My application would be frequently connecting to the web service to get some data in json.
Is there a way this data can be encrypted on server side and decrypted on application side so that data transferred is secure and safe?
Also, if the applicaiton comes with its own database (sqlite db file), is it possible for anyone using this application to look at this database (tables, fields and content)?
Regards,
Sapan
Your easiest option for transferring the data encrypted is to use SSL (i.e. https) for the communication between the app and the web service.
If you need to set up your own self-signed certificate for the server (instead of buying one) you might have problems getting android to talk with it, but it's doable. See this SO question for tips.
Regarding reading the database, it might be possible. I would assume that an attacker that got access to the phone could read the database, if they were determined enough. If you want the data to be really secure, you would have to store the database in an encrypted file and require the user to enter a password each time they open your app.
You have to decide how much security you really need.
You should definitely go for SSL encryption of the data when you transfer it over the network, though.
You can use crypto to encrypt/decrypt json in both android and server.In it very simple and secure. Using Base64 is not a efficient way, because anyone can decrypt. In this, you can use a secret key to encrypt and decrypt the String. If using wrong key to decrypt, the output will be wrong.
http://www.androidsnippets.com/encryptdecrypt-strings
I use Base64 encoding and decoding to encryt data over the network.
Depending on the type of webservice you are using, it will or will not have Base64 encoding and decoding. You can always google for code made by others.
Depending on the Android version you are targeting.
From API level 8 and up: http://developer.android.com/reference/android/util/Base64.html
For lower: http://www.frankdu.com/notes/2011/01/27/base64-encoding-with-android-2-1-or-earlier/
You could also write your own encoding and decoding systems of course. ;)
Related
Hello:
I received a special requirement today and it consists in the following situation:
From now, we have to encrypt 4 inputs in our Android app and then, when this data is already in the Server (SQL Server), these fields must be decrypted there when necessary and the same for the Microsoft Access engine.
I was reading about encrypting some fields in an Android app that I can use some encryption algorithms... okey, but do I can use the same algorithm for decryption in SQL Server and Ms Access?
What algorithm can I choose in order to don't have problems in the other db engines later when decrypting?
Can you suggest me another alternative maybe?
Hope I can find a light
Thks a lot and blessings
You may use any asymmetric algorithm, supported by Java.
There is a full example of using RSA for encryption and decryption using key pairs.
I have to develop an app both for iOS and Android. This app uses a small sqlite database with sensitive data, and depending on the user's input, it makes some process with this data. After this process is made, the database is no longer accessed unless the user has to enter a new input (it's not probable that this happens).
Since the database has sensitive data I have to protect it. I know is impossible to get a complete protection but I would like to make life harder for a possible attacker.
And since I don't know too much about security I'm not sure what would be the best alternative taking into account "difficulty / security".
I've thought in two alternatives:
1) Include the database in the apps and encrypt or obfuscate it.
But I guess it wouldn't be very difficult to get the database with a rooted Android.
2) Have the database stored in a server, each time the user enters the input the app downloads the database, the process is made and after that I remove the database from the app.
But the process takes 5-10 minutes and maybe this time is enough to get the database from the app, so I would have to add the same protection as in 1) plus a protection in the server.
Which would be the best option (difficult / security)? There would be any other options?
I've tried several Google searches but I'm confuse with all that information and I would like to try with the huge acknowledge of this community.
UPDATED:
Well, reading your answers I'm inclined to have a backend and not download the database to the app. It's not the preferred solution of the client, but it seem is the best by far so I'll try to convince it.
Anyway, due to the type of process the app has to do I'm not sure if it's possible with a backend.
Since it's a complete different question I would like to ask it in other thread: https://stackoverflow.com/questions/29942688/remote-sqlite-queries-from-app
NEW UPDATE:
I keep thinking in this and I don't find a good solution because the process is too complex. I've thought in something I would like to know if it's possible or if it has no sense (sorry but I don't know too much about backend development).
SERVER -> my sqlite database & PHP web services
DEVICE -> a txt file with user inputs (20MB)
Device: In the device the txt file is compressed (10MB)
Device: The app send the txt file to the server via POST web service.
Server: This txt file is stored in the server.
Server: This txt file is decompressed.
Server: This txt file is loaded into a new table InputTable inside my sqlite database.
Server: A new table UserFinalDataTable (almost 10000 rows) is created making lots of queries using InputTable and the rest of my database.
Server: UserFinalDataTable is converted into JSON and sended back to the device as the response to the web service called in step 2.
Device: The app receive this JSON and converts it to something useful for the app.
Is this possible or any (if not all) of the steps is impossible to achieve?
The most secure and reliable way is to store the database on your server encrypted with a symmetric encryption algorithm. Better yet if you also use an asymmetric encryption algorithm on top of that, if possible with some sort of forward secrecy, in case your server gets hacked. It all depends on what degree of security you want to achieve.
Another way would be to store the database on the device with the server's encryption key, when needed send the database to your server for decryption and return the decrypted output. Although this doesn't make sense in most situations, especially yours.
Neither. The most secure way is to keep the database on the server and access it only by webservice, with proper account authentication. If you send any data at all to a client, a sufficiently motivated attacker will get it. In the case of a whole database file, it would be trivial to root the device and read it. And if you encrpyt it, SQLite won't be able to read it (not to mention the decryption key would be local so easily reverse engineered).
