-1

I know this question may seem a bit malicious in nature, but I'm just trying to learn best practices in Android/mobile app development, and security is definitely a big issue in software. If you still, after reading this question (!), think it is malicious in nature, just keep in mind I'm not asking how to implement any of these attacks, I'm just asking which attacks a good Android/mobile developer needs to be cognizant of.

Below is a list of the "official" OWASP Top 10 security threats for applications (link is here). I was wondering which of these (if any) apply to Android development, or if there are any other major attacks not listed here:

  • Injection
  • Cross-Site Scripting (XSS)
  • Broken Authentication and Session Management
  • Insecure Direct Object References
  • Cross-Site Request Forgery (CSRF)
  • Security Misconfiguration
  • Insecure Cryptographic Storage
  • Failure to Restrict URL Access
  • Insufficient Transport Layer Protection
  • Unvalidated Redirects and Forwards

Please note: I'm not talking about websites that are built for being displayed in mobile devices. I'm talking about actual applications that are deployed on mobile devices. In the case of Android, this means APKs.

ThinkingStiff
  • 64,767
  • 30
  • 146
  • 239
IAmYourFaja
  • 55,468
  • 181
  • 466
  • 756
  • 1
    Assuming that you consume a network service of some kind (e.g. make a remote call, access a web page…) I would tend to say “any or all of them.” (Just assume your “trusted” server is actually a proxy trying to trip up your client…) – BRPocock Jan 25 '12 at 17:59
  • I voted to close as "not constructive"; however, I really should have picked "Off Topic" to send it to programmers.se This is NOT a question with a definitive technical answer and as such belongs more in the realm of discussing programming issues.. hence programmers.se – NotMe Jan 25 '12 at 19:01
  • 1
    @ChrisLively, there is a [security.se](http://security.stackexchange.com/). – Mike Samuel Jan 25 '12 at 21:31
  • @MikeSamuel: well that would be even more appropriate! – NotMe Jan 25 '12 at 21:33
  • @Chris Lively. I'm dismayed to see any attempt to close this question. Criticizing the question seems to challenge the validity of various "common vulnerability" lists, such as the OWASP top tens. However, the OWASP top tens seem to be pretty useful, challenging the validity of your desire to close this question. – Heath Hunnicutt Jan 25 '12 at 21:55
  • @HeathHunnicutt: It's an absolutely legitimate question... just not on this site. SO is focused on "specific programming problem"'s that are "answerable". An example would be a technical issue arising in implementing XSS detection code. However, this question is generic, invites discussion and is fairly open ended. That is exactly the type of thing programmers.se and security.se are for. – NotMe Jan 25 '12 at 22:10
  • @Chris Lively - shouldn't we have ported the question to the correct site, then? – Heath Hunnicutt Jan 28 '12 at 02:11

4 Answers4

3

The OWASP Top Ten is intended for web applications and Android apps are different.

OWASP does, however, have a fast-growing mobile intitiative and they are presently working on the Mobile Top Ten. Here is a list of the candidate top ten for the current year:

  1. Insecure Data Storage
  2. Weak Server Side Controls
  3. Insufficient Transport Layer Protection
  4. Client Side Injection
  5. Poor Authorization and Authentication
  6. Improper Session Handling
  7. Security Decisions Via Untrusted Inputs
  8. Side Channel Data Leakage
  9. Broken Cryptography
  10. Sensitive Information Disclosure

There is a wonderful set of slides that explain these in great detail.

In addition to the OWASP Mobile Top Ten, I can point you to Application Security for the Android Platform, just published by O'Reilly in December 2011 that discusses current secure mobile application design on Android, and provides a discussion about the threats inherit to that platform and how to code apps in a secure manner to avoid them (disclaimer: I'm the author of this book :)).

2

It's hard to answer your question in specifics because from what you've posted you are curious about your Android Application and your Java server, but you're asking a very generic question. Much of what the OWASP has published is very high level so getting any real substantive answers is going to be hard without knowing the specifics of how your Android application and server work. Generally, people aren't going to attack a phone when they can go after the server and own all of the data that will pass through all of the phones not just a single handset.

So injection, XSS, CSRF, etc mostly apply to the server side. You could perform injection into the Android SQLite database if your program uses it (see how the specifics of your app come into play here). XSS, CSRF could apply if you app is a web based client, or using webview for any part of it (again specifics matter).

Injection on the server for Java can easily be remedied by using PreparedStatements/PreparedCall. Don't use Statement. If you're using JPA, Hibernate, iBatis most of these use PreparedStatements under the hood. Injection in Java apps is easy to thwart those attacks:

https://www.owasp.org/index.php/Preventing_SQL_Injection_in_Java

XSS and CSRF are harder, but can be prevented using a filter. Read down this page, and you'll see where there is another link to the project that describes it.

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

Sending passwords over an insecure connection. If you send a password over HTTP or non-SSL socket then you're going to be disclosing too much information (using one-way hashes doesn't help because I don't need to know the password. All I need is the hash and that's transmitted in the clear). So make sure you are using SSL for authenticating users. Then we can get into how you are storing those passwords in your database. Are you using a one-way hash? Are you using bcrypt? If not are you using SALTs? Are you iterating on the hash to increase the time it takes to break that hash?

Most break-ins involve getting access to the underlying database through vulns in the OS, database, SQL injection, etc. Grabbing the table storing the user and passwords. Then run a super fast brute force method using simple off the shelf graphics cards to brute force passwords. Most one-way hashes can be broken today using this method if you don't take care to protect your passwords appropriately.

chubbsondubs
  • 37,646
  • 24
  • 106
  • 138
1

For (Android) Apps, most of the mentioned attacks do not apply regularily.

