Google安全团队对Android安全的认识
作者 secwang | 2013-07-08 13:18 | 类型 BYOD, 行业动感 | 2条用户评论 »
[Google 原文] 看看google的攻城师对android安全的认识: 1、敏感数据通过权限保护,这些权限都会由权贵把持,要想使用就得申请。 2、码农的安全意识很重要 码农很努力了,可惜由于缺乏安全意识,可能导致数据泄露: - Storing personal data in a world-readable file 全局读文件。。。 - Exporting an unprotected content provider 组件导出,人人都可以访问。组件导出,容易被人滥用,造成权限代理攻击。 - Logging personal data in logcat logs 喜欢log。。 还要考虑邪恶的外部环境啊 - Insecure wireless networks 传输容易被窃取,最近连ssl都被人攻破了 - Lost and stolen devices 丢手机
3、用户证书 随便android 没有ios那样有严格的开发者证书,自己随便玩证书。但也要严肃点。 毕竟证书承载了不少内容。 1)、同样的签名可以共用UID 2)、软件升级的问题。 因此,为了安全起见,程序猿也要保护好自己的私钥!!!要不然被人窃取了,他可能会窃取你的应用信息哦。 4、android安全架构 android的安全架构主要有这样几部分: 1)、linux DAC机制,也就是RWX,还有些特殊的组ID控制,比如internet 比如open()都是kernel通过uid控制 2)、组件认证,通常是被调用的一方进行权限控制,比如调用系统能力可能有System_server鉴权,如果和另一个应用交互,那就由另一个应用鉴权。其实就是IPC认证 5、沙箱 应用都是存在于自己的沙箱。 但也要考虑2个问题: 1)、反射的问题,现在很多hook的技术最后都是通过反射和java层对接。很邪恶 2)、native code不是法外之地,无法绕开permission机制,但可以修改进程空间,也就是动态修改应用状态。 另外进程间通信也有一些保护手段: Intent filters---过滤而已 Permissions---就是摆设 Signatures-----真的有价值。共享签名的价值。 6、攻击入口 7、保护组件 Don't export app components unless you want other apps on the system to interact with your app 万不得已,不要到处。实在要到处,请下申请权限,而后共享签名控制(下面的最后一种)!!血泪教训 定义权限只是万里长征第一步,你定义了,别人申请即可,关键得签名控制! protectionLevel="normal" – A lower-risk permission that gives requesting applications access to isolated application-level features, with minimal risk to other applications, the system, or the user. This is the default protection level. 悄悄地干活,啥都不提示 protectionLevel="dangerous" – A higher-risk permission that would give a requesting application access to private user data or control over the device that can negatively impact the user. 就是提示,有啥用 protectionLevel="signature" – Can be used to limit access to components to only apps signed with the same certificate. 真正有价值的!
上述的权限控制都是你定义了,系统帮你控制验证,你自己也可以的,要自信点。 其实很多种方法(下面列的太少了) - Context.registerReceiver(…) can be used to register a BroadcastReceiver dynamically • There is a version of registerReceiver(…) which can be used to specify permission the broadcaster must hold for your dynamically-registered receiver to be invoked. - Context.checkCallingPermission(…) and Context.enforceCallingPermission(…) can be 自己验证 used in your source code to make sure the calling app holds the appropriate permission. This can be used to implement fine-grained permissions if needed. • Avoid the confused deputy problem:权限代理的问题,我申请了一个专利,也有学术界的论文提出解决防范,很简单就是一个 ∩!!! 下图说了,不申请权限要玩没门!!但申请了权限容易被一些屌丝杀软发现啊!!!肿么办!! - If your app is using its granted permissions to respond to another app, check that the calling app has that permission as well
那就找有这些权限的,同时有漏洞的。。就是提供接口的。。。 8、注意细节啊 1)debug android:debuggable 不要开启啊!!容易被人*** - Disabled by default - Never leave this enabled in release code! - Allows a user to debug your app - even without source code - Users with physical access can run code as your app and access your app's data 开启你的隐私之旅。。。run-as有不懂的吗? jlarimer-macbookair:~ jlarimer$ adb shell shell@android:/ $ run-as com.example.awesomeness sh shell@android:/data/data/com.example.awesomeness $ id uid=10060(app_60) gid=10060(app_60) shell@android:/data/data/com.example.awesomeness $ ls files/ secret_data.txt shell@android:/data/data/com.example.awesomeness $ cat files/secret_data.txt SECRETS! 2)、数据 Use MODE_PRIVATE for data files, shared preferences, and databases 保护自己的隐私,别全局读写啊 • openFileOutput(), openSharedPreferences(), and openOrCreateDatabase() create files in your app's private data directory External storage (sdcard) is shared storage sd卡没有权限控制,都可以读取,要存储三思啊,不行就加密啊!