'SecureMe - Droid' Android Security Application by Vishal Asthana
•Download as PPTX, PDF•
1 like•534 views
OWASP Delhi October Meet - 'SecureMe - Droid' Android Security Application by Vishal Asthana
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (16)
Similar to 'SecureMe - Droid' Android Security Application by Vishal Asthana
Similar to 'SecureMe - Droid' Android Security Application by Vishal Asthana (20)
More from OWASP Delhi
More from OWASP Delhi (20)
Recently uploaded
Recently uploaded (20)
'SecureMe - Droid' Android Security Application by Vishal Asthana
- 2. About Us Security Consultant at Security Compass Inc. Active in… • Web, Mobile & Infrastructure Security • Research & Development, IoT (new!) • Quick-n-Dirty coder • Proud OSCP
- 3. About Us Director India Ops at Security Compass Inc. • Researching in SDLC and Agile Security • SafeCode TLC representative • Co-leading the Delhi chapters – Null (since March 2014) – OWASP (since June 2014) • Founder member of (ISC)² Delhi Chapter
- 7. • SMD: SecureMe – Droid • Android security application • Scan installed/updating apps • NVD CVE database as source SecureMe – Droid Overview
- 8. • No other app providing this feature • Some similar ideas: – Android OS security apps – Privacy apps http://cmuchimps.org/ – Trustable – Belarc Birth of SMD
- 9. SecureMe – Design Consideration
- 10. • Secure by Design – Minimum Android Permissions • Network Access • Boot Completed SecureMe – Design Consideration
- 11. • Secure by Design – Minimum Android Permissions • Network Access • Boot Completed – Not accessing sensitive data SecureMe – Design Consideration
- 12. • Secure by Design – Minimum Android Permissions • Network Access • Boot Completed – Not accessing sensitive data – Post scanning actions • Uninstall unsafe app • Update app using Google Play Store • Keep using app – Why not disable app? SecureMe – Design Consideration
- 13. • Secure by Design – Minimum Android Permissions • Network Access • Boot Completed – Not accessing sensitive data – Post scanning actions • Uninstall unsafe app • Update app using Google Play Store • Keep using app – Why not disable app? – Active over Mobile Data and WiFi SecureMe – Design Consideration
- 14. • App Scanning – Pre/Already installed apps – Just installed app – Updated app • Scan depth – Low, Normal, Medium – High, Intense • Scheduled Scan SecureMe Droid Internals
- 15. • Install SecureMe Droid – Google Play Store – Download from https://secureme.securitycompass.com/ SMD: Internals
- 16. • SecureMe Droid detects – New app installation – Existing app update – Scan any installed app • No sensitive information SMD: Internals (contd.)
- 17. • SecureMe Android Client and Server – HTTPS Communication • Find security issues: – NVD CVE database SMD: Internals (contd.)
- 18. • SecureMe Scan Results – App is safe – App is unsafe • Uninstall App • Keep App • Update app using Play Store SMD: Internals (contd.)
- 20. • Am I Vulnerable (AIV) • Re-branded to SecureMe – Droid (SMD) • AIV + ReBranding = SMD Where is AIV?
- 21. Demo Time
- 22. Conclusion • Fun side project • First ever conference acceptance and rollout • You MUST use it and provide feedback!
- 23. Abhineet Jayaraj Security Consultant Vishal Asthana Regional Director, India Operations THANK YOU! abhineet@securitycompass.com vishal@securitycompass.com W W W. S E C U R I T Y C O M PA S S . C O M
Editor's Notes
- Here we are to present SecureMe Droid
- Abhineet introduction
- Vishal introduction
- Vishal came up with this project so why don’t you share it with all.
- Vishal came up with this project so why don’t you share it with all.
- This is what we will be showing you today and this is what I want to happen in the end of this talk. Have SecureMe on all your Android devices.
- Light description of SMD and its purpose. CVE is a vendor agnostic and trustworthy database of vulnerabilities in products. Used in different domains of InfoSec.
- At the time of development we looked for any other app which might give similar functionality but couldn’t find any. Checked similar apps (from list) but not satisfied our need so SMD born.
- How many of the Android users are familiar with this image Battery app is trying to access my phone calls, send sms, etc
- It is coded in such a manner that the app uses least perms which helps in privacy and reducing attack surface. Secure by design: min perm, no sensitive info, post scanning modules, scan over wifi & mobile data
- Security by design: min perm, no sensitive info, post scanning modules, scan over wifi & mobile data
- 3 options for user to choose from. “Disable app” requires Device Admin permissions which we wanted to avoid asking for from user. Secure by Design.
- Android does not auto update apps over Mobile Data. It will notify user but not auto update. Security by design: min perm, no sensitive info, post scanning modules, scan over wifi & mobile data
- Helping secure the device by giving user option to uninstall the app right from SMD interface Scan depth setting for NVD CVE database. Low scanning depth will miss any past vulnerability. Setting has to be done by the user. Scheduled Scan for auto scanning and notifying user.
- Install SMD from mentioned locations.
- App data gathering and no sensitive information
- Secure client server communication. Check CVE database (already downloaded)
- Send scan results to user for action
- Putting it all together
- AIV and marketing and Nish
- Show SMD demo
- Conclude SMD talk
- Thank you and contact us