Posted by Bessie Jiang – Software program Engineer and Chris Schneider – Safety Engineer
Contributors: Maciej Szawłowski – Safety Engineer, Hannah Barnes – Technical Program Supervisor, Dirk Göhmann – Technical Author, Patrick Mutchler – Software program Engineer
Safety is difficult, however important to defending your customers and their information. We’re right here that can assist you construct safe Android apps with fewer vulnerabilities for a fair safer Android ecosystem for everyone.
Vulnerability Detection – The way it Works
Google presently scans each app on Google Play for dozens of widespread safety vulnerability lessons. If we spot one thing, we let so you possibly can repair the issue. Think about a pentesting staff attempting to find bugs in every of the tens of millions of apps printed on Play, rooting out points like dangerous TLS configurations that expose community visitors or listing traversal vulnerabilities that permit adversaries learn from or write to an app’s personal information.
We’re dedicated to retaining our joint customers protected. In critical instances, if a safety vulnerability would not get mounted, Google might take away the app from Google Play to maintain customers secure.
Android Utility Safety Information Base
We all know that it isn’t at all times sufficient to only inform you a couple of vulnerability in your app; it’s essential to know how one can repair the difficulty and how one can stop related points from cropping up sooner or later. To this finish, we’re introducing our safety steering and suggestions underneath a brand new program: the Android Utility Safety Information Base (AAKB).
AAKB goals to determine pointers for writing safe Android software program. It’s a repository of widespread code points, with remediation examples and explanations for implementing particular code patterns. Natural in nature, new points are recognized mechanically for assessment with specialists throughout the {industry} – making certain broad however well-tested approaches and steering.
Knowledge collected out of your engagement with AAKB is used to enhance steering, and to establish how one can make the Android ecosystem safer by default.
How Does it Work?
AAKB establishes clear, vetted steering with code examples. Steering is aligned to OWASP MASVS requirements, and content material is vetted in partnership with technical friends, akin to Microsoft. This helps make sure the content material isn’t biased to 1 social gathering and represents state-of-the-art requirements. This additionally offers an academic place so that you can proactively remediate safety dangers in your purposes utilizing industry-wide requirements, with direct entry to information from subject-matter specialists.
The steering is offered via two mechanisms:
The AAKB homepage lists every article independently, aligned to the related OWASP MASVS class (e.g. MASVS-STORAGE). Anybody can view or present direct suggestions to this content material. Safety is an ever-changing area, and having the ability to replace steering on the fly means software program improvement lifecycles may be up to date dynamically with as little friction as doable.
Android Studio triggers remediation steering from lint checks by pointing on to AAKB articles. You may repair issues as you are constructing the app and earlier than they ever attain customers.
There are two strategies to view remediation steering with Android Studio:
Present safety lint checks inside Android Studio Giraffe+ have had their descriptions up to date to incorporate a hyperlink to the related AAKB article, permitting you get extra context as to why a selected code snippet is perhaps doubtlessly “at-risk”.
In the meantime, the open-source Android Safety lint checks provide you with entry to our most up-to-date steering and experiments to additional defend your cell purposes and get forward of future safety issues.
Add the open supply checks to your venture by following the README. These lint checks all include click-to-fix performance that make it straightforward so that you can write safer code with minimal effort, in addition to hyperlinks to the related AAKB articles just like the built-in IDE checks.
All built-in IDE lint checks may be present in this checklist, with many underneath the Safety class containing hyperlinks to related AAKB articles. We’d love to listen to your suggestions and strategies for brand new lint checks and different enhancements to the open-source lint library.