1

Me and a colleague were discussing the fact that due to licensing we need to disclose a couple of libraries we used in the development of an Android app we make. I said, from a security standpoint it would probably be better to disclose the bare minimum.(So not disclosing the libraries that didn't specifically require it). He said he was lazy and didn't want to remove the ones that weren't required.

My philosophy is: If someone were to find a vulnerability that would affect a specific library that could maybe pose a threat to our app

How much of a potential risk could disclosing libraries pose?

  • 5
    Considering that anyone who wants to attack your app can find out the libraries by examining your APK, I would consider the risk of listing them in a dialog to be negligible. – CommonsWare Jun 22 '16 at 15:54
  • Is this a web app where users won't be able to know what libraries you're using unless you tell them, or do you provide a binary for users to install which they can search for function names, strings, and the like to figure things out on their own? – Ben Jun 22 '16 at 15:54
  • Nevermind, I missed the "android" tag. – Ben Jun 22 '16 at 15:54
3

If someone were to find a vulnerability that would affect a specific library that could maybe pose a threat to our app

The defense against that is not to use the library. Using the library and not documenting it does not change the fact that your application is vulnerable.

Not documenting that you use the library makes is marginally harder for people to discover that your application uses it, but only marginally so. It might not show up in certain automated scans (e.g. a Google search) but it will come up in other automated scans (e.g. looking for certain symbols) and it will come up once somebody tests (even if your application wasn't using the library, people might test it for similar bugs). And once one person has found it they can make the information public.

On the other hand, if you don't disclose that you use the library, then your users won't have an easy way to find that if a vulnerability affects the library, there's a serious risk that it affects your app. By not disclosing, you're increasing the risk on your users.

So the net security effect of disclosing what libraries your application uses is positive.

1

There may be a potential risk if you disclose libraries with known or later to be discovered vulnerabilities. This is no different than a website using WordPress and a popular image plugin that becomes comprised to allow shell uploads or an OS that has a program that allows someone remote access through an exploit. If the attacker knows the vectors exist in these products they can use them.

However let's take a minute to talk about licensing. Most licenses require you to include the license or required verbiage when distributing the software it is used in. Some such as the GPL even require you to open source your code. The Google Play Store and even the iOS Store for that matter take these licenses very seriously. If say you use a third party library and you are in violation of their license. The author(s) of that library can put in a take down request for your app and it could be removed and even blacklisted from the marketplace. Not including any additional legal action taken against you.

So it is very important you understand the licenses your libraries use. And if you don't agree with them use another one or create your own instead. If the license doesn't require a mention or license inclusion you don't have to disclose it's use at all. There are even licenses such as the WTFPL that don't obligate you to credit it's use. But for the ones that do you have no choice but to disclose their use. This makes the security aspect as a reason for nondisclosure a moot argument.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.