看看google的攻城师对android安全的认识：
1、敏感数据通过权限保护，这些权限都会由权贵把持，要想使用就得申请。
2、码农的安全意识很重要
码农很努力了，可惜由于缺乏安全意识，可能导致数据泄露：
- Storing personal data in a world-readable file 全局读文件。。。
- Exporting an unprotected content provider 组件导出，人人都可以访问。组件导出，容易被人滥用，造成权限代理攻击。
- Logging personal data in logcat logs 喜欢log。。
还要考虑邪恶的外部环境啊
- Insecure wireless networks 传输容易被窃取，最近连ssl都被人攻破了
- Lost and stolen devices 丢手机
- Storing personal data in a world-readable file 全局读文件。。。
- Exporting an unprotected content provider 组件导出，人人都可以访问。组件导出，容易被人滥用，造成权限代理攻击。
- Logging personal data in logcat logs 喜欢log。。
还要考虑邪恶的外部环境啊
- Insecure wireless networks 传输容易被窃取，最近连ssl都被人攻破了
- Lost and stolen devices 丢手机
3、用户证书
随便android 没有ios那样有严格的开发者证书，自己随便玩证书。但也要严肃点。
毕竟证书承载了不少内容。
1）、同样的签名可以共用UID
2）、软件升级的问题。
因此，为了安全起见，程序猿也要保护好自己的私钥！！！要不然被人窃取了，他可能会窃取你的应用信息哦。
4、android安全架构
android的安全架构主要有这样几部分：
1)、linux DAC机制，也就是RWX，还有些特殊的组ID控制，比如internet
比如open（）都是kernel通过uid控制
2)、组件认证，通常是被调用的一方进行权限控制，比如调用系统能力可能有System_server鉴权，如果和另一个应用交互，那就由另一个应用鉴权。其实就是IPC认证
5、沙箱
应用都是存在于自己的沙箱。
但也要考虑2个问题：
1）、反射的问题，现在很多hook的技术最后都是通过反射和java层对接。很邪恶
2）、native code不是法外之地，无法绕开permission机制，但可以修改进程空间，也就是动态修改应用状态。
另外进程间通信也有一些保护手段：
Intent filters---过滤而已
Permissions---就是摆设
Signatures-----真的有价值。共享签名的价值。
Permissions---就是摆设
Signatures-----真的有价值。共享签名的价值。
6、攻击入口
7、保护组件
Don't export app components unless you want other apps on the system to interact with your app
manifest xmlns:android="http://schemas.android.com/apk/res/android "
package="com.example.awesome">
<application android:label="@string/app_name">
…
<service android:name=".ServiceExample"
android:exported="false">
<intent-filter>…</intent-filter>
</service>
…
</application>
</manifest>
package="com.example.awesome">
<application android:label="@string/app_name">
…
<service android:name=".ServiceExample"
android:exported="false">
<intent-filter>…</intent-filter>
</service>
…
</application>
</manifest>
万不得已，不要到处。实在要到处，请下申请权限，而后共享签名控制（下面的最后一种）！！血泪教训
定义权限只是万里长征第一步，你定义了，别人申请即可，关键得签名控制！
protectionLevel="normal" – A lower-risk permission that gives requesting applications
access to isolated application-level features, with minimal risk to other applications, the
system, or the user. This is the default protection level. 悄悄地干活，啥都不提示
access to isolated application-level features, with minimal risk to other applications, the
system, or the user. This is the default protection level. 悄悄地干活，啥都不提示
protectionLevel="dangerous" – A higher-risk permission that would give a requesting
application access to private user data or control over the device that can negatively impact
the user. 就是提示，有啥用
protectionLevel="signature" – Can be used to limit access to components to only apps
signed with the same certificate. 真正有价值的！
上述的权限控制都是你定义了，系统帮你控制验证，你自己也可以的，要自信点。
其实很多种方法（下面列的太少了）
- Context.registerReceiver(…) can be used to register a BroadcastReceiver dynamically
• There is a version of registerReceiver(…) which can be used to specify permission the broadcaster must hold for your dynamically-registered receiver to be invoked.
- Context.checkCallingPermission(…) and Context.enforceCallingPermission(…) can be 自己验证
used in your source code to make sure the calling app holds the appropriate permission.
This can be used to implement fine-grained permissions if needed.
- Context.registerReceiver(…) can be used to register a BroadcastReceiver dynamically
• There is a version of registerReceiver(…) which can be used to specify permission the broadcaster must hold for your dynamically-registered receiver to be invoked.
- Context.checkCallingPermission(…) and Context.enforceCallingPermission(…) can be 自己验证
used in your source code to make sure the calling app holds the appropriate permission.
This can be used to implement fine-grained permissions if needed.
