicit intents
- Validate Input
- Manifest:
intent-filter = exported="true"

40. 2FA: SMS
- Secure PUSH

41. 2FA: SMS
- Secure PUSH
- Mobile application

42. 2FA: SMS
- Secure PUSH
- Mobile application
- SIMApplets

43. 2FA: SMS
- Secure PUSH
- Mobile application
- SIMApplets
- DCV (Dynamic Code Verification)

44. Insecure Device
- Secure persistent datastore

45. Insecure Device
- Secure persistent datastore
- No immutable (Strings -> char[])

46. Insecure Device
- Secure persistent datastore
- No immutable (Strings -> char[])
- Notify if root

47. Insecure Device
- Secure persistent datastore
- No immutable (Strings -> char[])
- Notify if root
- Custom keyboard

48. Insecure Device
- Secure persistent datastore
- No immutable (Strings -> char[])
- Notify if root
- Custom keyboard
- No EditText

49. Reverse Protection
- Check for debug mode

50. Reverse Protection
- Check for debug mode
- Emulator check

51. Reverse Protection
- Check for debug mode
- Emulator check
- Verify sign

52. Reverse Protection
- Check for debug mode
- Emulator check
- Verify sign
- Obfuscation

53. - JNI
Reverse Protection
- Check for debug mode
- Emulator check
- Verify sign
- Obfuscation

54. Security
• IV •
One more sentence

55. One more sentence
- Convenience vs Security

56. One more sentence
- Convenience vs Security
- Socialization & Tools

57. One more sentence
- Convenience vs Security
- Socialization & Tools
- Layered Security

58. One more sentence
- Convenience vs Security
- Socialization & Tools
- Layered Security
- Better than others

59. - OWASP TOP 10 Mobile Risks
One more sentence
- Convenience vs Security
- Socialization & Tools
- Layered Security
- Better than others

60. Security
• V •
Appendix

61. - Cyber Risk Report: bit.ly/1MuoIDS
- OWASP Top 10 Mobile Risks: bit.ly/1FAIJiv
- DefCon Groups List: bit.ly/1JQlNgC
- Triada Malware: bit.ly/1qvyFqY
- Obfuscation tools list: bit.ly/1XiHf6Z
- Security Official Docs: bit.ly/1qvw1BK
- Diffie–Hellman Video: bit.ly/23jV7Se
- Tools for SA and Hacking: bit.ly/1qvxpUM
Additional Information

62. - Android Security Model
- Reality
- Vulnerabilities
- One more sentence
Result

63. Any Questions,
Please?
smredkey@gmail.com
@_smred