Questions tagged [android-security]
Tag used by Android in Security Alert messages to developers. The Security Alert message is often accompanied with a Google-Play rejection. AOSP instructions state to tag a question with it.
644
questions
0
votes
0
answers
23
views
unsafe implementation of the HostnameVerifier interface. "lib.android.paypal.com.magnessdk.network"
I'm currently having an issue trying to get my android app accepted by Google.
Upon pushing the app to the Google Play Store I keep getting rejected with the following email:
Your app(s) are using an ...
0
votes
0
answers
48
views
Unsafe Cipher Mode Your app contains a less secure encryption mode. While Uploading on Play Store
While trying to upload the app on Play store it shows the unsafe cipher error and points towards a encryption function.
I have a function taking input a image and converting it to bitmap and than to ...
0
votes
0
answers
19
views
i am getting SElinux policies error while trying to execute native binary
i am trying to execute native binary which i packaged with my app but getting: avc: denied { execute_no_trans } error in log
i was trying to execute that native binary using ProcessBuilder:
...
5
votes
1
answer
83
views
How to prevent/stop/disable android SDK EditText exposed to application class
I have an SDK that contains MYSDKActivity. In this activity layout, I have 1 edit text where the user can enter his card number. Any android Client who is integrating this SDK, can use ...
0
votes
0
answers
29
views
EncryptedSharedPreferences ship default values in encrypted fashion
I am saving aws credentials in EncryptedSharedPreferences to avoid Google Play flagging
Your app(s) expose Amazon Web Services credentials.
Is there a way I can bundle the default values in ...
0
votes
1
answer
56
views
Flutter Razorp,Your app(s) are vulnerable to Intent Redirection
I have used the latest razorpay_flutter: ^1.3.4 dependency in the app.
when uploaded to place console i received mail from the team as
"
Intent Redirection
Your app(s) are vulnerable to Intent ...
0
votes
1
answer
39
views
One authorization key with passcode and biometrics to encrypt local data on Android
I want to use one secure key to encrypt and decrypt data on device without saving it in SharedPreferences or DataStore. I want to generate that key using in app authorization (passcode and biometrics)....
0
votes
0
answers
81
views
Android: Using PURPOSE_AGREE_KEY with ECDH and setUserAuthenticationRequired always throws android.security.keystore.UserNotAuthenticatedException
I am using Android Keystore, specifically KEY_ALGORITHM_EC, to create a key that is signing and verifying data.
We require user biometry to access the key.
Now I want to use that same key to encrypt/...
0
votes
0
answers
44
views
Sorted!! Play store: Remediation for Intent Redirection Vulnerability for Flutter
I have a question with regards to how to remedy intent redirection. I am not extremely well versed in Android, as the solutions offered on the Google Support page doesn't seem to address for flutter ...
0
votes
1
answer
116
views
AES/ECB/PKCS5Padding Unsafe Encryption Mode error
I got an warning from google to Change encryption mode from "AES/ECB/PKCS5Padding" to "AES/GCM/NoPadding".
After changing I need to be compatible with the old data which is ...
1
vote
0
answers
32
views
WebViewClient.onReceivedSslError on published flutter android app bundle
We have deveoloped an Flutter application. We use the following package 'webview_flutter' for WebView display in flutter application. Application works fine with android. We published an app bundle in ...
0
votes
0
answers
42
views
Fixed a Zip Path Traversal Vulnerability in Android app ,but Google Play still issued a warning
I have some apps on google play, and they are all prompted that there is an unsafe unzip mode. After I fixed this problem with the same code, most of my APPs no longer have warnings, but one APP still ...
0
votes
0
answers
15
views
Try to add alias profile to Android profile but got an error
I just tried to add variables on Android /etc/mkshrc file but I get an error:
Read-only file system
Further, I have tried to use adb remount, but it says inaccessible or not found.
I tried to use ...
0
votes
0
answers
48
views
Application rejected Unsafe Encryption androidx.transition.u.P
I have submitted my application on play store and It is rejected with following errors:
Your app contains unsafe cryptographic encryption patterns. Please see this Google Help Center article for ...
0
votes
1
answer
136
views
BiometricPrompt Error cases for onAuthenticationError() after update to latest version
I have updated the version of a library
from: `
from 'androidx.biometric:biometric:1.0.1' to -> 'androidx.biometric:biometric:1.1.0'
I saw that there are new possible errors and I was wondering ...