• Avoid the confused deputy problem:权限代理的问题，我申请了一个专利，也有学术界的论文提出解决防范，很简单就是一个 ∩！！！
下图说了，不申请权限要玩没门！！但申请了权限容易被一些屌丝杀软发现啊！！！肿么办！！
- If your app is using its granted permissions to respond to another app, check that the calling app has that permission as well
那就找有这些权限的，同时有漏洞的。。就是提供接口的。。。
8、注意细节啊
1）debug
android:debuggable 不要开启啊！！容易被人***
- Disabled by default
- Never leave this enabled in release code!
- Allows a user to debug your app - even without source code
- Users with physical access can run code as your app and access your app's data 开启你的隐私之旅。。。run-as有不懂的吗？
- Disabled by default
- Never leave this enabled in release code!
- Allows a user to debug your app - even without source code
- Users with physical access can run code as your app and access your app's data 开启你的隐私之旅。。。run-as有不懂的吗？
jlarimer-macbookair:~ jlarimer$ adb shell
shell@android:/ $ run-as com.example.awesomeness sh
shell@android:/data/data/com.example.awesomeness $ id
uid=10060(app_60) gid=10060(app_60)
shell@android:/data/data/com.example.awesomeness $ ls files/
secret_data.txt
shell@android:/data/data/com.example.awesomeness $ cat files/secret_data.txt
SECRETS!
shell@android:/ $ run-as com.example.awesomeness sh
shell@android:/data/data/com.example.awesomeness $ id
uid=10060(app_60) gid=10060(app_60)
shell@android:/data/data/com.example.awesomeness $ ls files/
secret_data.txt
shell@android:/data/data/com.example.awesomeness $ cat files/secret_data.txt
SECRETS!
2）、数据
Use MODE_PRIVATE for data files, shared preferences, and databases 保护自己的隐私，别全局读写啊
• openFileOutput(), openSharedPreferences(), and openOrCreateDatabase() create files in your app's
private data directory
External storage (sdcard) is shared storage sd卡没有权限控制，都可以读取，要存储三思啊，不行就加密啊！现在有很多开源加密库！
• openFileOutput(), openSharedPreferences(), and openOrCreateDatabase() create files in your app's
private data directory
External storage (sdcard) is shared storage sd卡没有权限控制，都可以读取，要存储三思啊，不行就加密啊！现在有很多开源加密库！
encryptedMessage = Encrypt(K, "Login-OK=0")
AlteredMessage = EncryptedMessage … XOR {…,0x31}
Plaintext = Decrypt(K, AlteredMessage) = "Login-OK=1"
AlteredMessage = EncryptedMessage … XOR {…,0x31}
Plaintext = Decrypt(K, AlteredMessage) = "Login-OK=1"
好码农
FileOutputStream fos = openFileOutput("private_data.txt", Context.MODE_PRIVATE);
SharedPreferences prefs = getSharedPreferences("data", Context.MODE_PRIVATE);
SharedPreferences prefs = getSharedPreferences("data", Context.MODE_PRIVATE);
女神对任何人都是开放的！
FileOutputStream fos = openFileOutput("private_data.txt", Context.MODE_WORLD_WRITEABL
SharedPreferences prefs = getSharedPreferences("data", Context.MODE_WORLD_READABLE);
FileOutputStream fos = openFileOutput("private_data.txt", Context.MODE_WORLD_WRITEABL
SharedPreferences prefs = getSharedPreferences("data", Context.MODE_WORLD_READABLE);
sd卡里面也不要存储程序哦：
Don't store code libraries that are world writable or on external storage 容易被替换，除非你校验
- Don't store paths to code libraries in files that are world writable or on external storage 路径也一样
- Don't process data from writable files in native code - memory corruption vulnerabilities could allow apps to run arbitrary code with your app's ID C语言爱溢出啊！！
• Don't store personal or protected data on external storage without user consent
- Don't store paths to code libraries in files that are world writable or on external storage 路径也一样
- Don't process data from writable files in native code - memory corruption vulnerabilities could allow apps to run arbitrary code with your app's ID C语言爱溢出啊！！
• Don't store personal or protected data on external storage without user consent
9、无线链路的安全
现在屌丝太多，就喜欢在星巴克搞WIFI Hack。
很多中间人攻击手段！
如何防护：
- HTTPS and SSL can protect against MitM attacks and prevent casual snooping 用https和ssl啊。但现在ssl在码农实现时存在太多的问题，详情看老王的书吧！比如Certificate pinning
-比如
URL url = new URL("https://www.google.com/ ");
HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();
友情提示：
Use cryptographic signing for any DEX or native code libraries that you load dynamically 这都是邪恶的软件才干的！远程下载APK、dex动态执行的
- Better yet, don't run code from the network
- Better yet, don't run code from the network
10、webview
web的安全话题就大了。。。xss.....
