Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 9 years ago.
Improve this question
For understanding how strong data should be secured on an Android device I want to understand which attacks are possible. I started to write down my knowledge and hope that I get corrections, where I'm wrong or where I'm missing something. I first assume that Google don't be evil, so will ignores attacks from google themselves.
Each application is signed and runs under his own user-id, so an app can only reads data which belongs to him, except the app creates a public storage. Furthermore app which are sign with the same key can share data.
If an application want to get special rights like reading or writing to calendar or contacts the user must accept it.
So by default it's a secure design. Unfortunately every system can have security issues, so that the system become corrupted. On Desktop-Systems regular updates are common practice. On the android it depends on the vendor and is except the Nexus mostly bad. So it could be that there are security holes open for a long period.
So how could an android phone be attacked?
Google can delete and install apps silently (Link). If someone hacks this mechanism, an attacker can install arbitrary apps on a device. Unsure if this app has automatically all rights it wants to have. This doesn't happens till now, but it's possible. You can only protect your phone by checking regularly all installed apps and there rights. This mechanism can be misused by a hacker.
Malicious applications can do a lot evil things, but if you don't give every app the rights the apps wanted and think a little bit, you can protect your phone.
Some security holes in the browser or the system allows an app to get root-access. In this case the app can do everything it wanted. I don't know any protection against this. As far as I know android has such security holes, so this is the most dangerous issue.
So in summary the only secure protection of data seems to be encryption. Depending on how secure your data must be with a default key or an individual key (in other words a password).
Some time ago I've found these PDF's, maybe they can help: slides, paper (more than 2 years old).
edit:
a new link for the slides
a new link for the paper
Google can delete and install apps silently. If someone hacks this mechanism, an attacker can install arbitrary apps on a device. Unsure if this app has automatically all rights it wants to have. This doesn't happens till now, but it's possible. You can only protect your phone by checking regularly all installed apps and there rights.
Delete may be silent, but the only push-install mechanism I know about is to use the firmware update mechanism, and that is not silent - the phone reboots twice.
Malicious applications can do a lot evil things, but if you don't give every app the rights the apps wanted and think a little bit, you can protect your phone.
Unfortunately, you cannot decline to grant permissions, you can only decline to install an app that requests more than you want to grant. And some permissions are quite broad, so an app may legitimately need a tiny part of some permission, but get the whole thing.
Some security holes in the browser or the system allows an app to get root-access. In this case the app can do everything it wanted. I don't know any protection against this. As far as I know android has such security holes, so this is the most dangerous issue.
On the other hand, these security holes are unfortunately what the owners of most devices must rely on in if they wish to to be able to install custom firmware, since most consumer phones were not designed to permit this. Knowledge about android security exploits is not much behind that of conventional linux distributions (most of the root exploit are inherited linux kernel exploits, not android exploits, since android has few components with root authority).
Related
I have a few questions about privacy protection on Android and iOS. I've looked at Android documentation, but as a beginner I am not sure if I understand correctly (I put my understanding in square brackets). Especially, not finding the obvious way does not mean there are no workarounds to get the same information. Therefore, could any developer give advice on the following questions? Answers about iOS are also appreciated.
Can the user allow an app to use the microphone/camera/location only once (i.e. the system should always ask the user every time this app needs access)? [No, the "never ask again" option in the dialog is not meant for this purpose.]
If microphone/camera/location permission is given to an app, can it access these while in background? [Yes.]
Is it possible for an app (running in foreground) to obtain the list of other apps currently running or installed on the device? [Yes for installed ones, not sure about currently running ones.]
Can an app in background know what other apps are currently running and which one is in foreground? Can it possibly figure out whether the user is using the phone? [Not sure.]
Can an app (apart from the OS itself) take screenshots? [No.]
With regards to Android:
Can the user allow an app to use the microphone/camera/location only once (i.e. the system should always ask the user every time this app needs access)?
Not directly. They could have this effect by granting the permission, using the app, then going into Settings and revoking the permission. I suspect that few people do this. Offering a one-time-use-only option directly in the runtime permission dialog is an interesting option, though I suspect that Google would pass on it as making the flow too complicated.
If microphone/camera/location permission is given to an app, can it access these while in background?
Locations, yes, though with some limits on Android 8.0+ (for power savings). Microphone/camera, yes, though reportedly no longer starting with Android P.
Is it possible for an app (running in foreground) to obtain the list of other apps currently running or installed on the device?
Installed, yes. Running, not really, on newer versions of Android.
Can an app in background know what other apps are currently running
See above.
and which one is in foreground?
Not really, on newer versions of Android.
Can it possibly figure out whether the user is using the phone?
You can tell if the screen is on. IMHO, "whether the user is using the phone" has lots of possible definitions.
