flâneur

Hiding Secrets in Android Apps

rammic.github.io · 2,341 words · saved by 1 readers

As a follow up on my somewhat incoherent rant about developers hiding passwords, keys, and other sensitive information in Android apps, I wanted to go through a semi-realistic example and explain the thought behind some of these strategies and why they may not be as effective as you might initially hope. While not a comprehensive review, we’ll take a look at the most common secret-stashing strategies (and how it can go wrong): To help illustrate some of these concepts, I created an example Android app on Github that we’ll analyze in this post. The full source code is available for review, but be sure to also take a look at the decompiled source. It’s important that you appreciate the perspective of both the developer and the reverse-engineer as you look for potential vulnerabilities. As an Android developer, your first instinct is probably to include any secrets, such as an API key, in your XML resources as you would with any other assets. We’ve done just that as well in our res/values

Hiding Secrets in Android Apps Sick of Acronyms Archive Pages Categories Tags Hiding Secrets in Android Apps 28 July 2015 As a follow up on my somewhat incoherent rant about developers hiding passwords, keys, and other sensitive information in Android apps , I wanted to go through a semi-realistic example and explain the thought behind some of these strategies and why they may not be as effective as you might initially hope. While not a comprehensive review, we’ll take a look at the most common secret-stashing strategies (and how it can go wrong): Embedded in strings.xml Hidden in Source Code

related reading