Android Security Essentials LiveLessons (Video Training) Review
I unintentionally watched all three hours of this video series in one sitting. The presenter hooked me and before I knew it, it was three hours later. It is a very fast paced tour of the security issues that can arise when using the Android platform. The tour is built around the Open Web Application Security Project (OWASP) top 10 Mobile Security Risks as a guideline.
The Open Web Application Security Project (OWASP) top 10 Mobile Security Risks are -
M1: Weak Server Side Controls
M2: Insecure Data Storage
M3: Insufficient Transport Layer Protection
M4: Unintended Data Leakage
M5: Poor Authorization and Authentication
M6: Broken Cryptography
M7: Client Side Injection
M8: Security Decisions Via Untrusted Inputs
M9: Improper Session Handling
M10: Lack of Binary Protections
It seems like every security consulting firm engagement I hear about lately finds one or two things that in some other context/environment would make them dangerous, tells you to fix them, and recommends you review the OWASP top ten lists. They get their check and say see you in 6 months.
I have seen companies blindly follow the directions given by a compliance/security audit that were a total waste of a lot of money on completely unwarranted requests. Everyone involved with approving and allowing them to be done should have been assessed for competency.
This type of thing happens a lot as technologies change. Web and mobile applications are not the same thing. To think you can simply hop from one to the other is nuts, and no, using HTML5 everywhere does not change that. This happens in more areas than just security, but with regards to security, although the high level types of attacks seem similar, the details of how they are carried out and what you need to do to protect your systems are not.
Luckily this video series drills in on the details of Android attacks. You won't walk away from this series a security expert, but you will walk away with an appreciation for how far hackers will go to get your data. You will also have a solid baseline understanding of the entire spectrum of the Open Web Application Security Project (OWASP) top 10 Mobile Security Risks, how they can be used to secure your android applications, and how hackers are going to attack your applications.
The presenter is engaging and easy to follow, there are a ton of demos, and all the material is very interesting. I would recommend this video series to anyone involved with an Android development project, but if you are a developer and you want to understand the details of what the presenter is talking about, you should have Android development experience. I say anyone can watch it, because even if you don't understand all the technical mumbo jumbo, you will understand how serious security should be taken, and what the end result will be if you don't.
Below is the description from the products web page. I simply pasted it below because I felt it was very accurate and it explains each lesson clearly.
You can check out previews and buy the series here.
Android applications make use of advanced hardware and software, as well as local and server data, exposed through the platform to bring innovation and value to consumers. To protect that value, the platform must offer an application environment that ensures the security of users, data, applications, the device, and the network. Securing an open platform requires a robust security architecture and rigorous security programs, as well as developers who are aware of the security issues that may come up.
Android Security Essentials LiveLessons alerts developers to the security issues that can arise when using the Android platform and guides them though solutions. Godfrey Nolan covers best practices for Android security by examining common security scenarios. Each lesson begins by presenting the concept behind the security problem at hand, with snippets of code introduced as the problem is explored. This is then followed by examination of code or demonstration of tools showing you how to implement the concepts presented.
Lesson 1: Android Security Basics
This lesson explains the problems with Android from a security perspective. We dive right in and show how to reverse engineer an Android APK to view its source as well as backup an APK’s data to see what runtime customer information is exposed. The lesson also introduces the OWASP Mobile top 10 risks from the Open Web Application Security Project which we cover detail in each lesson.
Lesson 2: Dealing with Insecure Data
Lesson 2 walks you through where runtime data is stored on the Android device, how to use Android file permissions to securely write data to an SD-card and also looks at how to write securely to a SQLite database.
Lesson 3: Weak Server Side Controls
This lesson deals with storing and securing data stored on backend web servers or in the cloud. You learn what the implications are of using remote servers for storing application data as well as how to secure the data.
Lesson 4: Insufficient Transport Layer Protection
This lesson builds on what we learned in Lesson 3. You learn how to perform a man-in-the-middle attack to see how insecure data is transmitted and how SSL can secure the traffic.
Lesson 5: Client Side Injection
Many Android apps are not 100% native and contain one or more HTML pages as webviews. Learn how to secure these hybrid apps by understanding how cross-site scripting and SQL injection are used to attack your web server.
Lesson 6: Poor Authorization
This lesson explains what the options are for logging in to an Android app, how they can be compromised and best practices for user authorization.
Lesson 7: Improper Session Handling
Building on Lesson 6, this lesson explains why mobile sessions are different from web sessions. Learn how to implement mobile sessions securely as well as use OAuth to log in to social media websites.
Lesson 8: Security Decisions via Untrusted Inputs
Learn how the Android framework manages communication between Android apps and how that can be exploited. Understand the principle of minimum Android manifest permissions and what permissions should be avoided.
Lesson 9: Side Channel Data Leakage
Android apps, probably more than other mobile platform, have a tendency to leak information in log files. In the past, third party libraries from advertising companies have also collected more customer information than they needed. In this lesson learn how to remove all logging for your production app and how to use proxy servers and decompilers to know exactly what your third party apps are collecting.
Lesson 10: Broken Cryptography
Learn what types of synchronous and asynchronous encryption can be used in Android apps, why it’s not a good idea to store the keys in the code or on the device, how to store the key using the NDK as well as encryption best practices using asynchronous techniques.
Lesson 11: Sensitive Information Disclosure
While Lesson 2 looked at the runtime information that may or may not be exposed, Lesson 11 looks at how developers are exposing information hard coded in the compiled application such as encryption keys and how this potentially exposes more customer information.
