Android Application Secure Design/Secure Coding Guidebook

499 Pages·2017·6.23 MB·English

by  Okuyama, Ken

Android Application
Secure Design/Secure Coding
Guidebook

August 29, 2022 Edition
Japan Smartphone Security Association（JSSEC）
Secure Coding Working Group

Document control number： JSSEC-TECA-SC-GD20220829B
※ 本ガイドの内容は執筆時点のものです。サンプルコードを使用する場合はこの点にあらかじめご注意ください。
※ JSSECならびに執筆関係者は、このガイド文書に関するいかなる責任も負うものではありません。全ては自己責任にてご活用ください。
※ Android™は、Google, Inc.の商標または登録商標です。また、本文書に登場する会社名、製品名、サービス名は、一般に各社の登録商標
または商標です。本文中では®、TM、© マークは明記していません。
※ この文書の内容の一部は、Google, Inc.が作成、提供しているコンテンツをベースに複製したもので、クリエイティブ・コモンズの表示 3.0
ライセンスに記載の条件に従って使用しています。
SecureCodingGuideDocumentation Release2022-08-29
Contents
1 Introduction 2
1.1 BuildingaSecureSmartphoneSociety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2 TimelyFeedbackonaRegularBasisThroughtheBetaVersion . . . . . . . . . . . . . . . . . . . 3
1.3 UsageAgreementoftheGuidebook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
ArticlesRevisedfromJanuary17,2022Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2 CompositionoftheGuidebook 5
2.1 Developer’sContext . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.2 SampleCode,RuleBook,AdvancedTopics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.3 TheScopeoftheGuidebook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.4 LiteratureonAndroidSecureCoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.5 StepstoInstallSampleCodesintoAndroidStudio . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3 BasicKnowledgeofSecureDesignandSecureCoding 21
3.1 AndroidApplicationSecurity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.2 HandlingInputDataCarefullyandSecurely . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4 UsingTechnologyinaSafeWay 32
4.1 Creating/UsingActivities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.2 Receiving/SendingBroadcasts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
4.3 Creating/UsingContentProviders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
4.4 Creating/UsingServices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
4.5 UsingSQLite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
4.6 HandlingFiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
4.7 UsingBrowsableIntent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
4.8 OutputtingLogtoLogCat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
4.9 UsingWebView . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
4.10 UsingNotifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
4.11 UsingSharedMemory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
5 HowtouseSecurityFunctions 334
5.1 CreatingPasswordInputScreens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
5.2 PermissionandProtectionLevel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
5.3 AddIn-houseAccountstoAccountManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383
5.4 CommunicatingviaHTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
5.5 Handlingprivacydata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438
5.6 UsingCryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
5.7 Usingbiometricauthenticationfeatures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
6 DifficultProblems 524
6.1 RiskofInformationLeakagefromClipboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524
i
SecureCodingGuideDocumentation Release2022-08-29
Revisionhistory 535
Publishedby . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538
AuthorsofJanuary172022Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539
AuthorsofOctober192021Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540
AuthorsofNovember1,2020Edition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541
AuthorsofSeptember12019Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542
AuthorsofSeptember1,2018Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543
AuthorsofFebruary1,2018Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544
AuthorsofFebruary1,2017Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545
AuthorsofSeptember1,2016Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 546
AuthorsofFebruary1,2016Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547
AuthorsofJune1,2015Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 548
AuthorsofJuly1,2014EnglishEdition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
AuthorsofApril1,2014EnglishEdition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550
AuthorsofApril1,2013JapaneseEdition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
AuthorsofNovember1,2012JapaneseEdition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
AuthorsofJune1,2012JapaneseEdition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
ii
SecureCodingGuideDocumentation Release2022-08-29
August29,2022Edition
JapanSmartphoneSecurityAssociation(JSSEC)
SecureCodingWorkingGroup
• The content of this guide is up to date as of the time of publication, but standards and environments are
constantlyevolving. Whenusingsamplecode,makesureyouareadheringtothelatestcodingstandardsand
bestpractices.
