About Ketan Parmar

Ketan Parmar (aka KPBird) is software engineer with 7 years experience, He is passionate about Java (SE,EE,ME),Android,BlackBerry, Grid Computing, Big Data, UI/UX and Open Source

Simple tips to secure Android app

Src: http://www.oneclickroot.com/wp-content/uploads/2012/10/Android-security.jpg

Src: http://www.oneclickroot.com/wp-content/uploads/2012/10/Android-security.jpg

Android has security features built into the operating system that significantly reduce the frequency and impact of application security issues but as application developer, its our job to secure application. The level of security is depends upon application type & domain. There are  few security aspects we need not forget. I am collecting those common tips in this article.

Here, I list down most common things that developers should take care to protect the application.

  1. Do not store private or sensitive data on SDCard. To store file on internal storage, use following methods with private mode (Context.MODE_PRIVATE) openFileOutput & openFileInput. If you really wants to store data in sdcard then encrypt it. You will find many encryption libraries. I prefer conceal from facebook.
  2. Restrict ContentProvider using exported flag set as false. It’s not the case that every time we develop ContentProvider for data exchange between applications but ContentProvider can be developed for single application or private.
  3. <provider android:exported="false" android:name="MyContentProvider" android:authorities="com.example.mycontentprovider" />
  4. Restrict WebView to access local data. HTML5 and related technologies have become popular  to develop Mobile Web App app or Hybrid app. For Hybrid uses WebView to display content from locally store HTML or fetch HTML and other content from the server.  Major security concerns for WebView are setAllowFileAccess() and setAllowContentAccess() methods.
  5. Do not pass sensitive information through Broadcast & Intent. Use LocalBroadcastManager for broadcast data within process / app. LocalBroadcastManager is available in Support Library V4.
  6. Don’t print sensitive information in LogCat. Information like username, password, web service URL, request or response, etc detail.
  7. Remove unnecessary Log before publishing app.
  8. Don’t process malicious Intents.  Before process Intent received in onReceive method of BroadcastReceiver, validate callers package name, action and other information.
  9. Protect your Service with Permission. Use exposed flag as  false When Service is developed for your app only.
  10. Restrict access to Activities. If the activity is intended solely for the internal use of the app then use exported flag set as false.
  11. <activity android:name=".view.MyActivity" android:exported="false"> </activity>
  12. Make sure that debug mode is false before publish APK.
  13. Encrypt sensitive data even if you store in internal storage.
  14. For cross app functionality, validate calling application before response.
  15. Properly verify server certificate TLS/SSL for HTTPS web call.
  16. Use NDK whenever you feel that information is not safe in Java code because It can decompile easily. i.e. Constant.
  17. Use ProGuard that shrinks, optimizes, and obfuscates your code.
  18. Remove unwanted / unused <user-permission> from AndroidManifest.xml
  19. Loading classes.dex outside of application is major security risk. DexClassLoader allowed developer to load classes.dex on demand.

Resource: http://developer.android.com/training/articles/security-tips.html

Reference: Simple tips to secure Android app from our JCG partner Ketan Parmar at the KP Bird blog.

Do you want to know how to develop your skillset to become a Java Rockstar?

Subscribe to our newsletter to start Rocking right now!

To get you started we give you two of our best selling eBooks for FREE!

JPA Mini Book

Learn how to leverage the power of JPA in order to create robust and flexible Java applications. With this Mini Book, you will get introduced to JPA and smoothly transition to more advanced concepts.

JVM Troubleshooting Guide

The Java virtual machine is really the foundation of any Java EE platform. Learn how to master it with this advanced guide!

3 Responses to "Simple tips to secure Android app"

  1. george says:

    any examples of ndk and constant ?

Leave a Reply

× seven = 49

Java Code Geeks and all content copyright © 2010-2015, Exelixis Media Ltd | Terms of Use | Privacy Policy | Contact
All trademarks and registered trademarks appearing on Java Code Geeks are the property of their respective owners.
Java is a trademark or registered trademark of Oracle Corporation in the United States and other countries.
Java Code Geeks is not connected to Oracle Corporation and is not sponsored by Oracle Corporation.
Do you want to know how to develop your skillset and become a ...
Java Rockstar?

Subscribe to our newsletter to start Rocking right now!

To get you started we give you two of our best selling eBooks for FREE!

Get ready to Rock!
You can download the complementary eBooks using the links below: