Testing Android Security
summary
Covers concrete testing steps and tools: use Android Lint and Sonar for static checks (detect MD5, insecure RNG like java.util.Random, missing permission declarations), run dynamic proxies and captures with tcpdump/wireshark and interceptors, and automate interaction and vulnerability discovery with drozer (example: exploit content provider SQL injection by passing selection "1=1" to dump rows). Use SQLCipher or securePreferences for encrypted storage, avoid exported components, validate TLS properly, and handle Android 6 runtime permissions explicitly.
AI-written summary · about
chapters (4)
- 0:00Start
- 5:21Code review Android Lint Android Studio Inspect Code Security Issues Sonar Cube Android Plugin-Rules
- 18:13Intercepting network traffic HTTP proxy tool Able to intercept layer traffic and allows users to manipulate the HTTP request and response
- 38:38Protect the webserver against application layer attacks Prefer encryption over encoding or obfuscation Sanitize inputs, use prepared statements (protection against sql injection)
related talks
29mSecuring Android Applications - The not so se…
34mDemystifying Android Security
37mPractical security for Android apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
01h 02mDon’t get stung by OWASP: An intro into writing code for greater Android Security
43mSecurity in Android Applications
58mAndroid Application Security Testing