• JSSECandthewritersofthisguidearenotresponsibleforhowyouusethisdocument. Fullresponsibilitylies
withyou,theuseroftheinformationprovided.
• Android is a trademark or a registered trademark of Google Inc. The company names, product names and
servicenamesappearinginthisdocumentaregenerallytheregisteredtrademarksortrademarksoftheirre-
spectivecompanies. Further,theregisteredtrademark®,trademark(TM)andcopyright©symbolsarenot
usedthroughoutthisdocument.
• PartsofthisdocumentarecopiedfromorbasedoncontentcreatedandprovidedbyGoogle, Inc. Theyare
usedhereinaccordancewiththeprovisionsoftheCreativeCommonsAttribution3.0License
1
SecureCodingGuideDocumentation Release2022-08-29
1
Introduction
1.1 Building a Secure Smartphone Society
This guidebook is a collection of tips concerning the know-how of secure designs and secure coding for Android
applicationdevelopers. OurintentistohaveasmanyAndroidapplicationdevelopersaspossibletakeadvantageof
this,andforthatreasonwearemakingitpublic.
In recent years, the smartphone market has witnessed a rapid expansion, and its momentum seems unstoppable.
Its accelerated growth is brought on due to the diverse range of applications. An unspecified large number of key
functionsofmobilephonesthatwereoncenotaccessibleduetosecurityrestrictionsonconventionalmobilephones
havebeenmadeopentosmartphoneapplications. Subsequently,theavailabilityofvariedapplicationsthatwereonce
closedtoconventionalmobilephonesiswhatmakessmartphonesmoreattractive.
With great power that comes from smartphone applications comes great responsibility from their developers. The
defaultsecurityrestrictionsonconventionalmobilephoneshadmadeitpossibletomaintainarelativelevelofsecurity
evenforapplicationsthatweredevelopedwithoutsecurityawareness. Asithasbeenaforementionedwithregardto
smartphones,sincethekeyadvantageofasmartphoneisthattheyareopentoapplicationdevelopers,ifthedevelopers
designorcodetheirapplicationswithouttheknowledgeofsecurityissuesthenthiscouldleadtorisksofusers'personal
informationleakageorexploitationbymalwarecausingfinancialdamagesuchasfromillicitcallstopremium-rate
numbers.
Due to Android being a very open model allowing access to many functions on the smartphone, it is believed that
Android application developers need to take more care about security issues than iOS application developers. In
addition,responsibilityforapplicationsecurityisalmostsolelylefttotheapplicationdevelopers. Forexample,appli-
cationscanbereleasedtothepublicwithoutanyscreeningfromamarketplacesuchasGooglePlay(formerAndroid
Market),thoughthisisnotpossibleforiOSapplications.
Inconjunctionwiththerapidgrowthofthesmartphonemarket,therehasbeenasuddeninfluxofsoftwareengineers
fromdifferentareasinthesmartphoneapplicationdevelopmentmarket. As aresult, thereisan urgentcallforthe
sharingknowledgeofsecuredesignandconsolidationofsecurecodingknow-howforspecificsecurityissuesrelated
tomobileapplications.
Due to these circumstances, Japan's Smartphone Security Association (JSSEC) has launched the Secure Coding
Group, and by collecting the know-how of secure design as well as secure coding of Android applications, it has
decidedtomakealloftheinformationpublicwiththisguidebook. It isourintentionto raisethesecuritylevelof
many of the Android applications that are released in the market by having many Android application developers
becomeacquaintedwiththeknow-howofsecuredesignandcoding. Asaresult,webelievewewillbecontributing
tothecreationofamorereliableandsafesmartphonesociety.
