This document discusses the risks of using mobile SDKs in apps. It notes that apps on average contain 57-60 SDKs from third parties, adding significant code that developers are responsible for but did not write. SDKs can pose security, privacy, and quality risks if they access sensitive permissions or system resources without the user's knowledge. The document provides examples of SDKs automatically granting themselves permissions or loading code in the background. It recommends that developers carefully audit the SDKs used in their apps and remove unused permissions to reduce security and privacy risks for users.

1. MOBILE SDKS: USE WITH CAUTION
Ori Lentzitzky
ori@safedk.com Ori Lentzitzky@orilentzorilentz

2. safedk.com
AVERAGE OF
SDKS IN APPS

3. safedk.com
WinIt
58 SDKs
Wishbone
60 SDKs
Destiny
57 SDKs

4. safedk.com

5. safedk.com
POPULAR SDKs CATEGORIES

6. safedk.com
FIREBASE & CRASH REPORTING

7. CHECK OUT YOUR APP OR SIMILAR APPS
safedk.com

8. safedk.com
That’s all fine and dandy...
So what’s the problem?

9. IT IS SOMEONE ELSE’S CODE INSIDE YOURS
YET YOU ARE RESPONSIBLE FOR IT…
WHY IS IT A PROBLEM?
safedk.com

10. WHY ARE SDKS RISKY ?
SECURITY & PRIVACY
safedk.com

11. if (context.checkCallingOrSelfPermission(
"android.permission.ACCESS_FINE_LOCATION")) {
Location userLocation =
locationManager.getLastKnownLocation("gps");
}
if (hasEmailPermission()) {
Pattern emailPattern = Patterns.EMAIL_ADDRESS;
Account[] accounts =
AccountManager.get(this.mContext).getAccounts();
…
}
THE DARK SIDE OF SDK PERMISSIONS
safedk.com

12. SDKs & PERMISSIONS: WHAT THEY DON’T TELL YOU
safedk.com
60.94%
15.31%
13.30%
10.87%
5.01% 4.01% 3.58% 3.29%
0.72%
0.00%
10.00%
20.00%
30.00%
40.00%
50.00%
60.00%
70.00%
Network Files Phone
State
Location Wake Lock Pim Camera Microphone In App
Purchase
• 16.59% of SDKs access
the list of installed apps.
• 9.3% of SDKs access
Accounts.
• 5.86% of SDKs access
Microphone.

13. I KNOW WHAT YOUR SDKs DID LAST SUMMER
safedk.com

14. BAD NEWS FROM BADNEWS
safedk.com

15. BAD NEWS FROM BADNEWS: HOW IT WORKED
safedk.com
App uploaded to Play Store
App passed Google checks:
no malware
Users download
the app
BadNews sets up a service
on the device
Device polls BadNews’ C&C
server every 4 hours
Server responds with
malicious data
And voila!
Device is infected
with malware

16. NOT TO WORRY, I CAN PROTECT MYSELF
safedk.com
if (myCoolAwesomeConfiguration.isEnabled(SOME_SDK_KEY)) {
new SomeSDK().init(SOME_SDK_KEY);
}

17. OOPS…
safedk.com
<receiver android:name="com.somesdk.sdk.BigMajorReceiver">
<intent-filter>
<action android:name="android.intent.action.BOOT_COMPLETED"/>
<action android:name="android.intent.action.USER_PRESENT"/>
<action android:name=" android.intent.action. ACTION_POWER_CONNECTED"/>
</intent-filter>
</receiver>

18. safedk.com

19. AARs: SELF-GRANTING PERMISSIONS
safedk.com
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.google.android.gms.analytics">
<uses-sdk android:minSdkVersion="9"/>
<!-- Include required permissions for Analytics to run. -->
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<!-- Optional permission for Analytics to run. -->
<uses-permission android:name="android.permission.WAKE_LOCK"/>
<application />
</manifest>
* Google Play Analytics, v9.4.0

20. JUST SAY NO!
safedk.com
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.mine.myawesomeapp">
<uses-permission
android:name="android.permission.WAKE_LOCK" tools:node=“remove”/>
</manifest>

21. safedk.com
ANDROID DEX AND THE METHOD COUNT

22. safedk.com
164,796
Methods
134,313
Methods 159,717
Methods
WinIt
58 SDKs
Wishbone
60 SDKs
Destiny
57 SDKs

23. safedk.com
THE GOOGLE PLAY SERVICES EXAMPLE
• Google offers its own SDK for Android with
plenty of wonderful features and capabilities...
.........
• Adds many methods
~ 44K methods

24. THE CONSEQUENCES OF MULTIDEXING
Slower Compilation Slower Start Time
safedk.com

25. LOLLIPOP TO THE RESCUE
Slower compilation Slower Start Time
safedk.com

26. WHY ARE SDKS RISKY ?
SECURITY & PRIVACY QUALITY OF SERVICE
safedk.com

27. WHO’S SLOWING YOU DOWN?
safedk.com

28. safedk.com
Start Time: 1
3 𝐴𝑝𝑝 + 2
3 𝑆𝐷𝐾𝑠

29. safedk.com
Start Time: 2ND TIME’S THE CHARM?

30. safedk.com
LETS LOOK INSIDE THE APK…
What’s this?
Additional code.
When is it loaded?

31. safedk.com
WHO’S CRASHING YOUR PARTY?

32. MAIN CRASH REASONS
 Out of Memory
 Null Pointer Exceptions…
 Concurrency & Threads
 Views & Layouts
 Permissions Mishap
safedk.com

33. KEEPING UP WITH THE ANDROIDS
safedk.com

34. SO ARE SDKs THE ENEMY?
safedk.com

35. SO ARE SDKs THE ENEMY?
safedk.com

36. safedk.com
When throwing a great party, be careful of any
guests that might spike the punch

37. THANK YOU!
WWW.SAFEDK.COM
ori@safedk.com Ori Lentzitzky@orilentzorilentz