650 questions
-4
votes
0
answers
42
views
What is setAllowUniversalAccessFromFileURLs(true) [closed]
What are vulnerabilitites can occur by this and prevention tech in code level ?
- 1
1
vote
1
answer
50
views
Is there a way to safely deliver the SDK keys with the Android app?
I found out that no matter where the SDK keys are stored, there is still a simple way to get them. I have a feeling that as long as the keys are shipped together with the apk, they are not secured.
...
- 1,603
0
votes
0
answers
50
views
How to access in-memory variables of another Android app (e.g. field values) without root or emulation?
Is there any way to access in-memory variables or object field values (e.g. Delivery.dropoffZipCode) of another app, without root access, without modifying the target APK, and without using an ...
- 11
1
vote
1
answer
100
views
App rejected due to intent scheme vulnerability – which part of my code is problematic?
This is an app that uses WebView.
Currently, my priority has been to get the upload done, so I haven’t organized the code yet.
I’ve attempted to upload the app several times to Google Play Console for ...
- 59
1
vote
0
answers
97
views
AEADBadTagException error on user's device causing Mobile app to not open
User I have in closed testing of an app uninstalled our app, and re-installed it via the Google Playstore app link. I pulled their bug report off their phone.
I'm pretty sure this (snippet below) is ...
- 498
0
votes
0
answers
110
views
Unsafe Implementation of WebView SSL Error Handler
Recently we got the below mail from Google play for our app:
Issue found: Unsafe Implementation of WebView SSL Error Handler
Issue details
We found an issue in the following area(s):
Version code ...
0
votes
1
answer
57
views
Can android photo apps see all my photos?
All photo apps require permission to photos, to work properly.
Does this mean a malicious developer can upload users' photos to cloud, so he can see?
If that is possible, what prevents him from doing ...
- 387
0
votes
1
answer
70
views
Where to implement the encryption on access token in clean architecture of android?
I implemented the Symmetric encryption of access token using Android KeyStore, but where I must do encryption process
Repository class where I receive data from Remote.
View Model class after passing ...
- 138
4
votes
2
answers
648
views
Enabling "detectUnsafeIntentLaunch" in strictMode throws warning even for Implicit Intent with setPackage
I have enabled detectUnsafeIntentLaunch in strict mode to test for change while targeting for android SDK 35 in my SDK.
I have the following code where I send a broadcast and it is caught within the ...
- 724
1
vote
0
answers
82
views
SecureEditText in Android
Context: Fridum is a tool that can be used for penetration testing in Android. it can take a dump of an app's memory/heap and extract all strings.
Problem: I am using fridump to take a dump for my app ...
- 451
0
votes
1
answer
80
views
Implicit Internal Intent vulnerability showing up when Android app is pre-Launch to the Playstore
Recently i creat new app from playstore console and also upload new bundle but playstore mention security and trust issues like Implicit Internal Intent vulnerability. this issues shows following ...
- 33
6
votes
0
answers
328
views
Google Play console: AES-CMAC incorrectly flagged as "security and trust issue" / "app contains unsafe cryptographic encryption patterns"
Edit notes and updates below.
Re-post from https://support.google.com/googleplay/android-developer/thread/277993015 as Google Support FAQ answer 9450925 states to post this here. (https://support....
1
vote
2
answers
105
views
SmsBroadcastReceiver Intent Redirection Error
When I'm trying to publish my app on play store but im getting the intent redirection error in my broadcast receiver. Here is the related code.
class SmsBroadcastReceiver : BroadcastReceiver() {
...
- 11
0
votes
1
answer
60
views
How to secure my secret key of S3 AWS - Google Console Warning
I encountered an issue while using AWS S3 in my app to download a file from it. However, upon deploying my app on Google Play, I received a warning about a potential AWS authorization leak.
val ...
- 21
0
votes
0
answers
217
views
Possible ways to simulate tap input with android studio
I'm working on a remote access application (similiar to AnyDesk) to access mobiles on a lan network and use them with just your browser. At this point, I'm able to send the device display output via ...
- 56
1
vote
0
answers
104
views
Limiting the access of JNI file access to "just" one folder
If I launch some C code with the JNI in my Android application, is there a way I could limit that C code to access only a specific folder in my application folder, so sandboxing it to just a specific ...
- 128
1
vote
1
answer
363
views
How much secure is the Public Key SSL pinning?
To avoid man in the middle attack in Android app, how efficient is the Public Key pinning method? Since anyone can easily get the public key of any domain, is it actually secure to implement it?
