Android (DRD)

50. Android (DRD)

Skip to end of metadata

• Created by Robert Seacord, last modified by Lori on Apr 09, 2014

Go to start of metadata

The following rules and guidelines are specific only to the Android platform. These do not apply to the development of Java or C programs for non-Android platforms. (The full set of Android -relevant rules and guidelines are here.) The term sensitiveincorporates the Java glossary definition of sensitive data, as well as the Android concept of permission-protected.

• Page:
  DRD00-J. Do not store sensitive information on external storage (SD card)
• Page:
  DRD01-J. Limit the accessibility to your sensitive content provider
• Page:
  DRD02-J. Do not allow WebView to access sensitive local resource through file scheme
• Page:
  DRD03-J. Do not broadcast sensitive information using an implicit intent
• Page:
  DRD04-J. Do not log sensitive information
• Page:
  DRD05-J. Do not grant URI permissions on implicit intents
• Page:
  DRD06-J. Do not act on malicious intents
• Page:
  DRD07-J. Protect exported services with strong permissions
• Page:
  DRD08-J. Always canonicalize a URL received by a content provider
• Page:
  DRD09-J: Restrict access to sensitive activities
• Page:
  DRD10-J. Do not release apps that are debuggable
• Page:
  DRD11-J. Ensure that sensitive data is kept secure
• Page:
  DRD12-J. Do not trust data that is world writable
• Page:
  DRD13-J. Do not allow JavaScript in Web Apps
• Page:
  DRD14-J. Check that a calling app has appropriate permissions before responding
• Page:
  DRD15-J. Consider privacy concerns when using Geolocation API
• Page:
  DRD16-J. Explicitly define the exported attribute for private components
• Page:
  DRD17-J. Do not use the Android cryptographic security provider encryption default for AES
• Page:
  DRD18-J. Do not use the default behavior in a cryptographic library if it does not use recommended practices
• Page:
  DRD19-J. Properly verify server certificate on SSL/TLS

Risk Assessment Summary

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
DRD00-J	high	probable	medium	P12	L1
DRD01-J	high	probable	low	P18	L1
DRD02-J	high	probable	high	P6	L2
DRD03-J	High	Probable	Medium	P12	L1
DRD04-J	High	Probable	Medium	P12	L1
DRD05-J	High	Probable	Medium	P12	L1
DRD06-J	High	Probable	Medium	P12	L1
DRD07-J	High	Probable	Medium	P12	L1
DRD08-J	High	Probable	Low	P18	L1
DRD09-J	High	Probable	Medium	P12	L1
DRD10-J	High	Probable	Low	P18	L1
DRD11-J	High	Probable	Medium	P12	L1
DRD12-J	High	Probable	Medium	P12	L1
DRD13-J	High	Probable	Medium	P12	L1
DRD14-J	High	Probable	Medium	P12	L1
DRD15-J	low	probable	medium	P6	L2
DRD16-J	Medium	Probable	Medium	P8	L2
DRD17-J	High	Likely	Medium	P18	L1
DRD18-J	High	Likely	Medium	P18	L1
DRD19-J	high	probable	medium	P12	L1