The most secure strategy you say....backend server with a db and web service.
Use SQLCipher to encrypt your db.
It works either on iOS and Android
I don't understand what the hacker can see and cannot see when he enters in a mobile app, for example android. He decompiles the .apk, then sees some .class files. If for example, I encrypt a key/value pair in a file, I still need to call this key from the code, and if the hacker can see the code, no matter if the key is encrypted, he will know which key I am calling?
My goal is to keep some encrypted string in my app, for example the twitter account Id of my app.
Some topics talk about " a private key to read, what was encrypted with a public key ", but if I use them, I still need to store them somewhere in my app...
Don't completely understand your requirement but the rule-of-thumb is always assume that client is not to be trusted.
You have to ensure that
All decryption should be done in your server (which you trust).
The client should never be able to access the decrypted data (unless you want it to). Hence whatever part of your code that needs to directly access the decrypted data should be in the server.
The client should have only the encrypted data (if it must store data).
The client should not be able to access the private key you used to encrypt the data.
If in your case your client must be able to access the critical data directly, then your only resort is to use obfuscation techniques (Basically hiding your data/code, to make it hard to find/understand). Of course all obfuscation techniques can be defeated eventually by a determined hacker. You have to decide how valuable your data is, what are the probabilities a hacker will try and access your data.
To take an extreme example : storing your twitter account and password using obfusucation is very bad. Storing a twitter-url- might not be so bad.
you can get your keys from server while launching app. and also dont manage in app purchase detail in sharedPrefrence or Sqlite. because in rooted device user can see that data file from root browser or sqlite editor application so user be able to change value.
A very determined person can crack it, but it's a major pain to crack encrypted strings and will stop most hackers. Especially if you obfuscate your code with something like ProGuard.
Answer to a similar question for details on how to encrypt
I currently work on a web message application , and I am storing the chat log on the database and some user data on share preferences.
The problem is, I wonder are there any way to make the data not accessible/ not readable when I open them in file explorer? Or how can I implment higher protection measures on the data ? I have searched for some approach but it somehow does not fit for the web messaging application.
For example:
Store data on server. If the data is chat log then there is a huge set of data and the network traffic to the server is very high
Encryption. If I use the SHA or else to encryt the data , it is not possible to read them
Thanks for helping
Database can be accessed if the phone is rooted, so you should encrypt the data that is stored in the database and decode it when reading from the database.
You probably could use one way RSA encryption, storing a key to decrypt the content (when required) on the server and the one way encryption key can be on the device. Reading the key alone should not create a lot of load on the server.
The key will be in the device memory at the time of decryption but intercepting in there may already be complex.
I'm looking for a way to be able to encrypt all data written to the WebView cache. Since it has been deprecated, I am attempting to avoid using the CacheManager. My current strategy would be to catch all attempts to write to cache and encrypt the data just prior to writing it and to catch all requests for data from the cache so that I can decrypt the data before returning the data requested.
I guess it is possible to encrypt all your data. But it is probably better practice and security to just clear the data it after use. You are correct that you should not use CacheManager because it is deprecated.
Android Security designs recommends clearing the cache:
If your application accesses sensitive data with a WebView, you may want to use the clearCache() method to delete any files stored locally. Server side headers like no-cache can also be used to indicate that an application should not cache particular content.
from here:
http://developer.android.com/guide/practices/security.html
But if you want to encrypt the data you will have to do it manually. So you would need to go to the directory where Android stores its cache and encrypt it yourself. There are different ways to do this depending on what you are trying to accomplish. How and when you do that will be up to you.
Off the top of my head, if you are trying to make a web browser application. the best way to do this is to create a wrapper class for the CookieStore or CookieManager class which could be found here:
http://developer.android.com/reference/java/net/package-summary.html
I hope this helps
Currently I'm working on a solution that shall able to encrypt the WebView cache. I'm brainstorming some possible solutions, according to you're thoughts...
Some possible (or not possible) Solutions I faced for now:
1. GoT hook read and write of libchromeXX.so
Pro
Deterministic encrypt and decrypt the cache. There won't be any unencrypted data on disk.
Cons
Very risky (possible architecture / device specific issues in field, possible android version specific issues, possible webview
implementation specific issues)
2. Listen with inotify for fs changes and encrypt jit (just in time). Decrypt on next app launch
Pro
Only "public" API
Cons
Some android devices might not support "inotify"
At runtime the data can be manipulated (sure only with root / system uid and if attacker this permission he might hook stuffs in
our process anyway)
3. Create hash over all data or last modified / size combination and store seperately
Pro
Only "public" API
Maybe faster than encryption
Cons
Only verifies if data was manipulated
The digest must be stored somewhere?
4. Somehow use ETag mechanism to validate the data
This I researched not that deep right now, but potentially the ETag might represent the hash of a particular resource and we might verifies if the hash matches to server provided digest. We would have to iterate through the cache and search for ETag and resource pairs or is there a browser feature out of the box? I guess not :(
Pro
Validation might be out of the box if browser supports it
Cons
Potentially not working or not the intended usage of ETag
Isn't there any mechanism that verifies integrity of cached resources?