Android architecture

    components

        application framework

        Dalvik Virtual Machine

        divisions

        kernel

        libraries

    HTC Dream

    security

        API call process

        content providers

        definition

        intents

        protecting user’s data

        protection levels

        risks

        sample code

        self-defined permissions

        zygote process

    security architecture

        application code signing

        permissions

        privilege separation

Android Debug Bridge (ADB) commands and features

Android LVL. See License verification library (LVL)

Android permission constants

Android security architecture

    permissions architecture

        API call process

        content providers

        intents

        protection levels

        sample code

        self-defined permissions

    zygote process

Anti-forensics

    detection mechanism

    fake messages

    mail messages

    technique

Authentication techniques

    browser setting

    CA trusts

    CipherSuites

    cryptography

    DigiNotar

    feature

    handshake

    introduction

    man-in-the-middle (MitM)

        data flow

        DigiNotar

        reference

        websites

    mobile device

    OAuth

        access token, Picnik

        Android app

        application details

        authentication flow

        back-end web application

        client ID

        consumers

        ID and secret

        photos

        Picasa/Flickr

        Picnik

        project creation

        service provider

        type

    POST request

    PreMaster key

    self-signed certificate

    SSL

    TLS

    traffic capture

    transport protocols

    username and password

Base64 encoded public key

Block ciphers, modes of operation

CBC mode. See Cipher-block chaining (CBC) mode

CFB mode. See Cipher feedback (CFB) mode

Challenge response authentication

    client side, login

    Constants.java

    CRAM object

    generate() function

    generateReply(String response) function

    graphical representation

    Hex.java file

    Login.java class

    project structure

    response

    server-side code

    steps

    verifyChallenge(String userResponse)

Challenge response message flow (CRAM)

Cipher-block chaining (CBC) mode

Cipher feedback (CFB) mode

Connectivity

Contact Class, Contact.java

Contact object

Content provider classes

Cryptography

    additional layer

    in mobile applications

        block ciphers, modes of operation

        data padding

        key generation

        symmetric key algorithm

    public key infrastructure

        instructions

        story and PKI elements

    terminology

Dalvik Executable (DEX) files

Dalvik Virtual Machine

Data classification table

Data padding

Data storage, Android

    combining data storage and encryption

        cryptographic module

        KeyManager Module

        modified RetrieveData Class

        modified StoreData Class

        New StorageExample3

        output

        specifications

    internal storage

        main class

        output

        RetrieveData.java

        StoreData.java

    mechanisms of

    shared preferences

        data retrieving code

        data storing code

        main class

        output

    SQLite databases

        contact object

        ContactsDb class

        ContactsDB helper class

        contacts table

        main class

        output

        project structure

        RetrieveData class

        SQLiteOpenHelper

        StoreData Class

Data theft vulnerabilities

Dedexer

DEX. See Dalvik Executable (DEX) files

Electronic codebook (ECB) encryption

Encryption

    key-generation algorithm

    results

    routine

Enterprise resource planning (ERP)

    applications

    business

    connectivity

    mobile application

    mobile middleware

        banking application

        database access

        data representation

        goals

        interaction

HTTP (HyperText Transfer Protocol)

JSON (JavaScript Object Notation)

Key generation

License verification library (LVL)

    alternate response verification idea

    Base64 encoded public key

    Chuck Norris facts app

    CommsEvent.java file

    Comms.java File

    CommsNotifier.java file

    copying LVL sources to separate directory

    downloading Google API Add-On

    importing LVL source as library project

        importing file system

        locating and importing source

        marking project as library

        naming Android project

        selecting API version

        specifying package name

    included in app project

    interfacing with market app and server

    Main Activity-ChuckNorrisFactsActivity.java

    modified ChuckNorrisFactsActivity.java File

    modified Verify Function

    selecting LVL library project

    unlicensed user receiving negative response

Licensing policy

    allowAccess() method

    default policies

    processServerResponse() method

Licensing, publishing and selling

Location Class, Location.java

Malware

    anti-forensics

        definition

        detection mechanism

        fake messages

        mail messages

        technique

    exfiltration

    FlexiSPY

        activation

        commands

        explicit instructions

        features

    Government sanctioned malware

        compromise

        detection

        exfiltration

        flowchart

        infection

        RIM

        SMS message

        spread

    infection

    spread

    spyware, definition

    stages

        compromise

Man-in-the-middle (MitM)

