Android Application Security - Securing Android Apps for Developers

What is Android application security?

Android application security refers to measures that safeguard Android applications from being accessed, misused, altered, or damaged without authorization. Thanks to the prevalence of mobile devices, including smartphones and tablets, Android has become a popular platform for creating and distributing mobile apps — but its openness makes it susceptible to different security risks. Employing mobile security measures can defend users against cyber threats, including hacking attempts, malware, and data theft.

Why is Android app security important?

Android app security is critical because Android dominates the mobile operating system market with a 71.8% market share compared to Apple’s iOS at about 27.6%. Android devices are often seen as high-value targets due to their access to a variety of data sources (emails, social media), the capability of the device (microphone, camera, geolocation), and its function in authentication processes (2FA). Developers must prioritize security to protect the personal, financial, and sensitive data stored on Android devices. While mobile attacks have always been a problem, the threat is rapidly evolving as bad actors develop increasingly sophisticated malware. 

Malicious attackers actively deploy malware with full remote access capabilities, modular design, and worm-like characteristics that can significantly damage Android devices. A number of these malware families transform to become more pernicious through regular development updates, and cybercriminals are getting better at sneaking malicious code past the official app store review process.

Mobile malware tactics developers must safeguard against include:

• On-Device Fraud (ODF): Mobile malware can now perform fraudulent actions directly from the victim's device. ODF marks a significant turning point for mobile attacks and can target business accounts and communication tools.

• Phone Call Redirection: Malware can redirect a call made to a bank to another number under the attacker's control. The victim remains unaware of the diversion as the call screen shows the legitimate phone number.

• Notification Direct Reply Abuse: FluBot spyware, Medusa, and Sharkbot can abuse Android's Notification Direct Reply feature to sign fraudulent transactions, modify push notifications, and spread malware. This feature can also be used to conduct push message phishing to spread the malware in a worm-like manner to the victim's contacts.

• Domain Generation Algorithm: Sharkbot uses a domain generation algorithm (DGA) to avoid detection by constantly creating new domain names and IP addresses for its command-and-control servers. This makes it difficult for security teams to detect and block the malware.

• Bypassing App Store Detection: Criminals have found ways to bypass app store detection by abusing Apple's TestFlight beta testing platform, Google Play's security process, and paying developers to embed their malicious SDK in their apps.

• Refined Development Practices: Android Trojans, such as the Xenomorph malware, are now developed with sophisticated update capabilities. Going forward, more mobile malware families will incorporate better update processes to enable enhanced features and new functionality on compromised devices.

Android security features

To thwart would-be attackers, Android provides security features designed to help developers protect applications from intrusion. These security features include:

• Application Sandbox: Apps run in a sandboxed environment to prevent unauthorized access to user data and system resources.

• Permissions: The Android platform includes a permission system allowing users to control the data and resources an app can access.

• SELinux: Android uses Security-Enhanced Linux (SELinux) to enforce mandatory access control policies, which helps protect the system from malicious apps.

• Code Signing: Android requires that all apps be signed with a digital certificate, which ensures that the app comes from a trusted source and hasn't been tampered with.

• Google Play Protect: Google Play Protect is a built-in security feature that scans apps on Google Play for malware and other security threats.

• Runtime Permissions: Starting with Android 6.0 (Marshmallow), users must grant permission to an app to access certain data or resources at runtime rather than during the installation.

• Network Security Configuration: Android provides a way for app developers to configure the network security of their app, including SSL/TLS certificate pinning and other security settings.

• Secure IPC: Android's Inter-Process Communication (IPC) mechanism provides secure communication between apps and services running on the same device.

• Verified Boot: Android devices include a verified boot process that ensures the integrity of the device's software and prevents unauthorized modifications.

• Hardware Security: Android devices include hardware security features such as a Trusted Execution Environment (TEE) and hardware-backed key storage to protect sensitive data.