0
votes
0
answers
58
views
Google Play Store Notification to remove the app || SSL Error Handler Security Vulnerability
I am recently getting security vulnerabilities regarding the SSL Error Handler.
I have checked many stackoverflow question but couldnt come to a conclusion to how to fix it. Some recent answers are ...
0
votes
1
answer
120
views
How to convert java.security.PrivateKey to JWK (JSON) format in Android?
I have seen some examples to convert java.security.PublicKey to JWK but I could not find an example to convert java.security.PrivateKey to JWK (JSON) format in Android. Is that even possible? Is there ...
0
votes
0
answers
17
views
HostnameVerifier is not safe
I submitted an app review on the google store and it prompted me that HostnameVerifier is not safe,As shown here is my code, I don't know where is the problem
Can anyone help me with this ...
0
votes
0
answers
63
views
I got this email from google play console team regarding my app. "your app uses software that contains security vulnerabilities for users"
JavaScript Interface Injection
Your app(s) are using a WebView that is vulnerable to JavaScript interface injection.
To address this issue, follow the steps in this Google Help Center article.
in.glg....
0
votes
0
answers
57
views
android-security ... How do I fix this jquery security alert: "Your app contains one or more libraries with known security issues"
In my Play Developer console I see the following message for an updated android app I have in my store:
Vulnerable Libraries
Your app contains one or more libraries with known security issues. Please ...
2
votes
1
answer
209
views
Reflection on Jetpack Compose
Currently, I’m creating a new SDK that contains sensitive fields that shouldn’t be read by the consumers (Think Credit Card Number field) and I’m using Jetpack Compose to create the forms, my question ...
1
vote
0
answers
456
views
How to fix apps with bad WebRTC versions
I am an Android developer.
I released an app for internal public testing and the following error was listed in the pre-release report summary.
"How to fix apps with bad WebRTC versions."
...
0
votes
0
answers
18
views
How to fix apps containing an unsafe implementation of TrustManager and HostnameVerifier
After upload my apps in Google play Store, getting a mail from google that the app are using an unsafe implementation of the TrustManager and HostnameVerifier. How to fix this problem? Can someone ...
2
votes
0
answers
88
views
how to detect root status in android device
I created an app and added root detection. I searched it on internet and discussed it on some forums, but nothing works. Can someone help me about this issue?
I tried these several possibility ...
0
votes
0
answers
16
views
How to verify if user has updated SECURITY_PATCH?
As far as I understand, SECURITY_PATCH is a date of creation of last applied security patch, but what's the actual usage of this field?
Patches differ within different manufacturers, but is there any ...
0
votes
1
answer
21
views
How to disallow emulator, isdebuggable check for debug build
I am resolving some security defects for my app.
Defect is:
Should not allow release app to be run in emulator
Release app should not be debuggable
Should not connect to debugger
Release app should ...
4
votes
1
answer
2k
views
Link to a working webRTC library for Android
Google play have a new error/warning from the last days about the WebRTC library that I use. I use this library for almost a year.
google-webrtc-1.0.32006.aar
My app is still available but they ask ...
0
votes
0
answers
29
views
How to prevent from reaching breakpoints in android library project
I've created an android closed source library with java that enabled the ProGuard rule.
In a class I have a byte array variable which is very important and no one should see its value.
I pass the byte ...
0
votes
1
answer
144
views
AES/ECB/NoPadding Unsafe Encryption Mode error
I have an error in Google play, AES/ECB/NoPadding Unsafe Encryption Mode Usage, I rely on it to communicate with beacons in the field, and for my API (which also uses this encryption). It contains no ...
0
votes
1
answer
98
views
Your app is using a version of libjpeg-turbo containing a security vulnerability
Google play store gives me this error when I am trying to send my application for review.
Your app is using a version of libjpeg-turbo containing a security
vulnerability. Please see this Google Help ...
1
vote
0
answers
57
views
Leaked GCP API Keys
We have followed the google instructions on how to prevent this error from coming up in Play Store. i.e. our keys are specified in the gradle local.properties file. We built and are referencing the ...
0
votes
0
answers
42
views
LocationManager.isProviderEnabled(LocationManager.NETWORK_PROVIDER) throws SecurityException only on some devices
The following code works flawlessly on the vast majority of devices according to an app's analytics:
LocationManager lm = (LocationManager) activity.getApplicationContext().getSystemService(Context....
1
vote
0
answers
88
views
Your app(s) are vulnerable to Intent Redirection. From com.facebook.CustomTabMainActivity
I get this this notify from google play when I summit my react native app.
