This document provides an overview of Android security from the ground up, covering key aspects like the CPU, bootloader, kernel, native user-space, framework, and updates. It discusses goals of protecting user data and system resources while providing application isolation. Key security features include a robust Linux kernel, mandatory application sandboxing, secure IPC, and application signing.
Android è un argomento di grande interesse nel mondo dell'informatica ma lavorare sulla piattaforma non è semplice.
Questo intervento avrà un taglio pratico e spiegherà come procurarsi gli strumenti per compilare un modulo kernel su android, come sviluppare un semplice modulo e come caricarlo sul dispositivo. Infine, si presenterà come creare un modulo più complesso usando delle API specifiche del kernel di Android.
I sorgenti del workshop sono reperibili qui:
https://github.com/arighi/mysuspend
Android è un argomento di grande interesse nel mondo dell'informatica ma lavorare sulla piattaforma non è semplice.
Questo intervento avrà un taglio pratico e spiegherà come procurarsi gli strumenti per compilare un modulo kernel su android, come sviluppare un semplice modulo e come caricarlo sul dispositivo. Infine, si presenterà come creare un modulo più complesso usando delle API specifiche del kernel di Android.
I sorgenti del workshop sono reperibili qui:
https://github.com/arighi/mysuspend
This paper attempts to look behind the wheels of android and keeping special focus on custom rom’s and basically check for security misconfiguration’s which could yield to device compromise, which may result in malware infection or data theft.
While Android’s use in mobile and embedded systems is now common, details about how to debug and develop in its internals are still hard to come by. This session will cover the tools, techniques and hacks that developers can use to debug difficult problems within the Android stack.
View this presentation on YouTube:
https://www.youtube.com/watch?v=vnoY9WwEwIc
Singularity: The Inner Workings of Securely Running User Containers on HPC Sy...inside-BigData.com
“Singularity is an open source container solution being developed specifically for HPC environments. With Singularity, HPC users can safely bring their own execution environments to the cluster. Unlike other container solutions,Singularity does not require root level permissions to run containers, which allows users to freely control what software stack they wish to use.Provisioning of a container image can be done locally on the user’s machine or on Singularity Hub. The resulting image can then be securely executed on any machine with Singularity installed. Reproduction of results has never been easier: a user can now share a single Singularity image file that will ensure a consistent execution environment wherever it is run.
This presentation will provide an in-depth look at how Singularity is able to securely run user containers on HPC systems. After a brief introduction to Singularity and its relationship to other container solutions, the details of Singularity’s runtime will be explored. The way that Singularity leverages Linux features such as namespaces, bind mounts, and SUID binaries will be discussed in further detail as well.”
The Ultimate Android Security Checklist (Mdevcon 2014)Ron Munitz
My session in Mdevcon, March 2014, Amsterdam, The Netherlands.
In this session I will present the essential security measures for Application Developers, show how to reverse engineer purely protected apps, and discuss what common security guidelines will and will not work against untrusted, rooted devices.
The session will include the confessions of an evil, yet good attacker, and will unleash some serious security flaws you have probably never considered in your app development.
For Training/Consulting requests: info@thepscg.com
The Ultimate Android Security Checklist (Codemotion Tel-Aviv, 2014)Ron Munitz
My Android Security session in Code Motion , December 2014, Tel-Aviv, Israel.
In this session I will present the essential security measures for Application Developers, show how to reverse engineer purely protected apps, and discuss what common security guidelines will and will not work against untrusted, rooted devices. The session will include the confessions of an evil, yet good attacker, and will unleash some serious security flaws you have probably never considered in your app development.
For Training/Consulting requests: info@thepscg.com
Ron Munitz - The Ultimate Android Security Checklist - Codemotion Rome 2015Codemotion
Ron Munitz - Codemotion Rome 2015
In this session I will present the essential security measures for Application Developers, show how to reverse engineer purely protected apps, and discuss what common security guidelines will and will not work against untrusted, rooted devices. The session will include the confessions of an evil, yet good attacker, and will unleash some serious security flaws you have probably never considered in your app development.
A talk presented at the Automotive Grade Linux All-Members meeting on September 8, 2015. The focus on why AGL should adopt systemd, and highlights two of the more difficult integration issues that may arise while doing so. The embedded SVG image, courtesy Marko Hoyer of ADIT, is at http://she-devel.com/2015-07-23_amm_demo.svg
Similar to Android Security, From the Ground Up (20)
In software engineering, the right architecture is essential for robust, scalable platforms. Wix has undergone a pivotal shift from event sourcing to a CRUD-based model for its microservices. This talk will chart the course of this pivotal journey.
Event sourcing, which records state changes as immutable events, provided robust auditing and "time travel" debugging for Wix Stores' microservices. Despite its benefits, the complexity it introduced in state management slowed development. Wix responded by adopting a simpler, unified CRUD model. This talk will explore the challenges of event sourcing and the advantages of Wix's new "CRUD on steroids" approach, which streamlines API integration and domain event management while preserving data integrity and system resilience.
Participants will gain valuable insights into Wix's strategies for ensuring atomicity in database updates and event production, as well as caching, materialization, and performance optimization techniques within a distributed system.
Join us to discover how Wix has mastered the art of balancing simplicity and extensibility, and learn how the re-adoption of the modest CRUD has turbocharged their development velocity, resilience, and scalability in a high-growth environment.
Unleash Unlimited Potential with One-Time Purchase
BoxLang is more than just a language; it's a community. By choosing a Visionary License, you're not just investing in your success, you're actively contributing to the ongoing development and support of BoxLang.
Providing Globus Services to Users of JASMIN for Environmental Data AnalysisGlobus
JASMIN is the UK’s high-performance data analysis platform for environmental science, operated by STFC on behalf of the UK Natural Environment Research Council (NERC). In addition to its role in hosting the CEDA Archive (NERC’s long-term repository for climate, atmospheric science & Earth observation data in the UK), JASMIN provides a collaborative platform to a community of around 2,000 scientists in the UK and beyond, providing nearly 400 environmental science projects with working space, compute resources and tools to facilitate their work. High-performance data transfer into and out of JASMIN has always been a key feature, with many scientists bringing model outputs from supercomputers elsewhere in the UK, to analyse against observational or other model data in the CEDA Archive. A growing number of JASMIN users are now realising the benefits of using the Globus service to provide reliable and efficient data movement and other tasks in this and other contexts. Further use cases involve long-distance (intercontinental) transfers to and from JASMIN, and collecting results from a mobile atmospheric radar system, pushing data to JASMIN via a lightweight Globus deployment. We provide details of how Globus fits into our current infrastructure, our experience of the recent migration to GCSv5.4, and of our interest in developing use of the wider ecosystem of Globus services for the benefit of our user community.
Your Digital Assistant.
Making complex approach simple. Straightforward process saves time. No more waiting to connect with people that matter to you. Safety first is not a cliché - Securely protect information in cloud storage to prevent any third party from accessing data.
Would you rather make your visitors feel burdened by making them wait? Or choose VizMan for a stress-free experience? VizMan is an automated visitor management system that works for any industries not limited to factories, societies, government institutes, and warehouses. A new age contactless way of logging information of visitors, employees, packages, and vehicles. VizMan is a digital logbook so it deters unnecessary use of paper or space since there is no requirement of bundles of registers that is left to collect dust in a corner of a room. Visitor’s essential details, helps in scheduling meetings for visitors and employees, and assists in supervising the attendance of the employees. With VizMan, visitors don’t need to wait for hours in long queues. VizMan handles visitors with the value they deserve because we know time is important to you.
Feasible Features
One Subscription, Four Modules – Admin, Employee, Receptionist, and Gatekeeper ensures confidentiality and prevents data from being manipulated
User Friendly – can be easily used on Android, iOS, and Web Interface
Multiple Accessibility – Log in through any device from any place at any time
One app for all industries – a Visitor Management System that works for any organisation.
Stress-free Sign-up
Visitor is registered and checked-in by the Receptionist
Host gets a notification, where they opt to Approve the meeting
Host notifies the Receptionist of the end of the meeting
Visitor is checked-out by the Receptionist
Host enters notes and remarks of the meeting
Customizable Components
Scheduling Meetings – Host can invite visitors for meetings and also approve, reject and reschedule meetings
Single/Bulk invites – Invitations can be sent individually to a visitor or collectively to many visitors
VIP Visitors – Additional security of data for VIP visitors to avoid misuse of information
Courier Management – Keeps a check on deliveries like commodities being delivered in and out of establishments
Alerts & Notifications – Get notified on SMS, email, and application
Parking Management – Manage availability of parking space
Individual log-in – Every user has their own log-in id
Visitor/Meeting Analytics – Evaluate notes and remarks of the meeting stored in the system
Visitor Management System is a secure and user friendly database manager that records, filters, tracks the visitors to your organization.
"Secure Your Premises with VizMan (VMS) – Get It Now"
Quarkus Hidden and Forbidden ExtensionsMax Andersen
Quarkus has a vast extension ecosystem and is known for its subsonic and subatomic feature set. Some of these features are not as well known, and some extensions are less talked about, but that does not make them less interesting - quite the opposite.
Come join this talk to see some tips and tricks for using Quarkus and some of the lesser known features, extensions and development techniques.
Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...Globus
The Earth System Grid Federation (ESGF) is a global network of data servers that archives and distributes the planet’s largest collection of Earth system model output for thousands of climate and environmental scientists worldwide. Many of these petabyte-scale data archives are located in proximity to large high-performance computing (HPC) or cloud computing resources, but the primary workflow for data users consists of transferring data, and applying computations on a different system. As a part of the ESGF 2.0 US project (funded by the United States Department of Energy Office of Science), we developed pre-defined data workflows, which can be run on-demand, capable of applying many data reduction and data analysis to the large ESGF data archives, transferring only the resultant analysis (ex. visualizations, smaller data files). In this talk, we will showcase a few of these workflows, highlighting how Globus Flows can be used for petabyte-scale climate analysis.
How to Position Your Globus Data Portal for Success Ten Good PracticesGlobus
Science gateways allow science and engineering communities to access shared data, software, computing services, and instruments. Science gateways have gained a lot of traction in the last twenty years, as evidenced by projects such as the Science Gateways Community Institute (SGCI) and the Center of Excellence on Science Gateways (SGX3) in the US, The Australian Research Data Commons (ARDC) and its platforms in Australia, and the projects around Virtual Research Environments in Europe. A few mature frameworks have evolved with their different strengths and foci and have been taken up by a larger community such as the Globus Data Portal, Hubzero, Tapis, and Galaxy. However, even when gateways are built on successful frameworks, they continue to face the challenges of ongoing maintenance costs and how to meet the ever-expanding needs of the community they serve with enhanced features. It is not uncommon that gateways with compelling use cases are nonetheless unable to get past the prototype phase and become a full production service, or if they do, they don't survive more than a couple of years. While there is no guaranteed pathway to success, it seems likely that for any gateway there is a need for a strong community and/or solid funding streams to create and sustain its success. With over twenty years of examples to draw from, this presentation goes into detail for ten factors common to successful and enduring gateways that effectively serve as best practices for any new or developing gateway.
Field Employee Tracking System| MiTrack App| Best Employee Tracking Solution|...informapgpstrackings
Keep tabs on your field staff effortlessly with Informap Technology Centre LLC. Real-time tracking, task assignment, and smart features for efficient management. Request a live demo today!