Can an app (apart from the OS itself) take screenshots?
I do not know how you are drawing the distinction here. An app can request screenshots and screen recordings through the media projection APIs on Android 5.0+, though this involves user acceptance. This acceptance is a one-time-per-process thing, so the user would have to grant access again in the future (akin to what you were seeking for microphone/camera/location).
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 6 years ago.
Improve this question
I am new in computing. I have read that android is based on Linux OS.
And Linux rather any distro of UNIX is virus free.
Then my question is that what is the need of anti virus s/w's in Android phones??
Please correct if I am carrying wrong knowledge.
Thanks in advance.
You may be asking yourself, what if I have a cell phone virus and what is it anyway? You know you keep a lot of precious, valuable data on your phone, and when you hear in the news that mobile threats are on the rise, it’s easy to lose sight of the context behind the numbers and worry that you’ve gotten a dreaded mobile phone virus that’s going to steal your personal info and eat your children. Hopefully we can clarify things by addressing some of the questions that we hear most about so-called Android “viruses.”
Is there really such a thing as an Android virus?
Historically carried over from the old PC world, a “virus” is a program that replicates itself by attaching to another program. Hackers often used this method to spread their nefarious work, and virus became a popular term to refer to all types of malicious software (malware) on computers. In the case of smartphones, to date we have not seen malware that replicate itself like a PC virus can, and specifically on Android this does not exist, so technically there are no Android viruses. However, there are many other types of Android malware. Most people think of any malicious software as a virus, even though it is technically inaccurate.
So what is Android malware?
Malware, short for malicious software, is software designed to secretly control a device, steal private information or money from the device’s owner. Malware has been used to steal passwords and account numbers from mobile phones, put false charges on user accounts and even track a user’s location and activity without their knowledge. Learn about some of the most notable malware Lookout has blocked in Resources Top Threats.
How would I get malware on my phone?
Through Lookout’s research for the State of Mobile Security 2012, we’ve found that user behavior and geography greatly influence your risk of encountering malware. The safest bet is to stick with downloading well-known apps from well-known apps from reputable markets like Google Play in addition to having a security app. Fraudsters make it their job to disguise malware as innocent-looking mobile apps on app stores and websites. So if you’re thinking that it’s a good idea to download a just-published, supposedly free version of Angry Birds you found on a random Chinese app store, it’s probably not. Once installed, these apps may appear to work just as described, but they are can be busy with additional secret tasks. Some apps start out clean, but are given malicious capabilities after a seemingly routine software update.
And conscientious app downloading won’t always minimize your risk. Sneaky, drive-by-download sites can download a potentially malicious app file without any user intervention. Safe Browsing in Lookout Premium for Android will block web-based threats like that, but even so, you also shouldn’t install random downloads from your download manager that you didn’t expect to find there.
How can I protect myself and my mobile device?
It’s pretty simple to minimize the risk of encountering malware, and we’ve got 5 simple mobile security tips right here. The top two ways to protect yourself are to download a mobile security app like Lookout to catch those pesky “phone viruses” and to be judicious about what apps you download and were you download them from. Lookout will scour your phone or tablet for any existing malware, and also examine every new app you download to ensure it is safe. But even before you let Lookout scan your newly downloaded app, you should only download apps from sites you trust, check the ratings and read reviews to make sure they’re widely used and respected.
So, should you worry about getting a phone virus? Nope, because they technically don’t exist. (If they ever do crop up, Lookout will weed them out.) And should you worry about the more accurately termed malware? Well, with a little bit of awareness and Lookout on your phone and by your side, you can keep malware and other mobile threats at bay.
My application will be running on hundreds of android devices belonging to a single owner and I may need to modify the software as an update at some point.
I decided I should include a feature to check with the server for updates and download them, which is currently working.
Installing the update is the difficult part. I need it done automatically. Preferably with no user interaction since there are hundreds of devices and it would be very time consuming to do each one manually.
This is the problem, even with the device rooted, I can not find a generic way that each device can install the update without system specific information.
I have read questions like this but can not find a proper answer: Install Android APK without prompt
The bottom answer executes but I can find no installed app, so I assume it failed.
What you want to do is not possible without some serious hacks. A private app store might be a better fit.
If your client is a Google Apps user, you can create a private channel in the Play Store.
Distribute Android apps in your organization
If not, you will have to rely on third party solution like these one:
Apperian Mobile Application Management
ManageEngine Mobile Device Manager
I didn't try any of these, so you will have to do some research to check that they fit your needs
I'm currently developing a small Android app that will not be on the Play Store. It is a private business application that will be used for a non-emergency transport company. The Android app will show drivers a list of pickups and drop-offs that they will have throughout the day and allow them to update the status of those trips. What I'd like to do is have some method of updating the app during off hours or when the device is idle. Ideally, it would be great if someone has already written some kind of Android updater that can run as a service. However, I certainly wouldn't mind writing this on my own.
