1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
|
<html devsite>
<head>
<title>App Security Best Practices</title>
<meta name="project_path" value="/_project.yaml" />
<meta name="book_path" value="/_book.yaml" />
</head>
<body>
<!--
Copyright 2018 The Android Open Source Project
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
//www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<p>This section contains recommendations to ensure the security of apps on
Android devices.</p>
<h2 id="source-code-review">Source code review</h2>
<p>Source code review can detect a broad range of security issues, including
those identified in this document. Android strongly encourages both manual
and automated source code review.</p>
<ul>
<li>Follow comprehensive security guidance when conducting reviews to ensure
coverage. Utilize relevant internal or external standards to ensure
consistent and complete reviews.</li>
<li>Run a linter, such as the
<a href="https://developer.android.com/studio/write/lint"
class="external">Android Studio linter</a>, on all app code using the
Android SDK and correct any identified issues.</li>
<li>Analyze native code using an automated tool that can detect memory
management issues, such as buffer overflows and off-by-one errors.</li>
<li>The Android build system supports many of the LLVM sanitizers, such as
<a href="/devices/tech/debug/asan">AddressSanitizer</a> and
<a href="/devices/tech/debug/sanitizers#undefinedbehaviorsanitizer">UndefinedBehaviorSanitizer</a>,
which can be used for runtime analysis of memory-related issues. Combined
with fuzzing, supported in Android through
<a href="/devices/tech/debug/libfuzzer">libFuzzer</a>, sanitizers can
uncover unusual edge cases requiring further investigation.</li>
<li>A knowledgeable security assessor should review higher risk code, such as
crypto, payment processing, and PII processing.</li>
</ul>
<h2 id="automated-testing">Automated testing</h2>
<p>Automated testing can help detect a broad range of security issues and
should be performed regularly.</p>
<ul>
<li>Run the latest version of <a href="/compatibility/cts/">CTS</a> regularly
throughout the development process to detect problems early and reduce time
to correction. Android uses CTS as part of continuous integration in our
automated build process, which builds multiple times per day.</li>
<li>Automate security testing of interfaces, including testing with malformed
inputs (fuzz testing). Android's build system supports
<a href="/devices/tech/debug/libfuzzer">libFuzzer</a> for writing fuzz
tests.</li>
</ul>
<h2 id="vulnerability-scanning">Vulnerability scanning</h2>
<p>Vulnerability scanning can help ensure that pre-installed apps are free of
known security vulnerabilities. Advanced detection can reduce the time and
cost required with addressing these vulnerabilities and preventing risk to
users and devices.</p>
<ul>
<li>Scan all pre-installed apps using an industry-recognized app
vulnerability scanning tool and address detected vulnerabilities.</li>
</ul>
<h2 id="phas">Potentially Harmful Applications</h2>
<p>It is important to ensure that no pre-installed apps on your device are
accidental
<a href="/security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially
Harmful Applications</a> (PHAs). You are responsible for the behavior of
all apps that are included on your devices.</p>
<h3 id="hostile-downloaders">Hostile downloaders</h3>
<p>Hostile downloaders are apps that are not directly considered harmful but
instead download other potentially harmful apps.</p>
<ul>
<li>Ensure there is user disclosure for all pre-installed apps that use the
<code>INSTALL_PACKAGES</code> permission.</li>
<li>Ensure that the developer is contractually obligated not to install any
apps as UID 0.</li>
<li>Evaluate permissions declared in the manifest of all apps to
be installed through the developer's network.</li>
<li>Ensure that the developer is contractually obligated to scan all download
URLs of auto-updater and installer apps with
<a href="https://developers.google.com/safe-browsing/"
class="external">Google Safe Browsing API</a> before serving apps to
the device.</li>
<li>Starting with Android 9, require all developers to use
<code>UPDATE_PACKAGES</code> permission instead of the
<code>INSTALL_PACKAGES</code> permission. When combined with
<code>INSTALL_SELF_UPDATES</code>, using <code>UPDATE_PACKAGES</code>
allows privileged apps to be granted finely scoped install privileges based
on their intended usage instead of the more broad
<code>INSTALL_PACKAGES</code> permission.</li>
</ul>
<h3 id="cryptomining">Cryptomining</h3>
<p>Cryptomining apps are those that attempt to leverage a device's hardware or
cloud-based computing to generate currency in the form of "coins", typically
by way of blockchain technology. If you intend to offer this service as an
alternate form of currency or in exchange for services, ensure you request
the user's permission before leveraging the device's hardware to run this
service, including explicit consent that this will impact battery runtime.</p>
<h3 id="imposter-apps">Impostor apps</h3>
<p>Impostor apps are defined as ones that attempt to disguise themselves as a
well known app, such as YouTube or Facebook.</p>
<ul>
<li>Prior to device launch, scan all pre-loaded apps for vulnerabilities.</li>
</ul>
<h2 id="app-permissions">App permissions</h2>
<p>Excessive permissions for pre-installed apps can create a security
risk. Restrict pre-installed apps to the minimum necessary permissions and
ensure they don't have access to unnecessary permissions or privileges.</p>
<ul>
<li>Do not grant unnecessary permissions or privileges to pre-installed apps.