For more details, visit us : https://informapuae.com/field-staff-tracking/
Cyaniclab : Software Development Agency Portfolio.pdfCyanic lab
CyanicLab, an offshore custom software development company based in Sweden,India, Finland, is your go-to partner for startup development and innovative web design solutions. Our expert team specializes in crafting cutting-edge software tailored to meet the unique needs of startups and established enterprises alike. From conceptualization to execution, we offer comprehensive services including web and mobile app development, UI/UX design, and ongoing software maintenance. Ready to elevate your business? Contact CyanicLab today and let us propel your vision to success with our top-notch IT solutions.
Developing Distributed High-performance Computing Capabilities of an Open Sci...Globus
COVID-19 had an unprecedented impact on scientific collaboration. The pandemic and its broad response from the scientific community has forged new relationships among public health practitioners, mathematical modelers, and scientific computing specialists, while revealing critical gaps in exploiting advanced computing systems to support urgent decision making. Informed by our team’s work in applying high-performance computing in support of public health decision makers during the COVID-19 pandemic, we present how Globus technologies are enabling the development of an open science platform for robust epidemic analysis, with the goal of collaborative, secure, distributed, on-demand, and fast time-to-solution analyses to support public health.
First Steps with Globus Compute Multi-User EndpointsGlobus
In this presentation we will share our experiences around getting started with the Globus Compute multi-user endpoint. Working with the Pharmacology group at the University of Auckland, we have previously written an application using Globus Compute that can offload computationally expensive steps in the researcher's workflows, which they wish to manage from their familiar Windows environments, onto the NeSI (New Zealand eScience Infrastructure) cluster. Some of the challenges we have encountered were that each researcher had to set up and manage their own single-user globus compute endpoint and that the workloads had varying resource requirements (CPUs, memory and wall time) between different runs. We hope that the multi-user endpoint will help to address these challenges and share an update on our progress here.
Into the Box Keynote Day 2: Unveiling amazing updates and announcements for modern CFML developers! Get ready for exciting releases and updates on Ortus tools and products. Stay tuned for cutting-edge innovations designed to boost your productivity.
Advanced Flow Concepts Every Developer Should KnowPeter Caitens
Tim Combridge from Sensible Giraffe and Salesforce Ben presents some important tips that all developers should know when dealing with Flows in Salesforce.
How Recreation Management Software Can Streamline Your Operations.pptxwottaspaceseo
Recreation management software streamlines operations by automating key tasks such as scheduling, registration, and payment processing, reducing manual workload and errors. It provides centralized management of facilities, classes, and events, ensuring efficient resource allocation and facility usage. The software offers user-friendly online portals for easy access to bookings and program information, enhancing customer experience. Real-time reporting and data analytics deliver insights into attendance and preferences, aiding in strategic decision-making. Additionally, effective communication tools keep participants and staff informed with timely updates. Overall, recreation management software enhances efficiency, improves service delivery, and boosts customer satisfaction.
Prosigns: Transforming Business with Tailored Technology SolutionsProsigns
Unlocking Business Potential: Tailored Technology Solutions by Prosigns
Discover how Prosigns, a leading technology solutions provider, partners with businesses to drive innovation and success. Our presentation showcases our comprehensive range of services, including custom software development, web and mobile app development, AI & ML solutions, blockchain integration, DevOps services, and Microsoft Dynamics 365 support.
Custom Software Development: Prosigns specializes in creating bespoke software solutions that cater to your unique business needs. Our team of experts works closely with you to understand your requirements and deliver tailor-made software that enhances efficiency and drives growth.
Web and Mobile App Development: From responsive websites to intuitive mobile applications, Prosigns develops cutting-edge solutions that engage users and deliver seamless experiences across devices.
AI & ML Solutions: Harnessing the power of Artificial Intelligence and Machine Learning, Prosigns provides smart solutions that automate processes, provide valuable insights, and drive informed decision-making.
