Android Security Improvement update: Helping developers harden their apps, one thwarted vulnerability at a time




Posted by Patrick Mutchler and Meghan Kelly, Android Security & Privacy Team




Helping Android app developers build secure apps, free of known vulnerabilities, means helping the overall ecosystem thrive. This is why we launched the Application Security Improvement Program five years ago, and why we're still so invested in its success today.


What the Android Security Improvement Program does





When an app is submitted to the Google Play store, we scan it to determine if a variety of vulnerabilities are present. If we find something concerning, we flag it to the developer and then help them to remedy the situation.




Think of it like a routine physical. If there are no problems, the app runs through our normal tests and continues on the process to being published in the Play Store. If there is a problem, however, we provide a diagnosis and next steps to get back to healthy form.



Over its lifetime, the program has helped more than 300,000 developers to fix more than 1,000,000 apps on Google Play. In 2018 alone, the program helped over 30,000 developers fix over 75,000 apps. The downstream effect means that those 75,000 vulnerable apps are not distributed to users with the same security issues present, which we consider a win.


What vulnerabilities are covered





The App Security Improvement program covers a broad range of security issues in Android apps. These can be as specific as security issues in certain versions of popular libraries (ex: CVE-2015-5256) and as broad as unsafe TLS/SSL certificate validation.



We are continuously improving this program's capabilities by improving the existing checks and launching checks for more classes of security vulnerability. In 2018, we deployed warnings for six additional security vulnerability classes including:



  1. SQL Injection
  2. File-based Cross-Site Scripting
  3. Cross-App Scripting
  4. Leaked Third-Party Credentials
  5. Scheme Hijacking
  6. JavaScript Interface Injection



Ensuring that we're continuing to evolve the program as new exploits emerge is a top priority for us. We are continuing to work on this throughout 2019.



Keeping Android users safe is important to Google. We know that app security is often tricky and that developers can make mistakes. We hope to see this program grow in the years to come, helping developers worldwide build apps users can truly trust.

Komentar

Posting Komentar

Postingan populer dari blog ini

Android Neural Networks API 1.3 and PyTorch Mobile support

Gambar
Posted by Oli Gaymond, Product Manager Android Machine Learning On-Device Machine Learning enables cutting edge features to run locally without transmitting data to a server. Processing the data on-device enables lower latency, can improve privacy and allows features to work without connectivity. Achieving the best performance and power efficiency requires taking advantage of all available hardware. Android Neural Networks API 1.3 The Android Neural Networks API (NNAPI) is designed for running computationally intensive operations for machine learning on Android devices. It provides a single set of APIs to benefit from available hardware accelerators including GPUs, DSPs and NPUs. In Android 11, we released Neural Networks API 1.3 adding support for Quality of Service APIs, Memory Domains and expanded quantization support. This release builds on the comprehensive support for over 100 operations, floating point and quantized data types and hardware implementations from partners acro
Baca selengkapnya

Turning it up to 11: Android 11 for developers

Gambar
Posted by Stephanie Cuthbertson, Director, Product Management Android 11 is here! Today we’re pushing the source to the Android Open Source Project (AOSP) and officially releasing the newest version of Android. We built Android 11 with a focus on three themes: a People -centric approach to communication, Controls to let users quickly get to and control all of their smart devices, and Privacy to give users more ways to control how data on devices is shared. Read more in our Keyword post . For developers, Android 11 has a ton of new capabilities. You’ll want to check out conversation notifications, device and media controls, one-time permissions, enhanced 5G support, IME transitions, and so much more. To help you work and develop faster, we also added new tools like compatibility toggles, ADB incremental installs, app exit reasons API, data access auditing API, Kotlin nullability annotations, and many others. We worked to make Android 11 a great release for you, and we can’t wait to se
Baca selengkapnya

Students Learn Android App Development with Google Developer Student Clubs

Gambar
Posted by Erica Hanson , Global Program Manager, Google Developer Student Clubs Google Developer Student Clubs , a program of university based community groups for students interested in Google developer technologies, recently started hosting study groups called Android Study Jams . The goal? Learn Android app development through hands-on codelabs in an online curriculum provided by Google. There are two tracks: one for students who are new to programming, and one for those who already have experience. Interested in participating? Facilitator materials are available for anyone to host Android Study Jams in their community - take a look and get to building. Google Developer Student Clubs are dedicated to helping students learn programming together, among peers, in a fun and interactive setting. While over 50 thousand students from all over the world have participated in these Android workshops, we wanted to highlight the exciting work from groups in Indonesia, Turkey, and Nigeria. F
Baca selengkapnya