Lesson 12: Conclusion
In the final lesson we review the OWASP top 10 and use a tool from OWASP called GoatDroid that will help you get a better understanding of how to write more secure Android code.
You can check out previews and buy the series here.
The Open Web Application Security Project (OWASP) top 10 Mobile Security Risks are -
M1: Weak Server Side Controls
M2: Insecure Data Storage
M3: Insufficient Transport Layer Protection
M4: Unintended Data Leakage
M5: Poor Authorization and Authentication
M6: Broken Cryptography
M7: Client Side Injection
M8: Security Decisions Via Untrusted Inputs
M9: Improper Session Handling
M10: Lack of Binary Protections
It seems like every security consulting firm engagement I hear about lately finds one or two things that in some other context/environment would make them dangerous, tells you to fix them, and recommends you review the OWASP top ten lists. They get their check and say see you in 6 months.
I have seen companies blindly follow the directions given by a compliance/security audit that were a total waste of a lot of money on completely unwarranted requests. Everyone involved with approving and allowing them to be done should have been assessed for competency.
This type of thing happens a lot as technologies change. Web and mobile applications are not the same thing. To think you can simply hop from one to the other is nuts, and no, using HTML5 everywhere does not change that. This happens in more areas than just security, but with regards to security, although the high level types of attacks seem similar, the details of how they are carried out and what you need to do to protect your systems are not.
Luckily this video series drills in on the details of Android attacks. You won't walk away from this series a security expert, but you will walk away with an appreciation for how far hackers will go to get your data. You will also have a solid baseline understanding of the entire spectrum of the Open Web Application Security Project (OWASP) top 10 Mobile Security Risks, how they can be used to secure your android applications, and how hackers are going to attack your applications.
The presenter is engaging and easy to follow, there are a ton of demos, and all the material is very interesting. I would recommend this video series to anyone involved with an Android development project, but if you are a developer and you want to understand the details of what the presenter is talking about, you should have Android development experience. I say anyone can watch it, because even if you don't understand all the technical mumbo jumbo, you will understand how serious security should be taken, and what the end result will be if you don't.
Below is the description from the products web page. I simply pasted it below because I felt it was very accurate and it explains each lesson clearly.
You can check out previews and buy the series here.
Android applications make use of advanced hardware and software, as well as local and server data, exposed through the platform to bring innovation and value to consumers. To protect that value, the platform must offer an application environment that ensures the security of users, data, applications, the device, and the network. Securing an open platform requires a robust security architecture and rigorous security programs, as well as developers who are aware of the security issues that may come up.
Android Security Essentials LiveLessons alerts developers to the security issues that can arise when using the Android platform and guides them though solutions. Godfrey Nolan covers best practices for Android security by examining common security scenarios. Each lesson begins by presenting the concept behind the security problem at hand, with snippets of code introduced as the problem is explored. This is then followed by examination of code or demonstration of tools showing you how to implement the concepts presented.
Lesson 1: Android Security Basics
This lesson explains the problems with Android from a security perspective. We dive right in and show how to reverse engineer an Android APK to view its source as well as backup an APK’s data to see what runtime customer information is exposed. The lesson also introduces the OWASP Mobile top 10 risks from the Open Web Application Security Project which we cover detail in each lesson.
Lesson 2: Dealing with Insecure Data
Lesson 2 walks you through where runtime data is stored on the Android device, how to use Android file permissions to securely write data to an SD-card and also looks at how to write securely to a SQLite database.
Lesson 3: Weak Server Side Controls
This lesson deals with storing and securing data stored on backend web servers or in the cloud. You learn what the implications are of using remote servers for storing application data as well as how to secure the data.
Lesson 4: Insufficient Transport Layer Protection
This lesson builds on what we learned in Lesson 3. You learn how to perform a man-in-the-middle attack to see how insecure data is transmitted and how SSL can secure the traffic.
Lesson 5: Client Side Injection
Many Android apps are not 100% native and contain one or more HTML pages as webviews. Learn how to secure these hybrid apps by understanding how cross-site scripting and SQL injection are used to attack your web server.
Lesson 6: Poor Authorization
This lesson explains what the options are for logging in to an Android app, how they can be compromised and best practices for user authorization.
Lesson 7: Improper Session Handling
Building on Lesson 6, this lesson explains why mobile sessions are different from web sessions. Learn how to implement mobile sessions securely as well as use OAuth to log in to social media websites.
Lesson 8: Security Decisions via Untrusted Inputs
Learn how the Android framework manages communication between Android apps and how that can be exploited. Understand the principle of minimum Android manifest permissions and what permissions should be avoided.
Lesson 9: Side Channel Data Leakage
Android apps, probably more than other mobile platform, have a tendency to leak information in log files. In the past, third party libraries from advertising companies have also collected more customer information than they needed. In this lesson learn how to remove all logging for your production app and how to use proxy servers and decompilers to know exactly what your third party apps are collecting.
Lesson 10: Broken Cryptography
Learn what types of synchronous and asynchronous encryption can be used in Android apps, why it’s not a good idea to store the keys in the code or on the device, how to store the key using the NDK as well as encryption best practices using asynchronous techniques.
Lesson 11: Sensitive Information Disclosure
While Lesson 2 looked at the runtime information that may or may not be exposed, Lesson 11 looks at how developers are exposing information hard coded in the compiled application such as encryption keys and how this potentially exposes more customer information.
Lesson 12: Conclusion
In the final lesson we review the OWASP top 10 and use a tool from OWASP called GoatDroid that will help you get a better understanding of how to write more secure Android code.
You can check out previews and buy the series here.
posted by tadanderson at 7:48 AM
0 Comments:
Post a Comment
<< Home