I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems to be a good option but out of my price range. :)
Be sure to check out The Denim Group's blog post on Using static analysis to review file access in android apps, which includes some tools written in Perl.
When Angry Birds Attack Android Edition is the latest blog post from TEAM JOCK, who presented on this research during this video at Shmoocon with a talk entitled [PDF - TEAM JOCH vs. Android: The Ultimate Showdown - PDF].
Nils also presented on Building android sandcastles in android’s sandbox at a recent BlackHat.
ENISA has done a more formal job at modeling the risks to smartphone platforms with their Smartphones: Information security risks, opportunities and recommendations for users paper. Cigital has at least one blog post on Moving to Mobile - New Threats which also covers threat-modeling topics.
Here are two free online tools that check for certain specific issues with Android applications:
Stowaway checks for overprivilege: i.e., it checks to see if the application requests permissions that its code doesn't seem to use.
Keep in mind that these are research tools. Moreover, they focus only on a very specific set of vulnerabilities. They are not a general-purpose static analysis tool, and are not substitute for a general-purpose security static analysis tool for Android (like Fortify); they are better thought of as a supplement for other tools available to you.
For static analysis of source code I found this tool useful especially for Android. It is a free tool called OpenGrok ,which can index a source repository. It supports multiple languages so it has been useful for analysis of Androids Java and native code. AndroidXRef also hosts an index that can be used for analysis of multiple versions of Android. Hope this helps.
Sorry if this is too basic, but I wanted to make sure the easy options are covered.
I just added static analysis with FindBugs and PMD (free) to my Eclipse workflow. I didn't go with Klockwork Solo yet because of the price, but I plan to use the 30 day trial before releasing my next app.