Android security

Welcome to my post about android and it's security.

Sorry this might be hard to read as I'm very bad writer and my native language isn't English, I TRY MY BEST!

In this post I’m going to explain some basic stuff you should know.

Let’s start from the basic consent model.

**kernel** is core of the android operating system, software that handles the GPU, system memory and system devices including file systems and networking. It servers as link between software and hardware, kernel security comes with great big power but it also comes with big responsibility. **Kernel security** determines overall security of the whole system. Androids kernel is based on **Linux**.

Security of the Android OS is based around the following key security features of the Linux kernel:

* Process Isolation
* User-Based Permission Model
* Inter-Process Communication (IPC)

Sandboxing:
Android uses the Linux permissions model to isolate application resources.

This process in called application sandbox.
kuva

Sandbox prevents malicious programs from interacting with the protected app.
Internal operating system components are also protected by the sandbox. Vulns exposed by an application cannot be exploited to gain access to the outer system.

Secure communication between apps is ensured by the Linux user-based protection.
Unlike traditional operating systems like MacOS and Windows, Android uses the User ID (UID) concept to manage an application’s
access control and not the system users access control. App is prohibited from accessing other application’s data or system features without permissions.

APPLICATION SECURITY

The security aspect of application is often overlooked. The lack of concern can determine the application to transform into an attack vector, leveraged by malicious actors.

Permissions in Android: the user’s privacy is protected by the means of permissions. Android applications requires the users consent to perform actions like see GPS location, see contact and other sort of permissions that application might ask you for.

Permissions required by an application are declared in the AndroidManifest.xml. Every permission is specified in its own uses-permission tag.

Android has 3 types of storage, Internal storage: Data stored here is visible only to the corresponding application, External storage: Data stored in external storage is globally readable and writable, Content providers: They provide an abstraction over the data stored. With the use of content providers, we have more control over the read and write permissions.

2 Likes

i love this thread, it is correct and right. i believe android could up its security such as appstore, APK warnings, and just a good system for keeping things sand boxed as some android systems don’t do that for whatever reason.

Though this a great and gives the common user a good map and layout of the linux kernel,Storage system, and Code. But this also gives hackers and malware writers a chance to take advantage of this if not taken extra precautions.

Firejail is a great option for stuff like this if you are on a linux system and want to be more secure.

2 Likes

This is not hard to read, and it does not seem obvious (to me) that English is not your second language. Thank you for your efforts and for increasing awareness of Android security.

1 Like

thank you for sharing such a great thread.