Posted by Bessie Jiang – Software program Engineer and Chris Schneider – Safety Engineer
Contributors: Maciej Szawłowski – Safety Engineer, Hannah Barnes – Technical Program Supervisor, Dirk Göhmann – Technical Author, Patrick Mutchler – Software program Engineer
Safety is difficult, however important to defending your customers and their knowledge. We’re right here that will help you construct safe Android apps with fewer vulnerabilities for a fair safer Android ecosystem for everyone.
Vulnerability Detection – The way it Works
Google at the moment scans each app on Google Play for dozens of widespread safety vulnerability lessons. If we spot one thing, we let you recognize so you’ll be able to repair the issue. Think about a pentesting crew attempting to find bugs in every of the hundreds of thousands of apps printed on Play, rooting out points like dangerous TLS configurations that expose community visitors or listing traversal vulnerabilities that permit adversaries learn from or write to an app’s personal recordsdata.
We’re dedicated to conserving our joint customers protected. In severe circumstances, if a safety vulnerability does not get fastened, Google could take away the app from Google Play to maintain customers secure.
Android Utility Safety Information Base
We all know that it isn’t all the time sufficient to only inform you a couple of vulnerability in your app; you might want to know repair the difficulty and forestall comparable points from cropping up sooner or later. To this finish, we’re introducing our safety steerage and suggestions beneath a brand new program: the Android Utility Safety Information Base (AAKB).
AAKB goals to determine pointers for writing safe Android software program. It’s a repository of widespread code points, with remediation examples and explanations for implementing particular code patterns. Natural in nature, new points are recognized routinely for evaluate with consultants throughout the {industry} – making certain broad however well-tested approaches and steerage.
Information collected out of your engagement with AAKB is used to enhance steerage, and to determine make the Android ecosystem safer by default.
How Does it Work?
AAKB establishes clear, vetted steerage with code examples. Steering is aligned to OWASP MASVS requirements, and content material is vetted in partnership with technical friends, similar to Microsoft. This helps make sure the content material shouldn’t be biased to at least one occasion and represents state-of-the-art requirements. This additionally offers an academic place so that you can proactively remediate safety dangers in your functions utilizing industry-wide requirements, with direct entry to data from subject-matter consultants.
The steerage is obtainable via two mechanisms:
The AAKB homepage lists every article independently, aligned to the related OWASP MASVS class (e.g. MASVS-STORAGE). Anybody can view or present direct suggestions to this content material. Safety is an ever-changing discipline, and having the ability to replace steerage on the fly means software program growth lifecycles could be up to date dynamically with as little friction as potential.
Android Studio triggers remediation steerage from lint checks by pointing on to AAKB articles. You’ll be able to repair issues as you are constructing the app and earlier than they ever attain customers.
There are two strategies to view remediation steerage with Android Studio:
Present safety lint checks inside Android Studio Giraffe+ have had their descriptions up to date to incorporate a hyperlink to the related AAKB article, permitting you get extra context as to why a selected code snippet is likely to be probably “at-risk”.
In the meantime, the open-source Android Safety lint checks provide you with entry to our most up-to-date steerage and experiments to additional shield your cell functions and get forward of future safety considerations.
Add the open supply checks to your venture by following the README. These lint checks all comprise click-to-fix performance that make it simple so that you can write safer code with minimal effort, in addition to hyperlinks to the related AAKB articles just like the built-in IDE checks.
All built-in IDE lint checks could be present in this checklist, with many beneath the Safety class containing hyperlinks to related AAKB articles. We’d love to listen to your suggestions and solutions for brand spanking new lint checks and different enhancements to the open-source lint library.