Blockchain Integration: Prosigns offers comprehensive blockchain solutions, including development, integration, and consulting services, enabling businesses to leverage blockchain technology for enhanced security, transparency, and efficiency.
DevOps Services: Prosigns' DevOps services streamline development and operations processes, ensuring faster and more reliable software delivery through automation and continuous integration.
Microsoft Dynamics 365 Support: Prosigns provides comprehensive support and maintenance services for Microsoft Dynamics 365, ensuring your system is always up-to-date, secure, and running smoothly.
Learn how our collaborative approach and dedication to excellence help businesses achieve their goals and stay ahead in today's digital landscape. From concept to deployment, Prosigns is your trusted partner for transforming ideas into reality and unlocking the full potential of your business.
Join us on a journey of innovation and growth. Let's partner for success with Prosigns.
Why React Native as a Strategic Advantage for Startup Innovation.pdfayushiqss
Do you know that React Native is being increasingly adopted by startups as well as big companies in the mobile app development industry? Big names like Facebook, Instagram, and Pinterest have already integrated this robust open-source framework.
In fact, according to a report by Statista, the number of React Native developers has been steadily increasing over the years, reaching an estimated 1.9 million by the end of 2024. This means that the demand for this framework in the job market has been growing making it a valuable skill.
But what makes React Native so popular for mobile application development? It offers excellent cross-platform capabilities among other benefits. This way, with React Native, developers can write code once and run it on both iOS and Android devices thus saving time and resources leading to shorter development cycles hence faster time-to-market for your app.
Let’s take the example of a startup, which wanted to release their app on both iOS and Android at once. Through the use of React Native they managed to create an app and bring it into the market within a very short period. This helped them gain an advantage over their competitors because they had access to a large user base who were able to generate revenue quickly for them.
2. 2
These slides are made available to you under a Creative Commons
Share-Alike 3.0 license. The full terms of this license are here:
https://creativecommons.org/licenses/by-sa/3.0/
Attribution requirements and misc., PLEASE READ:
● This slide must remain as-is in this specific location (slide #2),
everything else you are free to change; including the logo :-)
●
Use of figures in other documents must feature the below
“Originals at” URL immediately under that figure and the below
copyright notice where appropriate.
●
You are free to fill in the “Delivered and/or customized by” space
on the right as you see fit.
● You are FORBIDEN from using the default “About” slide as-is or
any of its contents.
(C) Copyright 2010-2014, Opersys inc.
These slides created by: Karim Yaghmour
Originals at: www.opersys.com/community/docs
Delivered and/or customized by
3. 3
About
● Author of:
● Introduced Linux Trace Toolkit in 1999
● Originated Adeos and relayfs (kernel/relay.c)
● Training, Custom Dev, Consulting, ...
4. 4
Android Security, From the
Ground Up
1. Goals and Features
2. Layers involved
3. CPU
4. Bootloader
5. Kernel
6. Native user-space
7. Framework
8. Updates
9. AppOpps
10.. Bottom line
5. 5
1. Goals and Features
● Goals:
● Protect user data
● Protect system resources (including the network)
● Provide application isolation
● Key Features:
● Robust security at the OS level through the Linux kernel
● Mandatory application sandbox for all applications
● Secure interprocess communication
● Application signing
● Application-defined and user-granted permissions
13. 13
5. Kernel
● Process isolation
● UID/GID
● Capabilities
● SELinux
● Misc. additions and features
14. 14
5.1. Process isolation
● Each process gets its own address space
● Processes can't see each others' memory
● Processes can't access the kernel's memory
● MUST use system calls to talk to kernel
15. 15
5.2. UID/GID
● Each process has a UID / GID
● Privileges granted to processes sharing UIDs
and GIDs
● Filesystem access
● Signals
● Tracing
● etc.
16. 16
5.3. Capabilities
● Root has a lot of power
● Sometimes only part of root privileged needed
● Use “man capabilities” to find out more
● Used by installd to drop out of root and keep
privileges.