2
SecureCodingGuideDocumentation Release2022-08-29
1.2 Timely Feedback on a Regular Basis Through the Beta Version
We,theJSSECSecureCodingGroup,willdoourbesttokeepthecontentcontainedintheGuidebookasaccurate
as possible, but we cannot make any guarantees. We believe it is our priority to publicize and share the know-
howinatimelyfashion. Equally,wewilluploadandpublicizewhatweconsidertobethelatestandmostaccurate
correct information at that particular juncture, and will update it with more accurate information once we receive
anyfeedbackorcorrections. Inotherwords,wearetakingthebetaversionapproachonaregularbasis. Wethink
thisapproachwouldbemeaningfulformanyoftheAndroidapplicationdeveloperswhoareplanningonusingthe
Guidebook.
ThelatestversionoftheGuidebookandsamplecodescanbeobtainedfromtheURLbelow.
• https://www.jssec.org/dl/android_securecoding_en.pdfGuidebook(English)
• https://www.jssec.org/dl/android_securecoding_en.zipSampleCodes(English)
ThelatestJapaneseversioncanbeobtainedfromtheURLbelow.
• https://www.jssec.org/dl/android_securecoding.pdfGuidebook(Japanese)
• https://www.jssec.org/dl/android_securecoding.zipSampleCodes(Japanese)
1.3 Usage Agreement of the Guidebook
TheusermustagreetothefollowingtwotermsandconditionswhenusingthisGuidebook.
1. ThisGuidebookmaycontaininaccuracies. Pleaseusethisinformationatyourownrisk.
2. IfyoufindanyerrorscontainedinthisGuidebook,pleasecontactusbye-mailusingthecontactinformation
below. Pleasenote,however,thatwecannotpromisetorespondtoyouortomakeanycorrections.
JapanSmartphoneSecurityAssociation(JSSEC)
ContactInformation
URLhttps://www.jssec.org/contact
3
SecureCodingGuideDocumentation Release2022-08-29
Articles Revised from January 17, 2022 Edition
Thissectioncontainstherevisionsthatwerefoundbycheckingthefactsagainstthepreviousversionofthearticle.
Eachrevisedarticleincorporatestheresultsofongoingresearchbytheauthorsaswellasawiderangeofvaluable
suggestions from readers. In particular, the suggestions that we received are the most important factors in making
thisrevisededitionamorepractical-orientedguidewithahigherdegreeofcompleteness.
Readerswhohavebeendevelopingappsbasedonthepreviousversionarerequestedtotakeaparticularlookatthe
list of revised articles below. The items listed here do not include corrections for typographical errors, changes in
organization,orsimpleimprovementsinwording.
Anycomments,opinions,orsuggestionsonthisGuidebookaregreatlyappreciated.
TableofRevisedArticles
Table1.3.1: RevisedArticles
Location revised in the Revisions in this re- Descriptionofrevision
January 17, 2022 edi- visededition
tion
(Notapplicable) 4.1.3.8. Blocking of Un- AddedanexplanationonblockingofintentsinAndroid
matchedIntents 13.
(Notapplicable) 4.2.3.8. Enhanced Safety Added an explanation on export settings for the dy-
ofDynamicBroadcastRe- namicbroadcastreceiverinAndroid13.
ceiver
(Notapplicable) 4.6.3.8. Media Collection AddedanexplanationonstoragebytargetscopeinAn-
PermissionsinAndroid13 droid13.
(APILevel33)
(Notapplicable) 4.10.3.4.RuntimePermis- Addedanexplanationonruntimepermissionsfornoti-
sionsforNotifications ficationsinAndroid13.
(Notapplicable) 5.2.3.10. Revoking Run- Addedanexplanationonrevokingruntimepermissions
timePermissions inAndroid13.
(Notapplicable) 5.2.3.11.Disablingshare- Added an explanation on the transition method of
dUserIdinNewlyInstalled sharedUserIdinAndroid13.
Apps
2.4. Literature on An- 2.4.LiteratureonAndroid Added links for OWASP MASVS and OWASP TOP
droidSecureCoding SecureCoding 10.
2.5. StepstoInstallSam- 2.5.StepstoInstallSample Added an explanation on the trusted location setting
ple Codes into Android CodesintoAndroidStudio methodwhenopeningasampleproject.
