OWASP Mobile Security Project - Android/References

Here are a number of references related to Android Security

Official documentation

• Android Developer's Guide
• Security and Permissions
• Testing and Instrumentation
• AndroidManifest.xml File
• Notepad Tutorial - Recomended starting point to understand Android

Published Research

• Coverity SCAN 2010 Open Source Integrity Report which contains information about 88 Kernel bugs in Android:

Blog posts

• Reversing Android Apps 101 and Storing Data On Mobile Devices The Wrong Way - Jack Mannino
• Android Emulators with Android Market and Android Market on Emulator

Presentations

• Building Android Sandcastles in Android's Sandbox at BlackHat Abu Dhabi (Nov 10 - 11 2010)
• [https://www.isecpartners.com/files/iSEC_Android_Exploratory_Blackhat_2009.pdf Exploratory Android Security (iSEC Partners, Blackhat_2009)
• DEVELOPING SECURE MOBILE APPLICATIONS FOR ANDROID

Tools

• Android Development
  • Android SDK

step by step. Also it makes working with app easier because of project-like files structure and automation of some repetitive tasks like building apk, etc..."

• Android Security Review
  • Dex2Jar : "...Android mobile device runs applications which have been converted into a compact Dalvik Executable (.dex) format. Dex2Jar converts .dex files to Java .class files..."
  • ApkTool : "...It is a tool for reengineering 3rd party, closed, binary Android apps. It can decode resources to nearly original form and rebuild them after making some modifications; it makes possible to debug smali code
  • JD : Java Decompiler
  • OWASP O2 Platform can be used to review the Android Java source code (create object model of compiled java code, search source-code files, model config files)
  • Commercial tools (like Fortify, IBM AppScan Source) can parse Java files (the question is "Do they have Android Specific rules")
  • iSec Partners have a number of Android related tools at https://www.isecpartners.com/mobile_application_tools.html