4

I have an Android app and it has 3 activities; A, G and B. When the app starts users see Activity A. If user wants to navigate to activity B, app starts activity G and asks for a password. If the password is true user is directed to Activity B, if not back to activity A. None of the activities are exported. Problem is on rooted devices a user can start activity B from command line using

am start -n package.name/package.name.B

command. How can I prevent this?

  • 7
    There's no security without physical security. – Neil Smithline Nov 25 '15 at 16:22
15

Either do the actual security check in activity B or make G send on some kind of token to B in the Intent.

The token can be any random data generated at runtime. Since G and B share the same process they can easily get access to it, but other processes cannot (not without manual debugging).

But note all of these only make it difficult for users to use your app without the password. The user does control the binary and memory, so can bypass any protection you put in.

  • This is the better of the 2 current answers. If someone must only run after doing something else, then combine them. – Nzall Nov 25 '15 at 22:42
12

You cannot prevent AM from running on a rooted phone. My approach to preventing Activity B from being run separately would be to write activity B to fail unless it's passed a code from activity A or G, depending on which activity starts it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.