17. 17
5.4. SELinux
● Linux has Discretionary Access Controls (DAC) by default.
● SELinux adds Mandatory Access Controls (MAC).
● Requires all process operations to be explicitly mapped
out.
● Unlisted operations are forbidden, even if you're root.
● Provides safe firewalling in case of privilege escalation.
20. 20
6.1. Filesystem partitions
● Each partition has different mount options
● RAM disk => Read-Only
● System image => Read-Only (unless update)
● Data image => Read-Write (specific user permissions needed)
● Cache => Read-Write
● Recovery => Not mounted by default
● Virtual filesystems (proc, sysfs, etc.)
● “sdcard” => Read-Write (world readable/writable)
● Directories and files have specific rights, see
system/core/include/private/android_filesystem_config.h
22. 22
6.3. /dev/*
● All devices accessed through device nodes
● Devices nodes have regular file permissions
● Entries created by ueventd
● App do NOT have access to most entries
23. 23
6.4. /dev/socket/*
● Unix domain sockets used native daemons and services:
srwrw system system 20140724 18:45 adbd
srwrw root inet 20140724 18:45 dnsproxyd
srw system system 20140724 18:45 installd
srwrw root system 20140724 18:45 mdns
srwrw root system 20140724 18:45 netd
srwrwrw root root 20140724 18:45 property_service
srwrwrw root root 20140724 18:45 qemud
srwrw root radio 20140724 18:45 rild
srwrw radio system 20140724 18:45 rilddebug
srwrw root mount 20140724 18:45 vold
srwrw root system 20140724 18:45 zygote
24. 24
6.5. Native daemons
● Some native daemons authenticate the requests they
get:
● sevicemanager
● init property service
● Some daemons shadow key system services:
● vold
● netd
● rild
● keystore
25. 25
6.6. installd
● Package Manager's “shadow”
● Starts as root
● Notifies kernel that it will drop out of root but wants to keep
capabilities.
● Changes UID to “install” user
● Sets caps kept as:
● DAC_OVERRIDE
● CHOWN
● SETUID
● SETGID
27. 27
7.1. Framework permissions
● Since apps can't access /dev/* entries, they
must talk to system services through Binder.
● Binder doesn't enforce security
● System services check for permissions on a
call-by-call basis.
● Package Manager is solicited to check
permissions.
● Ex: checkCallingOrSelfPermission()
28. 28
7.2. App signatures
● Apps must be signed by publisher
● Publishers are NOT authenticated
● There is NO certificate authority in this model
● Based on Java “keytool”
29. 29
7.3. Multi-human support
● Each user gets a region of UIDs
● Each gets entries in:
● /data/user
– Per-app data directories
● /data/system/users
– Per-user accounts DB
30. 30
7.4. Device administration
● API for BYOD
● Very limited
● Only good for password-strength enforcement
● Does not provide:
● Provisioning of apps
● Bulk configuration
31. 31
7.5. SEAndroid
● Mandatory access controls for Android
● Enforcing/non-enforcing: setenforce
● Not merged:
● Middle-ware MAC
32. 32
8. Updates
● OTA certs:
● platform: Phone, SystemUI, framework, etc.
● shared: Launcher2, Contacts, LatinIME, etc.
● media: Gallery, MediaProvider, etc.
● testkey: default key
● Default keys in: build/target/product/security
● Use of development/tools/make_key to
generate new keys.
33. 33
9. AppOps
● AppOps system service
● Introduced and the removed
● frameworks/base/core/java/com/android/interna
l/app/IAppOppsService.aidl
● packages/apps/Settings/AndroidManifest.xml
34. 34
10. Bottom line
● Strong built-in mechanisms
● but ...
● Dude, where's my “sudo apt-get update” / “sudo
apt-get upgrade”?
● No updates = No security
35. 35
References and Pointers
● http://source.android.com/devices/tech/security/
index.html
● http://seandroid.bitbucket.org