I have tried many ways, but after 10 time submit to store, it still doesn't work
Your app(s) are vulnerable to Intent ...
0
votes
0
answers
103
views
MobileIron - Bypass Unknown Sources
I have a question:
I have MobileIron (with MTD) and I have disabled all the folders that allow possible installation:
My Files / Chrome / Drive / Messages / etc, etc.
I have also thought about ...
2
votes
2
answers
575
views
Frida: nothing happens when hooking function
Hello I'm trying to hook a function that stores variables in some interface, but when I do, nothing happens, there no error, no log.
Function I'm trying to hook looks like this:
package ...
1
vote
0
answers
202
views
"AndroidKeyStore" with custom passcode or different provider with secure hardware protection
I'm implementing SCA (Strong Customer Authentication) on Android. There are 3 factors on SCA which are following:
Something you know (customer's 6 digit passCode)
Something you have (device secure ...
1
vote
0
answers
53
views
Zip Path Traversal com.android.vending.expansion.downloader.R$string.decompress
I am using this code to download expansion file. and I am getting alert "Zip Path Traversal" "com.android.vending.expansion.downloader.R$string.decompress"
Noting that I am not ...
0
votes
1
answer
31
views
Android: Is there an idea to lock (block) only certain activity?
Android: I don't want to block an entire app (which AppLock does), but I just want to block a certain activity from it. What ideas or app are there?
0
votes
0
answers
141
views
Cordova Webview SSLErrorHandler, playstore rejects after few days since released
i have a problem with cordova application: when i publish app on playstore, after few days the app will be removed because of vulnerability to Webview SSLErrorHandler. I tried a lot of solution found ...
0
votes
0
answers
92
views
TrustManager vulnerability
I got a warning about TrustManager vulnerability and the update was not accepted by Google. How can I pass this error? this is my code.
public static void nuke() {
try {
TrustManager[] ...
3
votes
1
answer
744
views
How to detect screen mirroring in android when my mobile screen is shared using teams presentation?
For enhanced security of My Android App, I need to detect the screen mirrioring. I have implemented this below source code:
var display : DisplayManager = getSystemService(DISPLAY_SERVICE) as ...
0
votes
1
answer
170
views
How to solve intent redirection?
We added option 3 by Remediation for Intent Redirection Vulnerability
Intent intent = this.activity.getIntent();
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
intent.removeFlags(...
0
votes
0
answers
198
views
How to Fix Leaked GCP FCM Server Keys, expose FCM server keys?
After I published my app to the google play console. The google play support warns me that they found
security vulnerabilities for users
Leaked GCP FCM Server Keys
Your app(s) expose FCM server keys.
...
0
votes
0
answers
35
views
Play unmutable sound, at a fixed volume in android
I am working on an Android Security App which should produce an unmutable sound, at a fixed volume, when certain actions are done
I Have tried media player, but it is getting reduced by volume buttons,...
0
votes
0
answers
39
views
Leaked GCP FCM Server Keys Your app(s) expose FCM server keys. To address this issue, follow the steps in this Google Help Center article
I'm using firebase cloud messaging for device to device messaging. before publish app it was working fine but after publish its not working and i got this warning. can anyone help me to fix that
enter ...
0
votes
0
answers
59
views
How to publish legacy android app with "unsafe encryption" error?
We use AES encryption with static key and static vector.
Encryption and decryption of data made on Windows, MacOS and Android.
We know it is not secure to store the key in the app and we do not care ...
0
votes
0
answers
49
views
Fixing apps that host an unsafe use of TrustManager
I got an e-mail from google.
How can i solve this problem. What should I check first?
Here is the code block that I think is wrong.
private static void allowAllSSL() {
@SuppressLint("...
0
votes
0
answers
2k
views
Android Root Detection is bypassed using Frida
I have to prevent my native mobile application from getting bypassed from root detection using FRIDA. Currently I'm using RootBeer mechanism for root detection, which is getting bypassed by using the ...
0
votes
0
answers
221
views
Android Intent Scheme Hijacking
I have problem with "Your app(s) are using a WebView that is vulnerable to Intent scheme hijacking."
This is my code.
@Override
public boolean shouldOverrideUrlLoading(WebView view, String ...
0
votes
1
answer
45
views
Secure management of local counter on Android
I'd like to develop a simple Android application that authorizes access to a server in the following way:
The app stores a local counter t_count of access tokens which initializes at t_count = X;
...