We ...
- 321
1
vote
1
answer
319
views
Accessing native libraries files
In our application, we check the hashes of native library files. I assume this is done to avoid spoofing these files (this code appeared before I came to the project).
We access the native code files ...
- 56
1
vote
0
answers
22
views
Trying to call different class's variable but java reflection does not work
I am trying out a challenge where the system has an app installed from which I need to extract a variable called x.
The app has a man-in-the-disk vulnerability where it calls a file in the external ...
- 11
1
vote
2
answers
148
views
How to set StorePassword & KeyPassword in securely way?
How to make secure info of my sign app when I want to release my app
i don't want to hardcode it.
I would like to keep them safe from attacker and reverse engineering
//gradle app file
SigningConfigs {...
- 123
0
votes
1
answer
494
views
Hide tap jacking alerts on android app below Android 12
I want to hide tap-jacking alerts in my Android app. I was able to do it on Android 12 and above by using getWindow().setHideOverlayWindows(true);. Can someone help me achieve this on versions below ...
- 1,595
1
vote
1
answer
412
views
Leaked GCP API Keys - Using web service API
Google play console pre-launch report says I have leaked GCP API Keys.
I can't restrict a google web service API to the android app. However, I did put it inside a secrets.properties file using gradle ...
- 81
2
votes
1
answer
133
views
How to resolve leaked AWS credentials in Android App
https://support.google.com/faqs/answer/9093739
How to resolve leaked AWS credentials in Android App, we initialize AWS Rekognition using https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-...
- 1,360
0
votes
1
answer
272
views
android-safetynet attestation replacement in webauthn after deprecation
android-safetynet attestation format is provided in webauthn in both browser API or FIDO2 Api for Android. Since safetynet API will be deprecated soon, what will be the replacement of safetynet ...
- 1,080
0
votes
0
answers
24
views
Android: How to catch spam email addresses after bot has signed in
I can get email addresses of users in my app, and sometimes they comes with addresses like this: [email protected]. My app provides some service, it's free for users now, but it's paid for me....
- 5,461
2
votes
1
answer
420
views
Places SDK for Android: API key restriction causing "This IP, site or mobile application is not authorized to use this API key" error
I am using the "Places Autocomplete" feature of the Places SDK for Android. I have set up an API key via the Google Cloud credentials console, and it worked great.
However, I attempted ...
- 307
0
votes
0
answers
504
views
How to solve android.security.KeyStore.getKeyStoreException in Android 11?
I am getting to many of below android security related exception/crash on my test enviourment
Device: Galaxy A52 5G
Android: 11
Updated stack traces
ndroid.security.KeyStore.getKeyStoreException ...
- 148
0
votes
0
answers
47
views
Saving hardcoded data in asset folder vs gradle.properties in Android
Which of the following is considered safer and why
Saving data (some strings, urls etc) in Asset folder and then reading from it
Saving data in gradle.properties and reading from it
2
votes
1
answer
3k
views
onReceivedSslError fixed but still showing error
I got an "onReceivedSslError" error in my Play Console account as in the screenshot.
I have handled the onReceivedSslError in all WebViewClients and show the required warning message. Then ...
- 301
0
votes
1
answer
312
views
Path Traversal Vulnerability fix problems Android
While recently submitting a app it got rejected saying
Vulnerability: Path Traversal
Your app(s) are using a content provider with an unsafe implementation of openFile.
Google suggested two solutions ...
- 151
16
votes
4
answers
3k
views
Your app contains unsafe cryptographic encryption patterns (in dynamically loaded code)
This recently popped out pre-launch report, once I published minor update to app.
I've seen also couple of similar recently in other projects, with class names obfuscated in exactly same name (bjqm.* ...
- 1,290
1
vote
0
answers
321
views
App rejected due to unsafe encryption - with no clues except q0.e0.c
Trying to publish an app and got the following:
Unsafe Encryption
Your app contains unsafe cryptographic encryption patterns. Please see this Google Help Center article for details.
q0.e0.c
...
- 21
0
votes
0
answers
140
views
Google Play Store alert : Insecure Hostname Verification
I am getting this issue from Google Play Console. What things goes as below 1. App's first screen will be code verification so once user enter code, there is one api call and in response we receiving ...
- 4,263
1
vote
0
answers
124
views
unsafe implementation of the HostnameVerifier interface. "lib.android.paypal.com.magnessdk.network"
I'm currently having an issue trying to get my android app accepted by Google.
Upon pushing the app to the Google Play Store I keep getting rejected with the following email:
Your app(s) are using an ...
- 21
0
votes
0
answers
449
views
Unsafe Cipher Mode Your app contains a less secure encryption mode. While Uploading on Play Store
While trying to upload the app on Play store it shows the unsafe cipher error and points towards a encryption function.
I have a function taking input a image and converting it to bitmap and than to ...
- 57
5
votes
1
answer
132
views
How to prevent/stop/disable android SDK EditText exposed to application class
I have an SDK that contains MYSDKActivity. In this activity layout, I have 1 edit text where the user can enter his card number. Any android Client who is integrating this SDK, can use ...
- 3,414
0
votes
1
answer
148
views
Flutter Razorp,Your app(s) are vulnerable to Intent Redirection
I have used the latest razorpay_flutter: ^1.3.4 dependency in the app.
when uploaded to place console i received mail from the team as
"
Intent Redirection
Your app(s) are vulnerable to Intent ...
0
votes
1
answer
415
views
One authorization key with passcode and biometrics to encrypt local data on Android
I want to use one secure key to encrypt and decrypt data on device without saving it in SharedPreferences or DataStore. I want to generate that key using in app authorization (passcode and biometrics)....
- 127
0
votes
1
answer
1k
views
AES/ECB/PKCS5Padding Unsafe Encryption Mode error
I got an warning from google to Change encryption mode from "AES/ECB/PKCS5Padding" to "AES/GCM/NoPadding".
After changing I need to be compatible with the old data which is ...
- 255
1
vote
0
answers
172
views
WebViewClient.onReceivedSslError on published flutter android app bundle
We have deveoloped an Flutter application. We use the following package 'webview_flutter' for WebView display in flutter application. Application works fine with android. We published an app bundle in ...
- 7,008
0
votes
1
answer
2k
views
BiometricPrompt Error cases for onAuthenticationError() after update to latest version
I have updated the version of a library
from: `
from 'androidx.biometric:biometric:1.0.1' to -> 'androidx.biometric:biometric:1.1.0'
I saw that there are new possible errors and I was wondering ...
- 145
0
votes
1
answer
1k
views
How to convert java.security.PrivateKey to JWK (JSON) format in Android?
I have seen some examples to convert java.security.PublicKey to JWK but I could not find an example to convert java.security.PrivateKey to JWK (JSON) format in Android. Is that even possible? Is there ...
- 81
0
votes
0
answers
189
views
android-security ... How do I fix this jquery security alert: "Your app contains one or more libraries with known security issues"
In my Play Developer console I see the following message for an updated android app I have in my store:
Vulnerable Libraries
Your app contains one or more libraries with known security issues. Please ...
2
votes
1
answer
920
views
Reflection on Jetpack Compose
Currently, I’m creating a new SDK that contains sensitive fields that shouldn’t be read by the consumers (Think Credit Card Number field) and I’m using Jetpack Compose to create the forms, my question ...
- 598
1
vote
0
answers
641
views
How to fix apps with bad WebRTC versions
I am an Android developer.
I released an app for internal public testing and the following error was listed in the pre-release report summary.
"How to fix apps with bad WebRTC versions."
...
- 11
3
votes
1
answer
3k
views
how to detect root status in android device
I created an app and added root detection. I searched it on internet and discussed it on some forums, but nothing works. Can someone help me about this issue?
I tried these several possibility ...
0
votes
1
answer
248
views
How to disallow emulator, isdebuggable check for debug build
I am resolving some security defects for my app.
Defect is:
Should not allow release app to be run in emulator
Release app should not be debuggable
Should not connect to debugger
Release app should ...
- 1,091
7
votes
1
answer
6k
views
Link to a working webRTC library for Android
Google play have a new error/warning from the last days about the WebRTC library that I use. I use this library for almost a year.
google-webrtc-1.0.32006.aar
My app is still available but they ask ...
- 775
0
votes
1
answer
704
views
AES/ECB/NoPadding Unsafe Encryption Mode error
I have an error in Google play, AES/ECB/NoPadding Unsafe Encryption Mode Usage, I rely on it to communicate with beacons in the field, and for my API (which also uses this encryption). It contains no ...
- 1
0
votes
1
answer
691
views
Your app is using a version of libjpeg-turbo containing a security vulnerability
Google play store gives me this error when I am trying to send my application for review.
Your app is using a version of libjpeg-turbo containing a security
vulnerability. Please see this Google Help ...
- 1,608