Studio
5.1.3.4. DisablingScreen 5.1.3.4. Disabling Screen Added the developer program policy for FLAG_SE-
Shot Shot CURE.
5.5.3.6. Location Infor- 5.5.3.6. Location Infor- AddedanexplanationonnewpermissionsfortheWi-Fi
mationAccess mationAccess APIs.
6.1.3.2. Operating In- 6.1.3.2. Usage of Infor- Added the new specifications for the content preview
formationStoredinClip- mation Stored in Clip- featurewhensetPrimaryClipisexecuted.
board board
4
SecureCodingGuideDocumentation Release2022-08-29
2
Composition of the Guidebook
2.1 Developer’s Context
Manyguidebooksthathavebeenwrittenonsecurecodingincludewarningsaboutharmfulcodingpracticesandtheir
suggestedrevisions. Althoughthisapproachcanbeusefulatthetimeofreviewingthesourcecodethathasalready
beencoded, itcanbeconfusingfordevelopersthatareabouttostartcoding, astheydonotknowwhicharticleto
referto.
TheGuidebookhasfocusedonthedeveloper’scontextof“Whatisadevelopertryingtodoatthismoment?” Equally,
wehavetakenstepstopreparearticlesthatarealignedwiththedeveloper’scontext. Forexample,wehavedivided
articlesintoprojectunitsbypresumingthatadeveloperwillbeinvolvedinoperationssuchas"Creating/UsingAc-
tivities","UsingSQLite",etc.
We believe that by publishing articles that support the developer’s context, developers will be able to easily locate
necessaryarticlesthatwillbeinstantlyusefulintheirprojects.
2.2 Sample Code, Rule Book, Advanced Topics
Eacharticleiscomprisedofthreesections: SampleCode,RuleBook,andAdvancedTopics. Ifyouareinahurry,
pleaselookuptheSampleCodeandRuleBooksections. Thecontentisprovidedinawaywhereitcanbereusedto
acertaindegree. Forthosewhohaveissuesthatgobeyondthese,pleaserefertheAdvancedTopicssection. Wehave
givendescriptionsthatwillbehelpfulinfindingsolutionsforindividualcases.
Unlessitisspecificallynoted,ourfocusofdevelopmentwillbetargetedtoplatformsconcerningAndroid4.0.3(API
Level15)andlater. SincewehavenotverifiedtheoperationalcapabilityofanyversionspertainingtoAndroidversions
under4.0.3(APILevel15),themeasuresdescribedmayproveineffectiveontheseoldersystems. Inaddition,even
forversionsthatarecoveredunderthescopeoffocus,itisimportanttoverifytheiroperationalcapabilitybytesting
themonyourownenvironmentbeforereleasingthempublically.
Also,forthesamplecodepresentedinthisdocument,settargetSdkVersiontoAPIlevel30orhigher. Thisisused
tocomplywiththefollowingrequirementsspecifiedbyGoogle.
• August2021: NewappsarerequiredtotargetAPIlevel30(Android11)orhigher.
• November2021: UpdatestoexistingappsarerequiredtotargetAPIlevel30orhigher.
• Fromthenon,appswillcontinuetoberequiredtotargetthelatestAPIlevels.
5
SecureCodingGuideDocumentation Release2022-08-29
2.2.1 Sample Code
Samplecodethatservesasthebasicmodelwithinthedeveloper'scontextandfunctionsasthethemeofanarticleis
publishedintheSampleCodesection. Iftherearemultiplepatterns,wehaveprovidedsourcecodeforthedifferent
patterns and classified them accordingly. We have strived to make our commentaries as simple as possible. For
example,whenwewanttodirectthereader'sattentiontoasecurityissuethatrequiresattention,abullet-pointnumber
willappearnextto"Point"inthearticle. Wewillalsocommentonthesamplecodethatcorrespondstothebullet-
point number by writing "*** Point (Number) ***." Please note that a single point may correspond to multiple
piecesofsamplecode. Therearesectionsthroughouttheentiresourcecode,albeitverylittlecomparedtotheentire
code,whichrequiresourattentionforsecurity. Inordertobeabletosurveythesectionsthatcallforscrutiny,wetry
toposttheentireclassunitofsamplecode.
