Entries Tagged as 'Tools'

An Enhanced Tool for Securing Android Apps

Android , Secure Coding , Tools No Comments »

By Lori Flynn
Member of the Technical Staff
CERT Secure Coding Team

This blog post was co-authored by Will Klieber.

flynn_loriEach software application installed on a mobile smartphone, whether a new app or an update, can introduce new, unintentional vulnerabilities or malicious code. These problems can lead to security challenges for organizations whose staff uses mobile phones for work. In April 2014, we published a blog post highlighting DidFail (Droid Intent Data Flow Analysis for Information Leakage), which is a static analysis tool for Android app sets that addresses data privacy and security issues faced by both individual smartphone users and organizations. This post highlights enhancements made to DidFail in late 2014 and an enterprise-level approach for using the tool.

Read more...

Two Secure Coding Tools for Analyzing Android Apps

Android , Secure Coding , Tools No Comments »

By Will Klieber 
Member of the Technical Staff 
CERT Division 

This blog post was co-authored by Lori Flynn

Will KlieberAlthough the Android Operating System continues to dominate the mobile device market (82 percent of worldwide market share in the third quarter of 2013), applications developed for Android have faced some challenging security issues. For example, applications developed for the Android platform continue to struggle with vulnerabilities, such as activity hijacking, which occurs when a malicious app receives a message (in particular, an intent) that was intended for another app but not explicitly designated for it. The attack can result in leakage of sensitive data or loss of secure control of the affected apps. Another vulnerability is exploited when sensitive information is leaked from a sensitive source to a restricted sink. This blog post is the second in a series that details our work to develop techniques and tools for analyzing code for mobile computing platforms. (A previous blog post, Secure Coding for the Android Platform, describes our team’s development of Android rules and guidelines.)

Read more...