I am working on an Android project whose goal is to identify which Java or native functions should be hooked and monitored at runtime to check if the application contains malicious behaviour or weak programming practices.

For example, hooking the connect() allow to access the port information and detect connections that use http instead of https, which is definitely a weak programming practice. I am currently checking if the connection uses port 80 or 443 as a first classification method, but users are suggesting that port is not enough to know if it's http or https, and a traffic analysis would be required (thanks to @AndréBoria).

I have identified many other potentially malicious behaviours and weak programming practices, and prepared similar hooking structures. I wanted to ask you which functions would you hook to check if the app tries to:

1. access the SD card,

2. detect GPS,

3. access camera or microphone,

4. call premium numbers.

Also, using deprecated methods is potentially dangerous for security reasons. Therefore, I want to check if the app is using any. What I'm thinking is to use a blacklist of all known deprecated methods and then scan the app code to search for methods of that list. Would you agree with this? (consider a scenario in which there is no code obfuscation). Same thing for weak encryption API (e.g. MD5?): how to spot them?

I am working on an Android project whose goal is to identify which Java or native functions should be hooked and monitored at runtime to check if the application contains malicious behaviour or weak programming practices.

For example, hooking the connect() allow to access the port information and detect connections that use http (80) instead of https (443), which is definitely a weak programming practice.

edit: apparently, checking the port number is not enough to know if it's http or https, and a traffic analysis would be required (thanks @André Borie).

I have identified many other potentially malicious behaviours and weak programming practices, and prepared similar hooking structures. I wanted to ask you which functions would you hook to check if the app tries to:

1. access the SD card,

2. detect GPS,

3. access camera or microphone,

4. call premium numbers.

Also, using deprecated methods is potentially dangerous for security reasons. Therefore, I want to check if the app is using any. What I'm thinking is to use a blacklist of all known deprecated methods and then scan the app code to search for methods of that list. Would you agree with this? (consider a scenario in which there is no code obfuscation). Same thing for weak encryption API (e.g. MD5?): how to spot them?

edit: I acknowledge the fact that not every deprecated method is deprecated due to security reasons (thanks @CommonsWare), but some of them are. How would you separate methods which have been deprecated for known security issues from the others? Would be nice to have a comprehensive list.

I am working on an Android project whose goal is to identify which Java or native functions should be hooked and monitored at runtime to check if the application contains malicious behaviour or weak programming practices.

For example, hooking the connect() allow to access the port information and detect connections that use http (80) instead of https (443), which is definitely a weak programming practice.

I have identified many other potentially malicious behaviours and weak programming practices, and prepared similar hooking structures. I wanted to ask you which functions would you hook to check if the app tries to:

1. access the SD card,

2. detect GPS,

3. access camera or microphone,

4. call premium numbers.

Also, using deprecated methods is potentially dangerous for security reasons. Therefore, I want to check if the app is using any. What I'm thinking is to use a blacklist of all known deprecated methods and then scan the app code to search for methods of that list. Would you agree with this? (consider a scenario in which there is no code obfuscation). Same thing for weak encryption API (e.g. MD5?): how to spot them?

I am working on an Android project whose goal is to identify which Java or native functions should be hooked and monitored at runtime to check if the application contains malicious behaviour or weak programming practices.

For example, hooking the connect() allow to access the port information and detect connections that use http instead of https, which is definitely a weak programming practice. I am currently checking if the connection uses port 80 or 443 as a first classification method, but users are suggesting that port is not enough to know if it's http or https, and a traffic analysis would be required (thanks to @AndréBoria).

I have identified many other potentially malicious behaviours and weak programming practices, and prepared similar hooking structures. I wanted to ask you which functions would you hook to check if the app tries to:

1. access the SD card,

2. detect GPS,

3. access camera or microphone,

4. call premium numbers.

Also, using deprecated methods is potentially dangerous for security reasons. Therefore, I want to check if the app is using any. What I'm thinking is to use a blacklist of all known deprecated methods and then scan the app code to search for methods of that list. Would you agree with this? (consider a scenario in which there is no code obfuscation). Same thing for weak encryption API (e.g. MD5?): how to spot them?