PleasenotethatonlyaportionofsamplecodeispostedintheGuidebook. Acompressedfile, whichcontainsthe
entiresamplecode,ismadepublicintheURLlistedbelow. ItismadepublicbytheApacheLicense,Version2.0;
therefore,pleasefeelfreetocopyandpasteit. Pleasenotethatwehaveminimizedthecodeforerrorprocessingin
thesamplecodetopreventitfrombecomingtoolong.
• https://www.jssec.org/dl/android_securecoding_en.zipSampleCodesArchive
Theprojects/keystorefilethatisattachedinthesamplecodeisthekeystorefilethatcontainsthedeveloperkeyforthe
signatureoftheAPK.Thepasswordis"android."PleaseuseitwhensingingtheAPKintheIn-housesamplecode.
We have provided the keystore file, debug.keystore, for debugging purposes. When using Android Studio for de-
velopment, it is convenient for verifying the operational capability of the In-house sample code if the keystore is
setforeachproject. Inaddition, forsamplecodethatiscomprisedofmultipleAPKs, itisnecessarytomatchthe
android:debuggable setting contained inside each AndroidManifest.xml in order to verify the cooperation between
eachAPK.Iftheandroid:debuggablesettingisnotexplicitsetwheninstallingtheAPKfromAndroidStudio,itwill
automaticallybecomeandroid:debuggable="true."
For embedding the sample code as well as keystore file into Android Studio, please refer to "2.5. Steps to Install
SampleCodesintoAndroidStudio".
2.2.2 Rule Book
Rulesandmattersthatneedtobeconsideredregardingsecuritywithinthedeveloper'scontextwillbepublishedin
theRuleBooksection. Rulestobehandledinthatsectionwillbelistedinatableformatatthebeginningandwill
bedividedintotwolevels: "Required"and"Recommended."Theruleswillconsistoftwotypesofaffirmativeand
negativestatements. Forexample,anaffirmativestatementthatexpressesthataruleisrequiredwillsay"Required."
Anaffirmativestatementthatexpressesarecommendationwillsay"Recommended."Foranegativestatementthat
expresses the requisite nature of the rule would say, "Definitely not do." For a negative sentence that expresses a
recommendationwouldsay, "Notrecommended."Sincethesedifferentiationsoflevelsarebasedonthesubjective
viewpointoftheauthor,itshouldonlybeusedasapointofreference.
SamplecodethatispostedintheSampleCodesectionreflecttheserulesandmattersthatneedtobeconsidered,and
adetailedexplanationonthemisavailableintheRuleBooksection. Furthermore,rulesandmattersthatneedtobe
consideredthatarenotdealtwithintheSampleCodesectionarehandledintheRuleBooksection.
2.2.3 Advanced Topics
Itemsthatrequireourattention,butthatcouldnotbecoveredintheSampleCodeandRuleBooksectionswithinthe
developer'scontextwillbepublishedintheAdvancedTopicssection. TheAdvancedTopicssectioncanbeutilized
to explore ways to solve separate issues that could not be solved in the Sample Code or Rule Book sections. For
example,subjectmattersthatcontainpersonalopinionsaswellastopicsonthelimitationsofAndroidOSinrelation
thedeveloper'scontextwillbecoveredintheAdvancedTopicssection.
Developersarealwaysbusy. Manydevelopersareexpectedtohavebasicknowledgeofsecurityandproducemany
Android applications as quickly as possible in a somewhat safe manner rather than to really understand the deep
security matters. However, there are certain applications out there that require a high level of security design and
implementation from the beginning. For developers of such applications, it is necessary for them to have a deep
understandingconcerningthesecurityofAndroidOS.
6