Android Security – Insecure Storage & Network Analysis
GitHubConducted deep-dive security research into Android application vulnerabilities, focusing on insecure data persistence and network communication flaws.
Overview
A comprehensive vulnerability assessment of a vulnerable Android application, demonstrating how attackers extract hardcoded secrets, bypass SSL pinning, and exploit insecure local storage, followed by the implementation of secure mitigations.
The Problem
Sensitive JWT tokens were stored in plain-text shared preferences, and lack of SSL pinning allowed for easy MITM interception of encrypted traffic.
System Architecture
Utilized Mobile Security Framework (MobSF) for static analysis, JADX for decompilation, and Frida for dynamic runtime hooking of Java/Kotlin methods.
Engineering Trade-offs
Focused heavily on local device vectors and network interception rather than server-side vulnerabilities to keep the research scoped to Android AppSec.
Lessons Learned & Future
Production Learnings
Obfuscation (like ProGuard) is a minor speed bump for a determined reverse engineer. True security requires proper cryptographic implementations and avoiding hardcoded secrets entirely.
Future Improvements
Expanding the research to include native library (JNI/C++) reverse engineering using Ghidra.
Database Layer
N/A - This was a research and exploitation project.
API Design
N/A - Exploited existing REST APIs by intercepting traffic via Burp Suite after bypassing SSL pinning.
Security Decisions
1. Documented the exact implementation flaws (e.g., using MODE_PRIVATE in SharedPreferences for sensitive data). 2. Provided patched code utilizing EncryptedSharedPreferences and the Android Keystore.
Scale & Metrics
N/A