Either way, all it needs to do is pull an APK from our servers and install that APK. I usually don't like doing things sneaky like this, but our clients want it to be this way so that they won't have to go to each device and press OK on permission prompts and they don't want to leave the responsibility of updating the software to the drivers.
I understand the security concerns, but it seems to me that there should be some way to allow an app to auto-update itself if the user permits it. Also, our app is signed and includes a certificate on the device to verify that the downloaded app is legit.
As CommonsWare mentioned it's not supported by standard android. If you take the path of creating your own firmware and installer take a look at the existing PackageInstaller. The required changes are not so complicated.
I did it for a couple of custom versions and it works.
Either way, all it needs to do is pull an APK from our servers and install that APK. I usually don't like doing things sneaky like this, but our clients want it to be this way so that they won't have to go to each device and press OK on permission prompts and they don't want to leave the responsibility of updating the software to the drivers.
This is not possible, except via custom firmware or on a rooted device.
it seems to me that there should be some way to allow an app to auto-update itself if the user permits it.
You are welcome to build your own customized version of Android that has this capability. Stock Android does not offer this, except to the firmware itself.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 9 years ago.
Improve this question
I'am writing some small security report about Android devices in general related to accessing information from RAM.
Main condition is that device initially is non-rooted.
Use case:
User opens 3rd-party app, enters some password in password field. After that the device is lost with this running application. Source code of this application shows that this password information available in RAM while application is up and running. For example in class AllMyAppPasswords in public String myPassword. Now is the question about possible way to access this password info (correct me if I am wrong):
The way to access this pwd is to dump the memory.
For memory dump I need to have device to be rooted.
In order to root the device I need to unlock bootloader.
To achieve unlock bootloader and root operations it is requires that device needs to be rebooted at least once.
After device is rebooted the information about password is gone from RAM
Conclusion: It is not possible to get password residing in RAM memory from app if device is non-rooted. Is it correct?
Update to use case:
We assume that user just un-boxed new device and 100% sure that it is not rooted and not contain any keylogger apps. So user just installed my app, entered password, and application uses this password internally during run-time for periodically connecting the server (password only RAM, never stored on disk). So, visually there is nothing left in Edit text fields, info about password only in application memory for internal use, of course it is not possible just to read password text from the screen. Now user lost his phone. Should user concern about someone who found his phone can get this password info from RAM?
While not being a hands-on insider in this area, I will claim that I'm certainly interested above average, and here are my thoughts. Not meaning to say you don't potentially already know this, though.
Yes, Linux protects process memory from other regular users (with root not being a regular user).
I don't see why in the scenario you describe, the person who finds the phone would not simply bring the app in question to the foreground and have all confidetial information displayed, because your scenario already assumes that whoever finds the device can successfully unlock it, and that the app is still running.
I am however suspecting (inspired by your hypothetical AllMyAppPasswords class) that you are intending to build an argument similar to the following: If my "password safe" app starts and identifies that the device is not rooted, a reboot is required to change this fact, and since on a non-rooted device there is no way to access my app's memory, holding decrypted confidential information in RAM is safe. If this is along the lines of your intended rationale, I'd like to point your attention to the following aspects.
It is relatively easy to reverse engineer your code from your APK even if you apply a byte code obfuscator. This is especially true if someone out there decides that confidential information held in your app's memory is important enough for them. This means that everyone can relatively easy figure what to look for, once they gain access.
There are security holes both in Linux and in Java Virtual Machines, and the update strategy of the Android device vendors is not exactly transparent in this respect. In other words, there may be a way, direct or by combination of bugs, to either execute code in root context or with the user ID of your app even if the phone is not rooted.
Ways to root phones may change once your app has been published, so you may not be able to reliably identify a rooted phone.
Any encrypted data and the key must solely exist on a trusted server, or otherwise people will simply extract the key from your app and access the encrypted data stored on the Android device (if any) instead of trying to access app RAM.
All bets are off if someone has an Android device which allows for an in-circuit debugger to be connected, which would then theoretically allow for direct memory access without any software being aware of this. I'm not sure about the exact prerequisites for such a scenario and I also don't know which precautions individual manufacturers take in this respect.
I have somewhat widened the scope of your original question, but maybe there's still something useful in it for you. Even when sticking to your question word by word, I believe the security hole point really hurts, besides the fact that I'm unaware of any reliable (fully doubt-free, now and in future) way to identify a rooted device.
Direct hardware access may be out of scope for the security level you aim at or not, but I seem to recall that I read something about this recently.