webview 中JavaScript is disabled by default。缺省是禁止的
addJavascriptInterface() is dangerous 你可以启用的。
- Avoid exposing protected or personal data to a JavaScript interface 既然放开了，就很难保证了，js和java就可以通信了，同时同源机制会被破坏。
- Server or network could be compromised, you can't trust the code
- If you do use it, ensure that you're using HTTPS for the WebView
- Server or network could be compromised, you can't trust the code
- If you do use it, ensure that you're using HTTPS for the WebView
10、友情提示
不要滥用职权，人民不会宽恕的！！申请最小的权利即可！
Permissions aren't required if you launch an activity that has the permission 系统已有task了，就别再申请权限了，直接调用这些应用即可！google为啥不直接删除那些直接发短信的api。谁能告诉我！！！
- Getting a picture from the camera
- Getting a picture from the camera
// create Intent to take a picture and return control to the calling application没权限照样干！！
Intent intent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE);
// create a file to save the image
fileUri = getOutputMediaFileUri(MEDIA_TYPE_IMAGE);
// set the image file name
intent.putExtra(MediaStore.EXTRA_OUTPUT, fileUri);
// start the image capture Intent
startActivityForResult(intent, MY_REQUEST_CO
Intent intent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE);
// create a file to save the image
fileUri = getOutputMediaFileUri(MEDIA_TYPE_IMAGE);
// set the image file name
intent.putExtra(MediaStore.EXTRA_OUTPUT, fileUri);
// start the image capture Intent
startActivityForResult(intent, MY_REQUEST_CO
- Sending an SMS through the SMS app 没权照样发！！
Uri smsNumber = Uri.parse("sms:5551212");
Intent intent = new Intent(Intent.ACTION_VIEW);
intent.setData(smsNumber);
intent.putExtra(Intent.EXTRA_TEXT, "hey there!");
startActivity(intent);
Intent intent = new Intent(Intent.ACTION_VIEW);
intent.setData(smsNumber);
intent.putExtra(Intent.EXTRA_TEXT, "hey there!");
startActivity(intent);
Permissions can be temporarily granted to apps by content providers
- Letting the user pick a contact to share with your app 无需申请READ_CONTACTS啊！！
- Letting the user pick a contact to share with your app 无需申请READ_CONTACTS啊！！
Intent intent = new Intent(Intent.ACTION_GET_CONTENT);
intent.setType(Phone.CONTENT_ITEM_TYPE);
startActivityForResult(intent, MY_REQUEST_CODE);
void onActivityResult(int requestCode, int resultCode, Intent data) {
if (data != null) {
Uri uri = data.getData();
if (uri != null) {
try {
Cursor c = getContentResolver().query(uri, new String[] {
Contacts.DISPLAY_NAME, Phone.NUMBER}, null, null, null);
intent.setType(Phone.CONTENT_ITEM_TYPE);
startActivityForResult(intent, MY_REQUEST_CODE);
void onActivityResult(int requestCode, int resultCode, Intent data) {
if (data != null) {
Uri uri = data.getData();
if (uri != null) {
try {
Cursor c = getContentResolver().query(uri, new String[] {
Contacts.DISPLAY_NAME, Phone.NUMBER}, null, null, null);
11、trick
Need a unique identifier? 唯一标示终端靠啥！老衲找了很多年，没找到！！下面的这些就更不靠谱了！
- TelephonyManager.getDeviceId() requires READ_PHONE_STATE permission
- Settings.Secure.ANDROID_ID doesn't require a permission, but still not perfect
To identify an installation of your app
- Generate a UUID when your app starts and store it in shared preferences:
- String id = UUID.randomUUID().toString();
- Use Android Backup Service to save the shared preferences to the cloud
- See: https://developers.google.com/android/backup/
- TelephonyManager.getDeviceId() requires READ_PHONE_STATE permission
- Settings.Secure.ANDROID_ID doesn't require a permission, but still not perfect
To identify an installation of your app
- Generate a UUID when your app starts and store it in shared preferences:
- String id = UUID.randomUUID().toString();
- Use Android Backup Service to save the shared preferences to the cloud
- See: https://developers.google.com/android/backup/
12、设备管理
设备管理本来是为企业管理MDM而生，可竟然被一些宵小用来作恶！！
最近史上最牛的恶意软件也用了设备管理，而后利用一个注册漏洞，竟然藏起来了。。让用户无法卸载这儿妖孽！！！
企业管理器激活后有很多功能，可以设置pin码复杂度，锁屏，擦出数据等等，ios的这部分就更丰富了！！
大家可以自己体验一下，激活后可以去激活！有个漏洞就是没有显示在激活列表。不去激活的话，应用是无法卸载的！于是成了邪恶！
最后
Use Android Lint 希望google 更加努力。让程序猿更多的时间和女神在一起！不要纠结在bug上！但现在的功能太小儿科！
这个功能很有商机！！有投资者看到了请与我联系。我做了应用漏洞检测工具！