Pro Tip: Specific features and the best way to use them depends on the Android version and device hardware, which can differ widely. It is a best practice to (1) keep yourself up to date what relevant features exist, (2) know the market your app addresses, and (3) design usage of these features accordingly. It is a best practice to use these OS services as much as possible

Android development languages and their security challenges

Android supports multiple programming languages for developing mobile applications, including Kotlin, Java, and C++. Each language has its strengths, weaknesses, and security challenges that developers need to consider.

Kotlin

Kotlin is a newer language that’s becoming the standard for Android development. It offers better sandboxing than Java, meaning Kotlin apps are less likely to interact with other apps on the user's device. This reduces the risk of malicious apps accessing sensitive data or resources.

The main security challenge with Kotlin is its relative newness. While it is considered more secure than Java, vulnerabilities or other security issues may have yet to be discovered. Developers must stay current with the latest security best practices and keep their libraries and frameworks updated to minimize the risk of security breaches.

Java 

Java is a popular programming language that is used in a wide range of applications, including Android app development. It is a higher-level language than C++, meaning it is easier to write and understand code in Java. However, because it is higher in the stack, it may not be as efficient as C++ in terms of performance and battery runtime.

One of the main security challenges with Java is the potential for vulnerabilities in its libraries and frameworks. Developers must ensure that they use up-to-date libraries and frameworks and follow secure coding practices to avoid common security issues such as SQL injection and cross-site scripting.

C++

C++ is a low-level language often used for system-level programming on Android. Because it is closer to the hardware, C++ can offer better performance and battery runtime than Java or Kotlin. However, C++ is shared between different applications, such as WebKit, media framework, and graphical layers, making it more difficult to sandbox effectively.

One of the main security challenges with C++ is the potential for memory-related vulnerabilities, such as buffer overflows and pointer errors. Developers must take care when working with C++ to avoid these vulnerabilities, which attackers can exploit. They also need to be aware of the shared nature of C++ and take measures to ensure that their code does not unintentionally interact with other apps or services.

Snyk Code has language support for Kotlin, Java, and C++, making it a great choice for Android application security.

Android application security best practices

Google, the maintainer of Android, is constantly developing an improved security & privacy framework. However, this makes it harder to write apps that work on multiple Android versions due to differing security requirements. Developers must consider the rights and privacy requirements that apps need early in the development cycle, as different versions of Android behave differently.

Other key best practices for Android security include:

1. Enforce secure communication: Developers should use secure protocols like HTTPS to encrypt data transmissions between the app and its servers. Additionally, implement certificate pinning, which ensures that the app only communicates with trusted servers by verifying the server's certificate against a known public key.

2. Provide the right permissions: Developers should ensure that their apps only request the permissions they need to function correctly and nothing more. Requesting unnecessary permissions could result in users denying the app access altogether or even worse, the app being removed from Google Play. Furthermore, only request permissions when required, such as when the user is trying to use a particular feature of the app.

3. Store data safely: Developers should use encryption to protect sensitive data that the app stores locally. Sensitive data should also be stored in secure locations inaccessible to unauthorized parties. For example, don’t store data on external storage devices like SD cards as other apps, or even users, can easily access them.

4. Keep services & dependencies up to date: Developers should regularly update their app's dependencies and libraries to ensure they are not vulnerable to known security issues or bugs. They should also stay informed about new security threats and patch their apps as soon as possible, and remove any unused or outdated dependencies to minimize the attack surface of their app.

Android application security checklist

Here’s an eight-point checklist you can use to ensure the highest security standards when developing applications for Android. 

1. Security and rights management is key: Security should be a primary concern throughout the development process. Identify potential security risks and threats at the project's outset and establish security protocols accordingly. Additionally, consider the management of user permissions and ensure that users have a clear understanding of the data their app is accessing.

2. Communication between mobile app and backend: The communication between mobile app and backend should be secure, and both sides should implement strong security measures. Ensure that all data transmissions between the app and the backend are encrypted and use secure protocols like HTTPS. Additionally, implement certificate pinning to ensure the app only communicates with trusted servers.

