1. Building Secure Android Apps
Kaushal Bhavsar

2. Who am I?
• Kaushal Bhavsar
• Founder & CEO, Pratikar Technologies
• Visiting Faculty, Dept. of Computer Science,
(Rollwala)
– Network Security in MCA V
• Pursuing PhD from CHARUSAT
– Computer Security

3. Know this App??

4. Similar Apps
Super Guitar Super History
Falling Down
Solo Eraser
Super Ringtone
Photo Editor Chess
Maker
Falling Ball
下坠滚球 Dodge
_Falldown

5. Basics
Vulnerability
Risk Threat

6. Basics - II
Attack Defense-in-
Surface depth
Least Privilege

7. Android Architecture
Your Apps
Application Framework
Native Libraries
Linux Kernel

8. Android Security Model
Application
Isolation
Application
Signing
Filesystem
Isolation

9. Application Isolation
• When an app is installed, it gets a new UID.
• All data stored by that application is assigned
that same UID
• All resources for that app are given full
permissions for the app’s UID.
• Different UIDs can not access each other’s
data.

10. Filesystem Isolation
• All data for the app is stored in
/data/data/app_package_name
• Only UID for specific app can access it
• Apps with same UIDs can access each other’s
data
• Root UID can access all apps’ data!
• SD Card data is not protected!
• Files created using apps MUST be have
appropriate permissions

11. Data Security
Stored
Data Mobile Data

12. Protecting Stored Data
Cryptography
Hashing Encryption
Symmetric Asymmetric

13. Protecting Mobile Data
Figure from http://technet.microsoft.com

14. Input Validation
Accept Reject
Known Good Known Bad

15. Command Injection
SQLiteDatabase db = dbHelper.getWriteableDatabase();
String userQuery = "SELECT lastName FROM
useraccounts WHERE userID = "
+ request.getParameter("userID");
SQLiteStatement prepStatement =
db.compileStatement(userQuery);
String userLastname =
prepStatement.simpleQueryForString();

16. SQLiteDatabase db = dbHelper.getWriteableDatabase();
String userQuery = "SELECT lastName FROM
useraccounts WHERE userID = ?";
SQLiteStatement prepStatement =
db.compileStatement(userQuery);
prepStatement.bindString(1,
request.getParameter("userID"));
String userLastname =
prepStatement.simpleQueryForString();

17. Thank you!
kaushal@pratikar.com