Posted by Bessie Jiang – Software program Engineer and Chris Schneider – Safety Engineer
Contributors: Maciej Szawłowski – Safety Engineer, Hannah Barnes – Technical Program Supervisor, Dirk Göhmann – Technical Author, Patrick Mutchler – Software program Engineer
Safety is hard, however important to defending your customers and their knowledge. We’re right here that will help you construct safe Android apps with fewer vulnerabilities for a fair safer Android ecosystem for everyone.
Vulnerability Detection – The way it Works
Google presently scans each app on Google Play for dozens of widespread safety vulnerability lessons. If we spot one thing, we let you recognize so you possibly can repair the issue. Think about a pentesting crew looking for bugs in every of the thousands and thousands of apps revealed on Play, rooting out points like dangerous TLS configurations that expose community site visitors or listing traversal vulnerabilities that permit adversaries learn from or write to an app’s non-public information.
We’re dedicated to conserving our joint customers protected. In severe instances, if a safety vulnerability does not get fastened, Google could take away the app from Google Play to maintain customers protected.
Android Software Safety Data Base
We all know that it isn’t at all times sufficient to simply let you know a few vulnerability in your app; it’s essential to know find out how to repair the problem and find out how to stop comparable points from cropping up sooner or later. To this finish, we’re introducing our safety steering and suggestions below a brand new program: the Android Software Safety Data Base (AAKB).
AAKB goals to ascertain pointers for writing safe Android software program. It’s a repository of widespread code points, with remediation examples and explanations for implementing particular code patterns. Natural in nature, new points are recognized robotically for assessment with consultants throughout the {industry} – guaranteeing broad however well-tested approaches and steering.
Information collected out of your engagement with AAKB is used to enhance steering, and to establish find out how to make the Android ecosystem safer by default.
How Does it Work?
AAKB establishes clear, vetted steering with code examples. Steerage is aligned to OWASP MASVS requirements, and content material is vetted in partnership with technical friends, similar to Microsoft. This helps make sure the content material just isn’t biased to at least one celebration and represents state-of-the-art requirements. This additionally gives an academic place so that you can proactively remediate safety dangers in your functions utilizing industry-wide requirements, with direct entry to information from subject-matter consultants.
The steering is obtainable by two mechanisms:
The AAKB homepage lists every article independently, aligned to the related OWASP MASVS class (e.g. MASVS-STORAGE). Anybody can view or present direct suggestions to this content material. Safety is an ever-changing subject, and with the ability to replace steering on the fly means software program growth lifecycles might be up to date dynamically with as little friction as potential.
Android Studio triggers remediation steering from lint checks by pointing on to AAKB articles. You’ll be able to repair issues as you are constructing the app and earlier than they ever attain customers.
There are two strategies to view remediation steering with Android Studio:
Current safety lint checks inside Android Studio Giraffe+ have had their descriptions up to date to incorporate a hyperlink to the related AAKB article, permitting you get extra context as to why a selected code snippet is perhaps doubtlessly “at-risk”.
In the meantime, the open-source Android Safety lint checks offer you entry to our most up-to-date steering and experiments to additional defend your cellular functions and get forward of future safety considerations.
Add the open supply checks to your challenge by following the README. These lint checks all comprise click-to-fix performance that make it simple so that you can write safer code with minimal effort, in addition to hyperlinks to the related AAKB articles just like the built-in IDE checks.
All built-in IDE lint checks might be present in this listing, with many below the Safety class containing hyperlinks to related AAKB articles. We might love to listen to your suggestions and recommendations for brand spanking new lint checks and different enhancements to the open-source lint library.