Hot answers tagged

4

You have to make trade-offs between usability and security. There are two types of android security patch level. The patch level 01 contains patches to the android framework and patch level 05 contains vendor patches for the Linux kernel, drivers and firmwares. While custom ROMs deliver 01 patch level, 05 patch level can be only delivered by OEMs. Your ...


3

Specifically, is it the Linux Kernel, the Android OS, or the DVM? All of this. And also the firmware. Bugs in the virtual machine would allow the attacker to change what an application is supposed to do, which is especially a problem if the application is allowed to access the specific hardware. Bugs in the Android OS could mean that an attacker could ...


2

TL;DR: You cannot win. What you want is called DRM, and that proved time and time again to be ineffective against dedicated users (or abusers). It increases the development cost, adds complexity, and don't solve the problem in the long run. If you cannot rely on SafetyNet, there's no way. As defalt pointed on his comment, a tainted application will lie about ...


1

I propose a strategy whereby you systematically reduce the reasons for your users to turn to re-packagers, thereby reducing your requirement to field service requests from unofficial versions of your client software: produce your own apk's for non-Play users, and publish these along with signature(s) generated by a tightly controlled private key offer an '...


1

If that custom ROM is using hardware-backed keystore (Trusted Execution Environment (TEE)) for screen lock authentication and file based encryption (FBE), there's no known way to decrypt /data partition without screen lock code as TEE is tamper-resistant by design. In FBE, encryption keys are cryptographically bound to screen lock code and TEE. This ensures ...


1

Rooting is a term for gaining root privileges on a system. Detecting an attacker that has rooted your system is very difficult, since the root user can generally do anything it wants, including tampering with logs or modifying security software and configuration. Rooting is a very broad term and can encompass many things. An attacker who rooted a system may ...


Only top voted, non community-wiki answers of a minimum length are eligible