Episode Details
Back to Episodes
Course 42 - Mobile Malware Analysis Fundamentals | Episode 5: Fundamentals, App Structure, and Knowledge Review
Published 1 month, 4 weeks ago
Description
Android Security & APK Architecture — Advanced Study Template1. Android Security ModelAndroid security is built around several fundamental objectives:
- Protecting user and application data
- Isolating applications from one another
- Controlling privileges
- Providing secure inter-process communication
- Restricting unauthorized access to system resources
The architecture combines traditional Linux security mechanisms with Android-specific controls.2. Linux FoundationAndroid is built on the Linux kernel, which provides fundamental capabilities such as:
- Process management
- Memory management
- Networking
- Device drivers
- Filesystem access
- User and group permissions
Android builds additional security mechanisms on top of these Linux primitives.3. Android Application SandboxOne of Android's most important security mechanisms is the application sandbox.Applications normally execute under distinct Linux identities, which limits their ability to interact with other applications.Conceptually:Android System │ ┌────┼────┐ │ │ │ App A App B App C │ │ │ UID A UID B UID C │ │ │ Sandbox Sandbox Sandbox This isolation helps prevent a compromised application from automatically accessing another application's private data.Security principleCompromise of one application should not automatically imply compromise of every application on the device.4. SELinuxAndroid also uses SELinux (Security-Enhanced Linux) to provide Mandatory Access Control (MAC).This adds another layer beyond traditional Linux discretionary permissions.Conceptually:Application Request ↓ Linux Permissions ↓ SELinux Policy ↓ Allow / Deny Even if a process has certain Linux-level permissions, SELinux policies can impose additional restrictions on what that process is allowed to do.5. Android Application Package — APKAndroid applications are distributed primarily as APK files.An APK is an archive containing the application's:
- Compiled code
- Resources
- Manifest
- Assets
- Configuration
- Supporting components
A simplified structure looks like:Application.apk │ ├── AndroidManifest.xml ├── classes.dex ├── resources.arsc ├── res/ ├── assets/ ├── lib/ └── META-INF/ For malware analysts, understanding this structure is fundamental.6. AndroidManifest.xmlThe Android Manifest is one of the most important files during APK analysis.It can contain information about:
- Package identity
- Application components
- Permissions
- Services
- Activities
- Broadcast receivers
- Content providers
- Intent filters
- Application configuration
Malware-analysis perspectiveThe manifest is often an excellent first point of investigation.For example, suspicious permissions or unexpected exported components can provide early indicators worth investigating further.7. ActivitiesAn Activity generally represents a user-facing application component.Examples include:
- Login screens
- Settings screens
- Main application interfaces
- Forms
Activities define how users interact with the application.Security relevanceAn analyst may examine:
- Exported activities
- Intent filters
- Deep links
- Input handling
- Inter-component communication
8. ServicesServices perform operations that may continue without a conventional foreground UI.They can be used for tasks such as:
- Background processing
- Network operations
- Synchronization
- Long-running application tasks
Malware relevanceMalware may attempt to use background compon
- Protecting user and application data
- Isolating applications from one another
- Controlling privileges
- Providing secure inter-process communication
- Restricting unauthorized access to system resources
The architecture combines traditional Linux security mechanisms with Android-specific controls.2. Linux FoundationAndroid is built on the Linux kernel, which provides fundamental capabilities such as:
- Process management
- Memory management
- Networking
- Device drivers
- Filesystem access
- User and group permissions
Android builds additional security mechanisms on top of these Linux primitives.3. Android Application SandboxOne of Android's most important security mechanisms is the application sandbox.Applications normally execute under distinct Linux identities, which limits their ability to interact with other applications.Conceptually:Android System │ ┌────┼────┐ │ │ │ App A App B App C │ │ │ UID A UID B UID C │ │ │ Sandbox Sandbox Sandbox This isolation helps prevent a compromised application from automatically accessing another application's private data.Security principleCompromise of one application should not automatically imply compromise of every application on the device.4. SELinuxAndroid also uses SELinux (Security-Enhanced Linux) to provide Mandatory Access Control (MAC).This adds another layer beyond traditional Linux discretionary permissions.Conceptually:Application Request ↓ Linux Permissions ↓ SELinux Policy ↓ Allow / Deny Even if a process has certain Linux-level permissions, SELinux policies can impose additional restrictions on what that process is allowed to do.5. Android Application Package — APKAndroid applications are distributed primarily as APK files.An APK is an archive containing the application's:
- Compiled code
- Resources
- Manifest
- Assets
- Configuration
- Supporting components
A simplified structure looks like:Application.apk │ ├── AndroidManifest.xml ├── classes.dex ├── resources.arsc ├── res/ ├── assets/ ├── lib/ └── META-INF/ For malware analysts, understanding this structure is fundamental.6. AndroidManifest.xmlThe Android Manifest is one of the most important files during APK analysis.It can contain information about:
- Package identity
- Application components
- Permissions
- Services
- Activities
- Broadcast receivers
- Content providers
- Intent filters
- Application configuration
Malware-analysis perspectiveThe manifest is often an excellent first point of investigation.For example, suspicious permissions or unexpected exported components can provide early indicators worth investigating further.7. ActivitiesAn Activity generally represents a user-facing application component.Examples include:
- Login screens
- Settings screens
- Main application interfaces
- Forms
Activities define how users interact with the application.Security relevanceAn analyst may examine:
- Exported activities
- Intent filters
- Deep links
- Input handling
- Inter-component communication
8. ServicesServices perform operations that may continue without a conventional foreground UI.They can be used for tasks such as:
- Background processing
- Network operations
- Synchronization
- Long-running application tasks
Malware relevanceMalware may attempt to use background compon