If you care to let us know who, in your case, is Alice, Bob, or Eve someone may provide a real answer to your question, so:

  • Who needs to be protected?
  • Who would (want to) attack the security of your App?

The most realistic threat I can come up with spontaneously (for a lack of information I assume a pretty much standalone App on a device) would be a bug in your App which either

  • leaks (app-)private information to a non-secure storage, or
  • allows injection of malicious data via user input (read: SQL injection; but the general problem is not only related to SQL DBs; think, e.g., about "XML injection").

Edit:

Let's just collect some possible stakeholders in the App's security (without any particular order):

  • App user: Does he, his data, his monetary values, or his privacy need to be protected/supported by the App?

  • App user: Does he pose a threat to any asset of the application and/or the developer?

  • App developer: Does he, or his IP, or other application-related assets, need to be specifically protected by the design of the application?

  • App developer: May he or his environment pose a threat to any asset not belonging to him?

  • Third party: Is there a third party whose IP or other values need to be protected?

  • Third party: Is there a third party which may be interested in compromising security for any of the above assets possibly unter threat?

(add more if you like.)

JimmyB
  • 12,101
  • 2
  • 28
  • 44
  • 1
    Hanno - I appreciate your answer but detect some "tones". I am looking for a "real answer" here, as this is a "real question". I have absolutely no idea what you are talking about in your reference to Alice, Bob or Eve. As to who needs to be protected: I'm talking about an Android app and, more importantly, its Java backend. As to who wants to attack this: it could be anybody. I am asking good Android developers out there about what attacks I should code against when building an Android app. – IAmYourFaja Jan 25 '12 at 18:17
  • 4
    I didn't mean to degrade your question, but it seems overly general and vague. If you cannot even name the stakeholders in your App's security I doubt you will receive the answer you are looking for. - What, btw., do you mean by "Java backend"? A server-side Java application? In your question you did not state you were referring to a client-server application - or any other relevant parameters of your to-be App. – JimmyB Jan 25 '12 at 18:23
0

Many mobile devices allow an app to pop-up a browser, and insert hooks into the browser which allows them to observe key-strokes and the like. This can allow key-logging. The attack occurs as follows:

  1. App creates a browser instance.
  2. App uses privileged browser APIs to add key-event handlers to pages loaded by the browser.
  3. App causes browser to load a URL, for example a bank login form.
  4. Use assumes that the browser same-origin policy is protecting the data they enter.
  5. App observes and exfiltrates form content possibly including the password.

How can I launch Safari from an iPhone app?

How can I open a URL in Android's web browser from my application?

Community
  • 1
  • 1
Mike Samuel
  • 118,113
  • 30
  • 216
  • 245
  • This is a risk which applies to an Android user, but how does it relate to someone wishing to write a secure app? – Heath Hunnicutt Jan 25 '12 at 18:52
  • @HeathHunnicutt, how do you define secure app? If your users are used to entering credentials into something that looks like a webpage, and another app can use that trust to get them to divulge those credentials, then the security of your system is compromised. – Mike Samuel Jan 25 '12 at 18:55
  • @MikeSamuel: Exactly! If you cannot define *who* or *what* is to be protected from *whom*, the term "security" becomes meaningless. – JimmyB Jan 25 '12 at 19:03
  • @MikeSamuel -- It really doesn't matter how I define secure app, your answer is aimed at a user, not a developer -- because you presuppose a hostile app. As for Hanno's pedantic insistence, I suppose the OWASP top 10 efforts are silly for not definining Alice, Bob, etc. Or perhaps Hanno is silly for wanting to overspecify an environment when openness to the possibility of varied threats might be more appropriate... – Heath Hunnicutt Jan 25 '12 at 21:22
  • @HeathHunnicutt, I can't give you a good answer until I understand your threat model. – Mike Samuel Jan 25 '12 at 21:31
  • @MikeSamuel, I've not posed a question. Somehow OWASP and JeffSix seem able to provide an answer without requiring a scope-narrowing scenario. – Heath Hunnicutt Jan 25 '12 at 21:52
  • Gee, Heath! You obviously do notice that your OWASP list is explicitly aimed at *web-based* apps, where it is clear who the client is and who the server and who is trying to protect what. Now understand that an Android App is **not** by default some mobile webbrowser and that, thus, those rules are simply not generally applicable. Jeffsix provided a good general answer which includes assumptions and narrowing of use cases that we are still just left to guess for the original question. – JimmyB Jan 25 '12 at 22:41
  • 1
    @HeathHunnicutt, if you don't want to narrow the scope, then the answer to your question is "read a laundry list of possible attack vectors and pick all the ones applicable to your situation, then make sure you include any novel attack vectors that no-one has bothered to publish yet." – Mike Samuel Jan 25 '12 at 22:44
  • @HeathHunnicutt, incidentally, what is your relation to Adam Tannon? – Mike Samuel Jan 25 '12 at 22:45
  • @Mike Samuel -- Has there been an incident? My connection to Adam Tannon is that we both have accounts on StackOverflow and both commented on this question. A more sinister question might be: what is my connection to YOU? It seems to much deeper than my connection to Adam Tannon. Perhaps you and I are up to something nefarious. Or, put seriously: WTF are you asking about? – Heath Hunnicutt Jan 25 '12 at 23:17
  • @HeathHunnicutt, I ask because I assumed from your comments that you had asked the question but obviously that is not the case. – Mike Samuel Jan 25 '12 at 23:56