Learning Android applications security
Recently, I decided to learn about Android application security. Since good learning always requires certain amount of practice, I decided to apply obtained knowledge by analyzing one of the existing Android applications with known vulnerabilities. I chose InsecureBankv2 as an application under test. My goal was not only to find out vulnerable pieces of an application, but also figure out how to change the code to remove vulnerability. The result of this exercise was a series of blog posts which I am sharing now here:
- Identifying and Fixing Vulnerable Android Activities
- Identifying and Fixing Vulnerable Android Broadcast Receivers
- Identifying and Fixing Vulnerable Android Content Providers
- Protecting Data in Transit
- Protecting Data at Rest
One should bear in mind that the content described in these posts is mostly between a basic and an intermediate level. There are a multitude of more advanced topics which I would like to learn at some point, including but not limiting to WebView vulnerabilities, Java/JavaScript bridges, etc. It should, nevertheless, give a reader a head start and allow him or her to continue his Android exploration further. Another note worth mentioning is that not all the vulnerabilities present in the application were covered here. Check Walkthrough Guides for other issues.
Tools
When evaluating applications, I was using several tools:
- Drozer makes it easy to analyze attack surface by showing exported Android components: activities, services, content providers, and broadcast receivers.
- Fiddler HTTP proxy was my choice to monitor traffic generated by an application.
- Bytecode Viewer is very handy to reverse engineer Android apks and view source code using various decompilers.
Books on Android Security
When learning about Android security, I used the following books:
