Google today published a blog post recommending mobile app developers to encrypt data that their apps generate on the users’ devices, especially when they use unprotected external storage that’s prone to hijacking.
Moreover, considering that there are not many reference frameworks available for the same, Google also advised using an easy-to-implement security library available as part of its Jetpack software suite.
The open-sourced Jetpack Security (aka JetSec) library lets Android app developers easily read and write encrypted files by following best security practices, including storing cryptographic keys and protecting files that may contain sensitive data, API keys, OAuth tokens.
To give a bit of context, Android offers developers two different ways to save app data. The first one is app-specific storage, also known as internal storage, where the files are stored in a sandboxed folder meant for a specific app’s use and inaccessible to other apps on the same device.
The other is shared storage, also known as external storage, which sits outside the sandbox protection and is often used to store media and document files.
However, it has been found that the majority of the apps use external storage to store sensitive and private data on users and don’t take adequate measures to protect it from other apps, allowing attackers to steal photos and videos, and tamper files (called “Media File Jacking”).
The consequences of the same were demonstrated two years back with the “man-in-the-disk” attacks that make it possible for attackers to compromise an app by manipulating certain data being exchanged between it and the external storage.
Another research demonstrated a side-channel attack using which attackers can secretly take pictures and record videos — even when they don’t have specific device permissions to do so, but only by leveraging access to the device’s external storage.
To prevent such attacks, Android 10 ships with a feature called ‘Scoped Storage‘ that sandboxes each app’s data in the external storage as well, thereby limiting apps from accessing data saved by other apps on your device. But JetSec library takes it one step further by offering an easy-to-use solution to encrypt data for an extra level of protection.
“If your app uses shared storage, you should encrypt the data,” the company outlined. “In the app home directory, your app should encrypt data if your app handles sensitive information including but not limited to personally identifiable information (PII), health records, financial details, or enterprise data.”
What’s more, Google is also recommending that app developers should combine encryption with biometric information for added security and privacy.
The Jetpack Security library was originally previewed last May at its annual developer conference. It comes as part of an expansion of Android Jetpack, a collection of Android software components that helps developers follow best practices and design high-quality apps.
Credit: The Hacker News By: noreply@blogger.com (Ravie Lakshmanan)