    data flow

    DigiNotar

    reference

    websites

Mobile middleware

    banking application

    database access

        apress

        HTTP

        javax.sql and java.sql packages

        JDBC drivers

        libraries

        ListView layout

        my.cnf file

        MySQLConnectActivity.java file

        program output

        project structure

    data representation

        data formats

        JSON output

        RESTful API request

        XML output

    goal

    interaction

O

PCBC mode. See Propagating cipher-block chaining (PCBC) mode

Permission constants. See Android permission constants

ProGuard obfuscator

Propagating cipher-block chaining (PCBC) mode

Proxim application

    contact object

    cryptography routine

    location object

    save controller

    structure

Public key infrastructure

    instructions

    story and PKI elements

Publishing and selling

    developer registration

    download availability

        ADB commands and features

        application directory

    license verification library (LVL)

        alternate response verification idea

        building and including LVL

        Chuck Norris facts app

        CommsEvent.java file

        Comms.java File

        CommsNotifier.java ile

        copying LVL sources to separate directory

        downloading Google API Add-On

        importing LVL source as library project

        interfacing with market app and server

        Main Activity-ChuckNorrisFactsActivity.java

        modified Verify Function

        obfuscation

    licensing

    licensing policy

        allowAccess() method

        default policies

        processServerResponse() method

    reverse engineering

        Android build process

        baksmali, code disassembling

        decompiling JAR file

        dexdump output

        DEX file

        running dex2jar

Reverse engineering

    Android build process

    baksmali, code disassembling

    decompiling JAR file

    dexdump output

    DEX file

    running dex2jar

SaveController.saveContact(getApplication Context(), contact)

Save Routine, SaveController.java

SD card image file

Security

    API call process

    architecture

        application code signing

        permissions

        privilege separation

    content providers

    intents

    protection levels

    sample code

    self-defined permissions

    zygote process

Shared preferences

    data retrieving code

    data storing code

    main class

    output

Spyware. See Malware

SQLite databases

    ContactsDB helper class

    contacts table

    main class

    output

    project structure

    RetrieveData class

    StoreData Class

SSL (Secure Sockets Layer)

Stored information

    classification

        personal information

        sensitive information

        types

    encryption

        key-generation algorithm

        results

        routine

    proxim and data storage

        Contact Class, Contact.java

        contact object

        Location Class, Location.java

        reworked SaveController.java method

        SaveController.saveContact(get ApplicationContext(), contact)

        Save Routine, SaveController.java

        SD card image file

    security

        direct attacks

        indirect attacks

Symmetric key algorithm

Theoretical concepts

    challenge response authentication

        client side, login

        Constants.java

        CRAM object

        generate() function

        generateReply(String response) function

        graphical representation

        Hex.java file

        Login.java class

        project structure

        response

        server-side code

        steps

        verifyChallenge(String userResponse)

    OAuth

        handling authorization

        token-retrieving

TLS (Transport Layer Security)

Virtual machine (VM)

Virtual private network (VPN)

Web applications. See also Authentication techniques

    advantages

    components

        advantages

        login process

        three-tier architecture

    definition

    GET and POST

    HTML pages

    HTTP

    JSON (JavaScript Object Notation)

    methods

    OWASP

        foundation

        list

        mobile security project

        testing

    RESTful API

    SOAP

    source code

    technologies

        databases and URL

        execute() method

        login class

        logon failure

        project structure

        server-side

        verification code

        XML files

    testing environment

        app creation

        applications list

        dashboard

        Google App Engine project

        home page

        login servlet

        name creation

        remote application

        stub application package

    transit

    web service

    XML

Web service

XML (eXtensible Markup Language)

XOR