OReilly Application Security for the Android Platform (2012).pdf

(5644 KB) Pobierz
769347628.009.png
769347628.010.png
Application Security for the Android
Platform
Jeff Six
Beijing
Cambridge
Farnham
Köln
Sebastopol
Tokyo
•
•
•
•
•
769347628.011.png 769347628.012.png 769347628.001.png 769347628.002.png 769347628.003.png 769347628.004.png 769347628.005.png 769347628.006.png
 
Application Security for the Android Platform
by Jeff Six
Copyright © 2012 Jeff Six. All rights reserved.
Printed in the United States of America.
Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.
O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions
are also available for most titles ( http://my.safaribooksonline.com ) . For more information, contact our
corporate/institutional sales department: (800) 998-9938 or corporate@oreilly.com .
Editors: Andy Oram and Mike Hendrickson
Production Editor: Melanie Yarbrough
Proofreader: Melanie Yarbrough
Cover Designer: Karen Montgomery
Interior Designer: David Futato
Illustrator: Robert Romano
Revision History for the First Edition:
2011-12-02 First release
Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registered trademarks of
O’Reilly Media, Inc., Application Security for the Android Platform , the image of a red gunard, and related
trade dress are trademarks of O’Reilly Media, Inc.
Many of the designations used by manufacturers and sellers to distinguish their products are claimed as
trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a
trademark claim, the designations have been printed in caps or initial caps.
While every precaution has been taken in the preparation of this book, the publisher and authors assume
no responsibility for errors or omissions, or for damages resulting from the use of the information con-
tained herein.
ISBN: 978-1-449-31507-8
[LSI]
1322594274
Table of Contents
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii
1.
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Application Security: Why You Should Care
2
The Current State of Mobile Application Security on Android
3
Security: Risk = Vulnerability + Threat + Consequences
4
Evolution of Information Security: Why Applications Matter the Most
7
Your Role: Protect the Data
8
Secure Software Development Techniques
9
Unique Characteristics of Android
10
Moving On
12
2.
Android Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Introduction to the Android Architecture
14
The Linux Security Model
15
The Resulting Android Security Model
15
Application Signing, Attribution, and Attestation
16
Process Design
18
Android Filesystem Isolation
21
Android Preferences and Database Isolation
22
Moving up the Layers to System API and Component Permissions
24
3.
Application Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Android Permission Basics
27
Using Restricted System APIs and the User Experience
29
Custom Permissions
32
4.
Component Security and Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
The Types of Android Components
37
Intercomponent Signaling Using Intents
38
Public and Private Components
41
iii
769347628.007.png 769347628.008.png

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin