About Ketan Parmar

Ketan Parmar (aka KPBird) is software engineer with 7 years experience, He is passionate about Java (SE,EE,ME),Android,BlackBerry, Grid Computing, Big Data, UI/UX and Open Source

Simple tips to secure Android app

Src: http://www.oneclickroot.com/wp-content/uploads/2012/10/Android-security.jpg

Src: http://www.oneclickroot.com/wp-content/uploads/2012/10/Android-security.jpg

Android has security features built into the operating system that significantly reduce the frequency and impact of application security issues but as application developer, its our job to secure application. The level of security is depends upon application type & domain. There are  few security aspects we need not forget. I am collecting those common tips in this article.

Here, I list down most common things that developers should take care to protect the application.

  1. Do not store private or sensitive data on SDCard. To store file on internal storage, use following methods with private mode (Context.MODE_PRIVATE) openFileOutput & openFileInput. If you really wants to store data in sdcard then encrypt it. You will find many encryption libraries. I prefer conceal from facebook.
  2. Restrict ContentProvider using exported flag set as false. It’s not the case that every time we develop ContentProvider for data exchange between applications but ContentProvider can be developed for single application or private.
  3. <provider android:exported="false" android:name="MyContentProvider" android:authorities="com.example.mycontentprovider" />
    
  4. Restrict WebView to access local data. HTML5 and related technologies have become popular  to develop Mobile Web App app or Hybrid app. For Hybrid uses WebView to display content from locally store HTML or fetch HTML and other content from the server.  Major security concerns for WebView are setAllowFileAccess() and setAllowContentAccess() methods.
  5. Do not pass sensitive information through Broadcast & Intent. Use LocalBroadcastManager for broadcast data within process / app. LocalBroadcastManager is available in Support Library V4.
  6. Don’t print sensitive information in LogCat. Information like username, password, web service URL, request or response, etc detail.
  7. Remove unnecessary Log before publishing app.
  8. Don’t process malicious Intents.  Before process Intent received in onReceive method of BroadcastReceiver, validate callers package name, action and other information.
  9. Protect your Service with Permission. Use exposed flag as  false When Service is developed for your app only.
  10. Restrict access to Activities. If the activity is intended solely for the internal use of the app then use exported flag set as false.
  11. <activity android:name=".view.MyActivity" android:exported="false"> </activity>
    
  12. Make sure that debug mode is false before publish APK.
  13. Encrypt sensitive data even if you store in internal storage.
  14. For cross app functionality, validate calling application before response.
  15. Properly verify server certificate TLS/SSL for HTTPS web call.
  16. Use NDK whenever you feel that information is not safe in Java code because It can decompile easily. i.e. Constant.
  17. Use ProGuard that shrinks, optimizes, and obfuscates your code.
  18. Remove unwanted / unused <user-permission> from AndroidManifest.xml
  19. Loading classes.dex outside of application is major security risk. DexClassLoader allowed developer to load classes.dex on demand.

Resource: http://developer.android.com/training/articles/security-tips.html

Reference: Simple tips to secure Android app from our JCG partner Ketan Parmar at the KP Bird blog.
Related Whitepaper:

Rapid Android Development: Build Rich, Sensor-Based Applications with Processing

Create mobile apps for Android phones and tablets faster and more easily than you ever imagined

Use 'Processing', the free, award-winning, graphics-savvy language and development environment, to work with the touchscreens, hardware sensors, cameras, network transceivers, and other devices and software in the latest Android phones and tablets.

Get it Now!  

3 Responses to "Simple tips to secure Android app"

  1. george says:

    any examples of ndk and constant ?

Leave a Reply


+ 3 = twelve



Java Code Geeks and all content copyright © 2010-2014, Exelixis Media Ltd | Terms of Use | Privacy Policy
All trademarks and registered trademarks appearing on Java Code Geeks are the property of their respective owners.
Java is a trademark or registered trademark of Oracle Corporation in the United States and other countries.
Java Code Geeks is not connected to Oracle Corporation and is not sponsored by Oracle Corporation.

Sign up for our Newsletter

20,709 insiders are already enjoying weekly updates and complimentary whitepapers! Join them now to gain exclusive access to the latest news in the Java world, as well as insights about Android, Scala, Groovy and other related technologies.

As an extra bonus, by joining you will get our brand new e-books, published by Java Code Geeks and their JCG partners for your reading pleasure! Enter your info and stay on top of things,

  • Fresh trends
  • Cases and examples
  • Research and insights
  • Two complimentary e-books