3. Threat scenarios in mobile are different: Mobile apps operate in a hostile environment, and sensitive data may be at risk. Consider the amount of critical security data stored on the mobile client and use encryption to protect sensitive data stored locally. Additionally, be mindful of potential threats, such as spying, and take appropriate measures to protect against them.

4. Use all the available security features of the Android OS: Android provides various security features, such as secure storage, key management, and sandboxing. Use these features to enhance the security of your app.

5. Think about the permissions your apps need: Developers should carefully consider the permissions their app requires and only request the minimum permissions necessary. Early planning is key to ensure that the app is designed to handle the required permissions. Additionally, developers should ensure that users know what data the app accesses and why it is necessary.

6. Use automation to keep your services and dependencies updated: Developers should use automated tooling to manage their app's dependencies and libraries. This ensures that the app is always up to date and not vulnerable to known security issues or bugs.

7. Make it clear which versions of the OS you support: Developers should be transparent about the Android versions their app supports. Supporting too many versions of Android can be challenging, so find a balance between customer service/device coverage and security. Additionally, remind users to update to the newest version of the app to ensure that they are using the most secure version.

8. Testing is key: Testing is crucial for detecting potential security risks and threats. Developers should use intrusion detection and other white-hat hacking methods to test their app's security. Additionally, include mobile apps in all security testing and measuring processes to ensure they are secure.

Android application security tools

Developers must have a security toolset in place to identify and prevent potential security threats. The following are some commonly used Android application security tools:

• SAST (Static Application Security Testing): A type of security testing that analyzes an application's source code or binary without executing the code. SAST tools use techniques such as pattern matching, control flow analysis, and data flow analysis to identify vulnerabilities early in development.

• SCA (Software Composition Analysis): SCA tools analyze an application's open-source and third-party dependencies to identify security vulnerabilities and license compliance issues. They scan the code for known vulnerabilities, monitor for new vulnerabilities, and provide recommendations on remediating them.

• Fuzzing: A type of testing that involves feeding invalid, unexpected, or random data as inputs to an application to detect bugs or vulnerabilities. Fuzzing tools generate large volumes of test data to identify potential vulnerabilities in an application's input validation.

• DAST (Dynamic Application Security Testing): A type of security testing that analyzes an application while it is running to identify potential vulnerabilities. DAST tools simulate attacks and analyze an application's responses to identify vulnerabilities such as injection flaws, cross-site scripting (XSS), and authentication issues.

• IAST (Interactive Application Security Testing): IAST tools combine elements of SAST and DAST to provide real-time feedback on potential security vulnerabilities while an application runs. They detect vulnerabilities like SQL injection, cross-site scripting, and buffer overflows.

• Monitoring and Detection: These tools provide ongoing security monitoring of an application in production to identify potential security incidents. They monitor logs, network traffic, and system events to detect anomalies and potential security threats. They also provide alerts and notifications to security teams when an incident occurs, allowing them to respond quickly.

Android application security with Snyk

Snyk offers two security tools for Android application security — Snyk Code and Snyk Open Source.

Snyk Code’s SAST analysis uncovers potential security vulnerabilities like SQL injection or Cross-Site Scripting (XSS) attacks. It supports language coverage for Kotlin, Java, and C++, which are commonly used languages for developing Android applications.

Snyk Open Source’s SCA coverage detects and reports any known security vulnerabilities in your Android application's third-party dependencies. It scans the open-source libraries and frameworks used in your application. It provides a report on any known security vulnerabilities so you can take appropriate measures to mitigate the risk of a security breach.

Mobile apps are not stand-alone, which means they interact with other services and dependencies, such as APIs and backend services. To ensure that the entire ecosystem surrounding your Android application is fully secured, Snyk offers other security tools such as Snyk Container and Snyk IaC. 

Snyk Container performs container security analysis to detect and fix vulnerabilities in your containerized environment. Snyk IaC scans infrastructure for security vulnerabilities, including misconfigurations, compliance violations, and more.

By leveraging Snyk's suite of developer security tools, you can ensure that your Android application is thoroughly scanned for any vulnerabilities and secured against potential threats, making it safe and ready for deployment. Book a live demo today to learn more.