The purpose of this wiki page is to gather information which identifies resources which will help us to write secure coding rules/guidelines against vulnerabilities which have been discovered.

Web resources for new Android app secure coding rules and guidelines:

• Specific to the NDK:
  • https://intrepidusgroup.com/insight/2012/05/ndk-file-permissions-gotcha-and-fix/
  • http://community.arm.com/groups/android-community/blog/2013/09/19/10-android-ndk-tips  Ten Android NDK tips
  • “Android NDK | Android Developers”: http://developer.android.com/tools/sdk/ndk/index.html#Contents (also http://developer.android.com/tools/sdk/ndk/index.html )
• https://viaforensics.com/resources/reports/best-practices-ios-android-secure-mobile-development/  (secure app development guidelines list on the right column summarizes, and full report downloadable)
• http://developer.android.com/guide/practices/verifying-apps-art.html#JNI_Issues It discusses current security problems (JNI), as well as new ones that will arise with ART (arrays and compacting garbage collectors, error handling).
• https://developer.android.com/training/articles/security-tips.html Secure Android app development tips
• http://source.android.com/devices/tech/security/  very large source of info about Android app security
  • http://source.android.com/devices/tech/security/best-practices.html best practices for secure Android coding, within main site above
• https://www.isecpartners.com/media/11991/isec_securing_android_apps.pdf Guidelines for developing secure Android apps
• https://developer.android.com/training/articles/security-ssl.html Android app developers should securely use HTTPS and TLS. Info on how to do so, including using pinning when possible.
• For fleshing out new rule JNI01-J, based on slide 18 from Marc Schoenefeld's Java One presentation: https://www.securecoding.cert.org/confluence/display/java/JNI01-J.+Safely+invoke+standard+APIs+that+perform+tasks+using+the+immediate+caller%27s+class+loader+instance?src=contextnavchildmode
• http://source.android.com/devices/tech/security/index.html Overall Android security overview, but needs searching to find the specific info useful for secure coding of Android apps
• https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy Hardening Android for Security and Privacy

Specific vulnerabilities disclosures

• http://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-19997/Google-Android.html big list of Google Android CVE security vulns
• http://www.pcworld.com/article/2366040/android-444-fixes-openssl-connection-hijacking-flaw.html  Android 4.4.4 fixes OpenSSL hijacking vuln
• http://www.networkworld.com/article/2226770/smartphones/risk-and-the-android-heartbleed-vulnerability.html Android and Heartbleed  
• http://www.jpcert.or.jp/english/ JPCERT's English-language Android vulnerabilities site
• http://threatpost.com/android-root-access-vulnerability-affecting-most-devices
• http://www.pcworld.com/article/2111100/rogue-apps-could-exploit-android-vulnerability-to-brick-devices-researchers-warn.html memory corruption via string over 387,000 characters.
• https://groups.google.com/forum/?fromgroups#!forum/android-security-discuss   Android security group, discussions of a lot of secure Android app coding issues
• Three of the CERT secure coding books:
  • Java rules
  • Java guidelines
  • C rules and recommendations

Online coding forums

Books

Conference/workshop proceedings

I have a lot of papers in PDF, might be easiest to give these to you via USB when you’re in Pittsburgh.