Bulletproof Android: Practical Advice for Building Secure Apps

Table of Contents

Preface xiii

Chapter 1: Android Security Issues 1

Why Android? 1

Guidelines 7

Securing the Device 17

Conclusion 18

Chapter 2: Protecting Your Code 19

Looking into the classes.dex File 19

Obfuscation Best Practices 24

Smali 39

Hiding Business Rules in the NDK 48

Conclusion 49

Chapter 3: Authentication 51

Secure Logins 51

Understanding Best Practices for

User Authentication and Account Validation 54

Application Licensing with LVL 65

OAuth 77

User Behavior 84

Conclusion 86

Chapter 4: Network Communication 87

HTTP(S) Connection 88

Symmetric Keys 92

Asymmetric Keys 94

Ineffective SSL 99

Conclusion 107

Chapter 5: Android Databases 109

Android Database Security Issues 109

SQLite 110

SQLCipher 116

Hiding the Key 120

SQL Injection 127

Conclusion 129

Chapter 6: Web Server Attacks 131

Web Services 131

Cross Platform 135

WebView Attacks 140

Cloud 146

Conclusion 150

Chapter 7: Third-Party Library Integration 151

Transferring the Risk 152

Permissions 152

Installing Third-Party Apps 154

Trust but Verify 160

Conclusion 165

Chapter 8: Device Security 167

Wiping Your Device 168

Fragmentation 168

Device Encryption 172

SEAndroid 174

FIPS 140-2 176

Mobile Device Management 177

Conclusion 178

Chapter 9: The Future 179

More Sophisticated Attacks 179

Internet of Things 186

Audits and Compliance 188

Tools 190

Conclusion 194