I am pretty confused here trying to find a solution to this problem.
There is a wifi enabled micro controller and a client (android app), both connected to the same wifi network. The official android app sends some instructions to the microcontroller through GET params.
Now i want only and only the official app to be able to send meaningful data across. To prevent man-in-the-middle attack i can encrypt this data using asymmetric keys. The micro-controller will generate the public and private keys and give out the public key through the server when asked for.
But then comes the problem. Can't the attacker send data to the device (micro-controller) too if he knows the public key? The attacker can simply get the code of the app through reverse eng. and send meaningful data through his browser to the device.
Some limitations -
I cant make any sort of white-list on the device.
There is no internet connection. Just LAN available.
The device has no sense of time.
Some properties-
The devices have a unique 8 digit id. In scenario of multiple devices, the right one is targeted using this id. The devices' used IP address is mapped to this ID.
The android app (client) sends numeric strings in GET params for the devices to perform operations.
Can this be solved using a fool-proof method?
Thank you in advance.
Related
I'm, working on a security scenario for an Android Application to prevent sending unwanted/spam or multi-requests by users.
These users are unregistered and as you know one way to detect them is by checking the IP addresses but the problem is that the public IP Addresses will change. Users can turn On/Off the modem (as an example) to get the new public IP Address or can install/uninstall the app to refresh everything and start sending unwanted requests to the server.
I want to make something like a token and store it on the phone that it will send with their request and on the server-side, we can detect which these requests come from which phone/user and handle the security issues.
This token or ID must have these features:
Access to it (deleting) should be impossible or hard for normal people (not for
hackers, I know it's impossible)
If the app has been uninstalled/installed, Android OS doesn't remove
it
Is it possible?
Is there a better solution to handle this?
The Android developer docs have a good article on available user IDs. Getting the second property will be difficult because Android has been pushing for resettable IDs for user privacy. The firebase installation ID (FID) is close, but you don't get #2. You can also use SafetyNet APIs to see if the app is genuine and then build rate limiting in the client or server side.
A similar question was asked How to send data from one android device to another?
However their scope of data pass is between android devices.
And so to extend that question, I wanted to know ways of connecting two completely separate devices like ECG device to apps (Android or IOS).
For example, AliveCor allows to send reading of external device to their mobile app.
So what ways do we have apart from Bluetooth or TCP/IP?
You have essentially listed all reasonable means that are used nowadays. You can either transfer data via bluetooth, using your own/3rd party hosted webservices like firebase or direct tcp/ip connection. TCP/IP probably being the hardest, bluetooth being 2nd hardest and webservice being the easiest but yet requiring both devices to be online. The implementation is however totally your responsibility (with web you would either add user registration and sync user data to all signed in devices, or if sync is one time thing, you could upload data to your server, issue a expiring token, which if entered in other device allow it to download that data).
Another way is NFC(Near field communication). You can transmit data when phone(with NFC) is near to another device (with NFC). Also,
For example, AliveCor allows to send reading of external device to their mobile app.
this app use NFC for transmitting data.
From permissions ( google play AliveCor Kardia app)
Also read the information about this system on https://www.alivecor.com/faq/
https://books.google.com.ua/books?id=H-JRAwAAQBAJ&lpg=PA41&ots=EV9Qy61sjY&dq=nfc%20data%20transfer%20ECG&hl=uk&pg=PA41#v=onepage&q=nfc%20data%20transfer%20ECG&f=false
I'm about to start a new project in which I have to make two Android devices exchange data assuming no internet connection. I've seen the Nearby Connections API which seems perfect for my case.
Since the data the devices exchange are private, I would like to understand how Nearby secure the communication. On the website is written:
Connections between devices are high-bandwidth, low-latency, and fully encrypted to enable fast, secure data transfers.
No additional information are provided. Does anyone knows how Nearby enforces communication encryption?
Thanks
When one device requests a connection with another, both devices are given the exact same token and asked to, independently, accept the connection. Users are expected to confirm this token somehow (eg. Show the token on both screens with a confirmation prompt).
This step is required for every connection request; there's no way to reconnect (yet).
I'm using C2DM in my Application to send data from mobile to mobile
But C2DM uses Google server(lacks data confidentiality) to redirect messages to device.
Is there any other way for sending data from mobile to mobile directly without any third party server?
I dont want to use SMS in my App.
Base on requirement (1) Without third party server (2) Between 2 mobiles.
Your options are limited to these:
WiFi Direct (Ad Hoc Network)
http://developer.android.com/guide/topics/wireless/wifip2p.html
Bluetooth
http://developer.android.com/guide/topics/wireless/bluetooth.html
NFC
http://developer.android.com/guide/topics/nfc/index.html
You clearly said "no third party server". But may I suggest xmpp. I've had good luck with smack derived jars and OpenFire. You get a lot of flexible and easy to use functionality out of the box. It may be your best bet for chat type applications.
We host our own instance of OpenFire and authenticate against Active Directory. The XMPP protocol provides the user/device addressing, routing, and, optionally, store and forward capabilities.
It also makes it easy to exchange device data with applications written for other operating systems and in other languages. XMPP IQ packets can be used for lookup type transactions without the overhead of a Chat type connection (no presence information, back end XEP-114 plug ins to connect with server side resources).
Not really: your device has to know which device to connect to. You could theoretically do that if you know the IP of the device, but with mobile phones this changes frequently and I'm not even sure if mobile providers will let you connect directly to devices on their network. So, you're at least going to need a 'step' in between the two phones that you can trust to be stable.
What you could do is set up your own server, and let a user (user1) upload messages to your server addressed to a specific sender (user2). When the message is received, you can use C2DM to send a signal to user2's phone, and attach the message's unique identifier to this. When user2's app receives this message, you can proceed to download the message content from your webserver.
If you don't want to use any webserver at all, you're limited to the options mentioned by Calvin: WiFi, bluetooth or NFC.
Unfortunately having a direct socket connection between mobiles phones is almost impossible as they invariably are behind firewall. BTW also look at https://www.alljoyn.org/ Its an interesting technology as well.
I'm writing an Android app that communicates via HTTPS with a server application. On the server side, I have to be absolutely sure about the Android app's integrity. This means that the server app needs to be sure that it's communicating with the Android app that I developed and not with a re-written one (e.g. after decompiling the original app or after having rooted the device).
Is there a possibility to ensure that? Maybe there is a possibility with the signature of the apk file?
Any hint is appreciated.
Regards,
Peter
You are trying to address a known problem:
You can never trust an application on an open device (mobile phone, desktop computer). In order to trust it, it should be tamper proof. An example of such device is a SmartCard. Mobile devices are certainly not it.
You should never send data to device that user is not supposed to see. The implication of this is that all business logic must be done on the server.
All requests to the server should be authenticated with user's credentials (username/password) and made via a secure protocol (HTTPS/SSL).
No way. Whatever is in user's hands, is not yours anymore. Even if you somehow manage to transfer the APK to the server for validation, nothing prevents the hacked program send an original copy to the server.
In order to validate that your software is running, the client devices need to be able to provide remote attestation services, which is one of many piles of acronyms in the TPM world. I found that someone has been working on providing TPM services, including IBM's IMA, which is almost good enough for what you want.
Details here: http://www.vogue-project.de/cms/upload/vogueSoftware/Manual.pdf (Google Quickview).
Of course, this is emulating the TPM, and requires patching the Android kernel. But perhaps one of the various manufacturers would be willing to build a model with the TPM hardware included for you?