OWASP Mobile Security Project - Android/References - Revision history

Jeff Six at 20:07, 2 December 2011

2011-12-02T20:07:16Z

Jeff Six: added book reference

2011-12-02T20:06:46Z

added book reference

Anant Shrivastava: added whitepaper on security issues in android custom roms

2011-10-17T00:07:56Z

added whitepaper on security issues in android custom roms

Dinis.cruz: /* Tools */

2010-11-08T18:03:14Z

‎Tools

Dinis.cruz: /* Tools */

2010-11-08T16:25:13Z

‎Tools

Dancornell: /* Tools */

2010-11-06T01:09:36Z

‎Tools

Dancornell: /* Published Research and presentations */

2010-11-06T01:09:12Z

‎Published Research and presentations

Dinis.cruz at 16:03, 5 November 2010

2010-11-05T16:03:43Z

Dinis.cruz at 16:03, 5 November 2010

2010-11-05T16:03:05Z

Dinis.cruz at 15:49, 5 November 2010

2010-11-05T15:49:21Z

@@ Line 25: / Line 25: @@
 ** [http://anantshri.info/articles/android_cust_rom_security.html Security Issues in android Custom ROMs] at c0c0n Kochi India (Oct 8 2011)
 * '''Books'''
-** [http://shop.oreilly.com/product/0636920022596.do/ Application Security for the Android Platform]
+** [http://shop.oreilly.com/product/0636920022596.do Application Security for the Android Platform]
 ** [http://www.amazon.com/gp/product/0071633561/ Mobile Application Security]
 *'''Blog posts'''

@@ Line 25: / Line 25: @@
 ** [http://anantshri.info/articles/android_cust_rom_security.html Security Issues in android Custom ROMs] at c0c0n Kochi India (Oct 8 2011)
 * '''Books'''
 ** [http://www.amazon.com/gp/product/0071633561/ Mobile Application Security]
 *'''Blog posts'''

@@ Line 23: / Line 23: @@
 ** [https://www.isecpartners.com/files/iSEC_Securing_Android_Apps.pdf Developing Secure Mobile Applications for Android]
 ** [http://www.blackhat.com/html/bh-ad-10/bh-ad-10-briefings.html Building Android Sandcastles in Android's Sandbox] at BlackHat Abu Dhabi (Nov 10 - 11 2010) (NOT PUBLISHED YET)
 * '''Books'''
 ** [http://www.amazon.com/gp/product/0071633561/ Mobile Application Security]

@@ Line 36: / Line 36: @@
 ** [http://code.google.com/p/dex2jar/ Dex2Jar] :'' "...Android mobile device runs applications which have been converted into a compact Dalvik Executable (.dex) format. Dex2Jar converts .dex files to Java .class files..." ''
 ** [http://code.google.com/p/android-apktool/ ApkTool] :'' "...It is a tool for reengineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications; it makes possible to debug smali code step by step. Also it makes working with app easier because of project-like files structure and automation of some repetitive tasks like building apk, etc..." ''
-** [http://java.decompiler.free.fr JD] : Java Decompiler
+** [http://java.decompiler.free.fr JD-GUI and JD-Eclipse], [http://www.neshkov.com/ DJ] and [http://www.varaneckas.com/jad JAD (mirror)] : Java Decompilers
 ** [[OWASP O2 Platform]] can be used to review the Android Java source code (create object model of compiled java code, search source-code files, model config files)
 ** Commercial tools (like Fortify, IBM AppScan Source) can parse Java files (the question is "Do they have Android Specific rules")
 ** iSec Partners have a number of Android related tools at https://www.isecpartners.com/mobile_application_tools.html
 ===Media Coverage===
 *  Storing data unencrypted: "Firm finds security holes in mobile bank apps": http://news.cnet.com/8301-27080_3-20021874-245.html
 * Paypal has issue with lack of SSL in iPhope app: http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html (more to iPhone page)

← Older revision		Revision as of 16:25, 8 November 2010
Line 40:		Line 40:
	** Commercial tools (like Fortify, IBM AppScan Source) can parse Java files (the question is "Do they have Android Specific rules")		** Commercial tools (like Fortify, IBM AppScan Source) can parse Java files (the question is "Do they have Android Specific rules")
	** iSec Partners have a number of Android related tools at https://www.isecpartners.com/mobile_application_tools.html		** iSec Partners have a number of Android related tools at https://www.isecpartners.com/mobile_application_tools.html
		+
		+
		+	===Media Coverage===
		+	* Storing data unencrypted: "Firm finds security holes in mobile bank apps": http://news.cnet.com/8301-27080_3-20021874-245.html
		+	* Paypal has issue with lack of SSL in iPhope app: http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html (more to iPhone page)

@@ Line 33: / Line 33: @@
 ** [http://developer.android.com/sdk/index.html Android SDK]
 * '''Android Security Review'''
 ** [http://code.google.com/p/dex2jar/ Dex2Jar] :'' "...Android mobile device runs applications which have been converted into a compact Dalvik Executable (.dex) format. Dex2Jar converts .dex files to Java .class files..." ''
 ** [http://code.google.com/p/android-apktool/ ApkTool] :'' "...It is a tool for reengineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications; it makes possible to debug smali code step by step. Also it makes working with app easier because of project-like files structure and automation of some repetitive tasks like building apk, etc..." ''

@@ Line 18: / Line 18: @@
 ===Published Research and presentations ===
 * '''Presentations'''
 ** [http://www.coverity.com/library/pdf/coverity-scan-2010-open-source-integrity-report.pdf Coverity SCAN 2010 Open Source Integrity Report] which contains information about 88 Kernel bugs in Android
 ** [https://www.isecpartners.com/files/iSEC_Android_Exploratory_Blackhat_2009.pdf Exploratory Android Security (iSEC Partners,  Blackhat_2009)

@@ Line 12: / Line 12: @@
 ===Android Security Team===
-* Report security vulnerabilities in Android: security@android.com (their [http://developer.android.com/security_at_android_dot_com.txt PGP Public] key)
+* Report security vulnerabilities in Android: security@android.com (here is the [http://developer.android.com/security_at_android_dot_com.txt PGP Public] key)
 * [http://groups.google.com/group/android-security-discuss Android Security Mailing list]
 * [http://groups.google.com/group/android-security-discuss/browse_thread/thread/a2ab575dd0e5c27d Introduction from Android Security Team]

@@ Line 4: / Line 4: @@
 ===Official documentation===
 * Main websites: http://www.android.com , http://code.google.com/android , http://developer.android.com/
 * [http://developer.android.com/guide/index.html Android Developer's Guide]
 * [http://developer.android.com/guide/topics/security/security.html Security and Permissions]
@@ Line 10: / Line 11: @@
 * [http://developer.android.com/guide/tutorials/notepad/index.html Notepad Tutorial] - Recomended starting point to understand Android
 * [http://groups.google.com/group/android-security-discuss Android Secuity Mailing list]
 ===Published Research and presentations ===