How we’re serving to you repair vulnerabilities in your Android apps

Posted by Bessie Jiang – Software program Engineer and Chris Schneider – Safety Engineer

Contributors: Maciej Szawłowski – Safety Engineer, Hannah Barnes – Technical Program Supervisor, Dirk Göhmann – Technical Author, Patrick Mutchler – Software program Engineer

Safety is hard, however important to defending your customers and their information. We’re right here that will help you construct safe Android apps with fewer vulnerabilities for a good safer Android ecosystem for everyone.

Vulnerability Detection – The way it Works

Google at present scans each app on Google Play for dozens of widespread safety vulnerability lessons. If we spot one thing, we let you realize so you possibly can repair the issue. Think about a pentesting staff looking for bugs in every of the thousands and thousands of apps revealed on Play, rooting out points like unhealthy TLS configurations that expose community visitors or listing traversal vulnerabilities that permit adversaries learn from or write to an app’s non-public information.

We’re dedicated to retaining our joint customers protected. In severe instances, if a safety vulnerability does not get fastened, Google might take away the app from Google Play to maintain customers secure.

Android Software Safety Information Base

We all know that it isn’t all the time sufficient to simply inform you a couple of vulnerability in your app; it is advisable know learn how to repair the difficulty and learn how to stop related points from cropping up sooner or later. To this finish, we’re introducing our safety steerage and suggestions below a brand new program: the Android Software Safety Information Base (AAKB).

AAKB goals to determine pointers for writing safe Android software program. It’s a repository of widespread code points, with remediation examples and explanations for implementing particular code patterns. Natural in nature, new points are recognized mechanically for overview with consultants throughout the {industry} – guaranteeing broad however well-tested approaches and steerage.

Information collected out of your engagement with AAKB is used to enhance steerage, and to establish learn how to make the Android ecosystem safer by default.

How Does it Work?

AAKB establishes clear, vetted steerage with code examples. Steering is aligned to OWASP MASVS requirements, and content material is vetted in partnership with technical friends, reminiscent of Microsoft. This helps make sure the content material isn’t biased to at least one occasion and represents state-of-the-art requirements. This additionally gives an academic place so that you can proactively remediate safety dangers in your functions utilizing industry-wide requirements, with direct entry to information from subject-matter consultants.

The steerage is on the market by means of two mechanisms:

The AAKB homepage lists every article independently, aligned to the related OWASP MASVS class (e.g. MASVS-STORAGE). Anybody can view or present direct suggestions to this content material. Safety is an ever-changing area, and with the ability to replace steerage on the fly means software program growth lifecycles might be up to date dynamically with as little friction as doable.

Android Studio triggers remediation steerage from lint checks by pointing on to AAKB articles. You may repair issues as you are constructing the app and earlier than they ever attain customers.

There are two strategies to view remediation steerage with Android Studio:

Present safety lint checks inside Android Studio Giraffe+ have had their descriptions up to date to incorporate a hyperlink to the related AAKB article, permitting you get extra context as to why a selected code snippet could be probably “at-risk”.

Determine 1. Instance of a discovering with a hyperlink to a related AAKB article within the Android Studio IDE

In the meantime, the open-source Android Safety lint checks offer you entry to our most up-to-date steerage and experiments to additional defend your cellular functions and get forward of future safety considerations.

Add the open supply checks to your venture by following the README. These lint checks all include click-to-fix performance that make it simple so that you can write safer code with minimal effort, in addition to hyperlinks to the related AAKB articles just like the built-in IDE checks.

Determine 2. Instance of an open-source safety lint discovering, highlighting a weak code snippet and click-to-fix answer

All built-in IDE lint checks might be present in this checklist, with many below the Safety class containing hyperlinks to related AAKB articles. We might love to listen to your suggestions and ideas for brand new lint checks and different enhancements to the open-source lint library.