现在有很多开源加密库! encryptedMessage = Encrypt(K, "Login-OK=0") AlteredMessage = EncryptedMessage … XOR {…,0x31} Plaintext = Decrypt(K, AlteredMessage) = "Login-OK=1" 好码农 FileOutputStream fos = openFileOutput("private_data.txt", Context.MODE_PRIVATE); SharedPreferences prefs = getSharedPreferences("data", Context.MODE_PRIVATE); 女神对任何人都是开放的! FileOutputStream fos = openFileOutput("private_data.txt", Context.MODE_WORLD_WRITEABL SharedPreferences prefs = getSharedPreferences("data", Context.MODE_WORLD_READABLE); sd卡里面也不要存储程序哦: Don't store code libraries that are world writable or on external storage 容易被替换,除非你校验 - Don't store paths to code libraries in files that are world writable or on external storage 路径也一样 - Don't process data from writable files in native code - memory corruption vulnerabilities could allow apps to run arbitrary code with your app's ID C语言爱溢出啊!! • Don't store personal or protected data on external storage without user consent 9、无线链路的安全 现在屌丝太多,就喜欢在星巴克搞WIFI Hack。 很多中间人攻击手段! 如何防护: - HTTPS and SSL can protect against MitM attacks and prevent casual snooping 用https和ssl啊。但现在ssl在码农实现时存在太多的问题,详情看老王的书吧!比如Certificate pinning -比如 URL url = new URL("https://www.google.com/"); HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection(); 友情提示: Use cryptographic signing for any DEX or native code libraries that you load dynamically 这都是邪恶的软件才干的!远程下载APK、dex动态执行的 - Better yet, don't run code from the network 10、webview web的安全话题就大了。。。xss..... webview 中JavaScript is disabled by default。缺省是禁止的 addJavascriptInterface() is dangerous 你可以启用的。 - Avoid exposing protected or personal data to a JavaScript interface 既然放开了,就很难保证了,js和java就可以通信了,同时同源机制会被破坏。 - Server or network could be compromised, you can't trust the code - If you do use it, ensure that you're using HTTPS for the WebView 10、友情提示 不要滥用职权,人民不会宽恕的!!申请最小的权利即可!
Permissions aren't required if you launch an activity that has the permission 系统已有task了,就别再申请权限了,直接调用这些应用即可!google为啥不直接删除那些直接发短信的api。谁能告诉我!!! - Getting a picture from the camera // create Intent to take a picture and return control to the calling application没权限照样干!! Intent intent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE); // create a file to save the image fileUri = getOutputMediaFileUri(MEDIA_TYPE_IMAGE); // set the image file name intent.putExtra(MediaStore.EXTRA_OUTPUT, fileUri); // start the image capture Intent startActivityForResult(intent, MY_REQUEST_CO - Sending an SMS through the SMS app 没权照样发!!
Uri smsNumber = Uri.parse("sms:5551212"); Intent intent = new Intent(Intent.ACTION_VIEW); intent.setData(smsNumber); Permissions can be temporarily granted to apps by content providers - Letting the user pick a contact to share with your app 无需申请READ_CONTACTS啊!! Intent intent = new Intent(Intent.ACTION_GET_CONTENT); intent.setType(Phone.CONTENT_ITEM_TYPE); startActivityForResult(intent, MY_REQUEST_CODE); void onActivityResult(int requestCode, int resultCode, Intent data) { if (data != null) { Uri uri = data.getData(); if (uri != null) { try { Cursor c = getContentResolver().query(uri, new String[] { 11、trick Need a unique identifier? 唯一标示终端靠啥!老衲找了很多年,没找到!!下面的这些就更不靠谱了! – TelephonyManager.getDeviceId() requires READ_PHONE_STATE permission – Settings.Secure.ANDROID_ID doesn’t require a permission, but still not perfect To identify an installation of your app – Generate a UUID when your app starts and store it in shared preferences: – String id = UUID.randomUUID().toString(); – Use Android Backup Service to save the shared preferences to the cloud – See: https://developers.google.com/android/backup/ 12、设备管理 设备管理本来是为企业管理MDM而生,可竟然被一些宵小用来作恶!! 最近史上最牛的恶意软件也用了设备管理,而后利用一个注册漏洞,竟然藏起来了。。让用户无法卸载这儿妖孽!!! 企业管理器激活后有很多功能,可以设置pin码复杂度,锁屏,擦出数据等等,ios的这部分就更丰富了!! 大家可以自己体验一下,激活后可以去激活!有个漏洞就是没有显示在激活列表。不去激活的话,应用是无法卸载的!于是成了邪恶!
最后 Use Android Lint 希望google 更加努力。让程序猿更多的时间和女神在一起!不要纠结在bug上!但现在的功能太小儿科!
| |
雁过留声
“Google安全团队对Android安全的认识”有2个回复
支持楼主!
能把NativeClient很优雅的实现本身就是极大创新