Home » Android » Android Core » Simple tips to secure Android app

About Ketan Parmar

Ketan Parmar (aka KPBird) is software engineer with 7 years experience, He is passionate about Java (SE,EE,ME),Android,BlackBerry, Grid Computing, Big Data, UI/UX and Open Source

Simple tips to secure Android app

Src: http://www.oneclickroot.com/wp-content/uploads/2012/10/Android-security.jpg

Src: http://www.oneclickroot.com/wp-content/uploads/2012/10/Android-security.jpg

Android has security features built into the operating system that significantly reduce the frequency and impact of application security issues but as application developer, its our job to secure application. The level of security is depends upon application type & domain. There are  few security aspects we need not forget. I am collecting those common tips in this article.

Here, I list down most common things that developers should take care to protect the application.

  1. Do not store private or sensitive data on SDCard. To store file on internal storage, use following methods with private mode (Context.MODE_PRIVATE) openFileOutput & openFileInput. If you really wants to store data in sdcard then encrypt it. You will find many encryption libraries. I prefer conceal from facebook.
  2. Restrict ContentProvider using exported flag set as false. It’s not the case that every time we develop ContentProvider for data exchange between applications but ContentProvider can be developed for single application or private.
  3. <provider android:exported="false" android:name="MyContentProvider" android:authorities="com.example.mycontentprovider" />
    
  4. Restrict WebView to access local data. HTML5 and related technologies have become popular  to develop Mobile Web App app or Hybrid app. For Hybrid uses WebView to display content from locally store HTML or fetch HTML and other content from the server.  Major security concerns for WebView are setAllowFileAccess() and setAllowContentAccess() methods.
  5. Do not pass sensitive information through Broadcast & Intent. Use LocalBroadcastManager for broadcast data within process / app. LocalBroadcastManager is available in Support Library V4.
  6. Don’t print sensitive information in LogCat. Information like username, password, web service URL, request or response, etc detail.
  7. Remove unnecessary Log before publishing app.
  8. Don’t process malicious Intents.  Before process Intent received in onReceive method of BroadcastReceiver, validate callers package name, action and other information.
  9. Protect your Service with Permission. Use exposed flag as  false When Service is developed for your app only.
  10. Restrict access to Activities. If the activity is intended solely for the internal use of the app then use exported flag set as false.
  11. <activity android:name=".view.MyActivity" android:exported="false"> </activity>
    
  12. Make sure that debug mode is false before publish APK.
  13. Encrypt sensitive data even if you store in internal storage.
  14. For cross app functionality, validate calling application before response.
  15. Properly verify server certificate TLS/SSL for HTTPS web call.
  16. Use NDK whenever you feel that information is not safe in Java code because It can decompile easily. i.e. Constant.
  17. Use ProGuard that shrinks, optimizes, and obfuscates your code.
  18. Remove unwanted / unused <user-permission> from AndroidManifest.xml
  19. Loading classes.dex outside of application is major security risk. DexClassLoader allowed developer to load classes.dex on demand.

Resource: http://developer.android.com/training/articles/security-tips.html

Reference: Simple tips to secure Android app from our JCG partner Ketan Parmar at the KP Bird blog.

Do you want to know how to develop your skillset to become a Java Rockstar?

Subscribe to our newsletter to start Rocking right now!

To get you started we give you our best selling eBooks for FREE!

1. JPA Mini Book

2. JVM Troubleshooting Guide

3. JUnit Tutorial for Unit Testing

4. Java Annotations Tutorial

5. Java Interview Questions

6. Spring Interview Questions

7. Android UI Design

and many more ....

 

3 comments

  1. any examples of ndk and constant ?

Leave a Reply

Your email address will not be published. Required fields are marked *

*


four + 9 =

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Do you want to know how to develop your skillset and become a ...

Subscribe to our newsletter to start Rocking right now!

To get you started we give you our best selling eBooks for FREE!
Get ready to Rock!
To download the books, please verify your email address by following the instructions found on the email we just sent you.

THANK YOU!

Close