Thoroughly review apps with system privileges as they may have very
sensitive permissions.</li>
<li>Ensure that all permissions requested are relevant and necessary for the
functionality of that specific app.</li>
</ul>
<h2 id="app-signing">App signing</h2>
<p>App signatures play an important role in device security and are used for
permissions checks and software updates. When selecting a key to use for
signing apps, it is important to consider whether an app will be available
only on a single device or common across multiple devices.</p>
<ul>
<li>Ensure that apps are not signed with a key that is publicly known, such
as the AOSP developer key.</li>
<li>Ensure that keys used to sign apps are managed in a manner consistent
with industry-standard practices for handling sensitive keys, including an
hardware security module (HSM) that provides limited, auditable access.</li>
<li>Ensure that apps are not signed with the platform key. Doing so gives an
app access to platform signature permissions, which are very powerful and
only intended to be used by components of the operating system. System apps
should use privileged permissions.</li>
<li>Ensure that apps with the same package name are not signed with different
keys. This often occurs when creating an app for different devices,
especially when using the platform key. If the app is device-independent,
use the same key across devices. If the app is device-specific, create
unique package names per device and key.</li>
</ul>
<h2 id="isolating-apps-and-processes">Isolating apps and processes</h2>
<p>The Android <a href="/security/app-sandbox">sandboxing model</a>
provides extra security around apps and processes when used correctly.</p>
<h3 id="isolating-root-processes">Isolating root processes</h3>
<p>Root processes are the most frequent target of privilege escalation attacks;
reducing the number of root processes reduces risk of privilege escalation.</p>
<ul>
<li>Ensure that devices run the minimum necessary code as root. Where
possible, use a regular Android process rather than a root process. If a
process must run as root on a device, document the process in an AOSP
feature request so it can be publicly reviewed.</li>
<li>Where possible, root code should be isolated from untrusted data and
accessed via interprocess communication (IPC). For example, reduce root
functionality to a small Service accessible via Binder and expose the
Service with signature permission to an app with low or no privileges to
handle network traffic.</li>
<li>Root processes must not listen on a network socket.</li>
<li>Root processes must not include a general-purpose runtime, such as a Java
VM).</li>
</ul>
<h3 id="isolating-system-apps">Isolating system apps</h3>
<p>In general, pre-installed apps should not run with the shared system unique
identifier (UID). If it is necessary for an app to use the shared UID of
system or another privileged service (e.g., phone), the app should not export
any services, broadcast receivers, or content providers that can be accessed
by third-party apps installed by users.</p>
<ul>
<li>Ensure devices run the minimum necessary code as system. Where possible,
use an Android process with its own UID rather than reusing the system UID.</li>
<li>Where possible, system code should be isolated from untrusted data and
expose IPC only to other trusted processes.</li>
<li>System processes must not listen on a network socket. This is a CTS
requirement.</li>
</ul>
<h3 id="isolating-processes">Isolating processes</h3>
<p>The Android Application Sandbox provides apps with an expectation of
isolation from other processes on the system, including root processes and
debuggers. Unless debugging is specifically enabled by the app and the user,
no app should violate that expectation.</p>
<ul>
<li>Ensure root processes do not access data within individual app data
folders, unless using a documented Android debugging method.</li>
<li>Ensure root processes do not access memory of apps, unless using a
documented Android debugging method.</li>
<li>Ensure devices do not include any app that accesses data or memory of
other apps or processes.</li>
</ul>
</body>
</html>
|
