How to Improve the Security of Android Mobile Apps?

The security of Android mobile apps is an important aspect that should be prioritised by any developer. Below you will find several tips on how to improve the security of Android mobile apps

1. Static Code Analysis with SonarQube:

Developers can use SonarQube static analysis to boost the quality of their code and prevent problems before they are introduced to an app. The tool allows you to create reports with detailed information on detected problems, making it easier to fix them.

The tool detects potential security gaps such as unsecured network connections, login errors, failed authentication and many others.  

2. Permission Management

Managing Android permissions is an important aspect that allows users to control which apps have access to their private data and other system functions. If done right, permission management is key to ensuring user privacy and security:

Few Tips

• Defining required permissions: Before granting permissions to an app, you should determine which permissions are necessary for it to work. Avoid granting apps unnecessary permissions, which could put the private data of users at risk.
• Informing users of required permissions: Before requesting permissions, the user must know why an app requires them. It is good practice to provide users with a brief description to explain why an app needs access to specific system functions.
• Reducing permissions: Reduce permissions required by an app to a minimum. If an app only needs to read data, it should be unable to save data.
• Testing apps using different permission levels: Test an app using different permission levels to find out how it works if there are no permissions or when the user denies it permissions.  

3. Certificate Pinning

Certificate pinning is a technique to protect mobile apps against man-in-the-middle attacks (MITM), which involve intercepting and interrupting application-server connections and then taking control over transferred data. During an MITM attack, an attacker may use a fake SSL certificate to gain access to the actual server and intercept confidential data such as passwords, login or payment details.

With certificate pinning, this scenario can be avoided by forcing an app to use only pre-defined SSL certificates. As a result, an attacker will be unable to use a fake SSL certificate to intercept data.  

4. Code Obfuscation

Code obfuscation involves reducing the readability of the app's source code. As it makes it more difficult to read and understand the app's source code, code obfuscation can help protect an app against attacks.

Examples of code obfuscation techniques

• Renaming variables and functions -this technique simply removes names of variables and functions by changing them into meaningless one- or two-letter symbols. This makes it difficult to understand what a chunk of code does.
• Metadata and unused code removal - this allows you to reduce the size of the code, thus hindering its analysis and understanding.
• String encryption: this technique involves changing the source code into another form, e.g. an equivalent mathematical form. It is one of the most effective techniques because it makes the code virtually illegible for people.
• Dummy code insertion - this involves inserting unnecessary instructions that do not affect the operation of an app, but make it difficult to analyse its code.  

5. Android Keystore

Android Keystore is a tool used to** securely store confidential data** such as private keys, SSL certificates, passwords etc. With Keystore, you can protect an app against attacks involving the interception of confidential data by unauthorised persons.  

Android Keystore has many advantages

• Security - Keystore provides high security as the data stored in it are encrypted and protected using various Android security methods.
• Simple key management - Keystore offers simple key and certificate management, making it easy for developers to work with confidential data.
• Support for various types of keys - Keystore supports various types of keys, including symmetric and asymmetric keys, which allows developers to use different data encryption methods.  

6. Root Detection

Android root detection is important from the point of view of app security. If a device is rooted, this means that its user has full access to the operating system and can modify it as they wish, possibly affecting device and app security.  

Two ways of root detecting on Android

• Checking if the su file is in the system - the su file is used to gain root access to rooted devices. You can find it in the folder "/system/bin" or "/system/xbin". If the su file is located in these folders, this means that the device is rooted.
• Using libraries such as SafetyNet / Play Integrity API - these Google services allow you to check if the device is rooted.  

Android root detection involves using special tools and techniques. There are many ways to detect root, but none of them is 100% effective. To hide the root status of their device, advanced users can utilise various tools and techniques to cheat the root detection system.  

Ensuring the security of mobile apps is very difficult and complex. The techniques described above increase the security of mobile app users considerably.