Advanced Android Security

#text-block-10 { margin-bottom:0px; text-align:left; }

IT security and secure coding

* Nature of security
* IT security related terms
* Definition of risk
* IT security vs. secure coding
* From vulnerabilities to botnets and cybercrime
* Classification of security flaws

Android security overview

* Android fragmentation challenges
* The Android software stack
* OS security features and exploit mitigation techniques
* The Linux kernel
* Filesystem security
* Dalvik
* Deploying applications

Application security

* Permissions
* Writing secure Android applications
* Digital Rights Management (DRM)
* Reverse engineering and debugging

Basics of cryptography

* Cryptosystems
* Symmetric-key cryptography
* Other cryptographic algorithms
* Asymmetric (public-key) cryptography
* Public Key Infrastructure (PKI)
* Cryptography on Android

#text-block-11 { margin-bottom:0px; text-align:left; }

Android native code security

* Buffer overflow possibilities in Android
* ARM architecture
* Buffer overflow on the stack
* Protection techniques – ASLR, XN, RELRO, …

Android and Java vulnerabilities

* Input validation
* SQL Injection
* Cross-Site Scripting (XSS)
* Improper use of security features
* Improper error and exception handling
* Code quality problems

Testing Android code

* Testing Android code
* Android Lint
* Android Lint – Security features
* Lint exercise
* PMD
* PMD exercise
* FindBugs
* FindBugs exercise

Advices and principles

* Matt Bishop’s principles of robust programming
* The security principles of Saltzer and Schroeder

Knowledge sources

* Secure coding sources – a starter kit
* Vulnerability databases