Android Security Internals

Android Security Internals

An In-Depth Guide to Android's Security Architecture
by Nikolay Elenkov
October 2014, 432 pp.
ISBN-13: 
978-1-59327-581-5

"I honestly didn’t believe I’d learn much from the book because I’ve been working on Android security for many years. This belief could not have been more wrong. Android Security Internals has earned a permanent spot on my office bookshelf."
—Jon “jcase” Sawyer, from the Foreword

There are more than one billion Android devices in use today, each one a potential target. Unfortunately, many fundamental Android security features have been little more than a black box to all but the most elite security professionals—until now.

In Android Security Internals, top Android security expert Nikolay Elenkov takes us under the hood of the Android security sys­tem. Elenkov describes Android security archi­tecture from the bottom up, delving into the imple­mentation of major security-related components and subsystems, like Binder IPC, permissions, cryptographic providers, and device administration.

You’ll learn:

  • How Android permissions are declared, used, and enforced
  • How Android manages application packages and employs code signing to verify their authenticity
  • How Android implements the Java Cryp­­­tog­raphy Architecture (JCA) and Java Secure Socket Extension (JSSE) frameworks
  • About Android’s credential storage system and APIs, which let applications store cryptographic keys securely
  • About the online account management framework and how Google accounts integrate with Android
  • About the implementation of verified boot, disk encryption, lockscreen, and other device security features
  • How Android’s bootloader and recovery OS are used to perform full system updates, and how to obtain root access

With its unprecedented level of depth and detail, Android Security Internals is a must-have for any security-minded Android developer.

Author Bio 

Nikolay Elenkov has been working on enter­prise security–related projects for more than 10 years. He became interested in Android shortly after the initial public release and has been developing Android applications since version 1.5. His work has led to the discovery and correction of significant Android security flaws. He writes about Android security on his highly regarded blog, nelenkov.blogspot.com.

Table of contents 

Foreword by Jon Sawyer
Acknowledgements
Introduction

Chapter 1: Android's Security Model
Chapter 2: Permissions
Chapter 3: Package Management
Chapter 4: User Management
Chapter 5: Cryptographic Providers
Chapter 6: Network Security and PKI
Chapter 7: Credential Storage
Chapter 8: Online Account Management
Chapter 9: Enterprise Security
Chapter 10: Device Security
Chapter 11: NFC and Secure Elements
Chapter 12: SELinux
Chapter 13: System Updates and Root Access

Index

View the detailed Table of Contents (PDF)

View the Index (PDF)

Reviews 

"If you are an Android application developer or breaker, you should definitely read this book."
—Michele Orrù, BeEF core developer and coauthor of The Browser Hacker's Handbook

"A deep look at Android from both the operating system internals and security perspective."
—Andrew Case, Volatility core developer and coauthor of The Art of Memory Forensics

"Not only does this book provide an invaluable and even essential course in security, it will deepen your understanding of the OS generally."
—Steve Mansfield-Devine, editor of Elsevier's Network Security Newsletter

"An excellent coverage of all things Android security."
—IT World (Read More)

"Every Android developer should have this book on their bookshelf."
—SYS-CON Media (Read More)

"Highly recommended."
—I Programmer (Read More)

"This book is amazing and one of the most comprehensive Android texts I have read to date."
—Dan Borges, LockBoxx

Updates 

View the latest errata.