Android Security: Don't leave WebView debugging enabled in production

Ashish Bhatia — Wed, 14 Aug 2019 06:00:16 +0000

WebView debugging can be enabled via WebView.setWebContentsDebuggingEnabled(true). Leaving WebView debugging enabled in production Android apps is a bad idea. Anyone who gets hold of the unlocked phone can access the app’s data forever.

Consider this, the Tripit app exposes WebView debugging and by using that I can read all the files inside the private data directory. As an example, by connecting a user’s unlocked mobile phone to my laptop, I can extract TripIt OAuthToken.

First connect the phone via ADB, open chrome://inspect in the Chrome browser, then enter the following in there.

window.location="file:///data/data/com.tripit/shared_prefs/com.tripit.xml"
document.getElementsByTagName("html")[0].innerHTML

Now, you can see all the entries like

<string name=”oauthTokenSecret”>f731d36cdbf9006f917307…</string>

These auth tokens can be copied and used to get permanent access to the user’s TripIt account.

Original post at ashishb.net

Introducing ADB-enhanced: A swiss army knife for Android development

Ashish Bhatia — Sun, 03 Feb 2019 23:14:11 +0000

Android development requires tons of disconnected approaches for the development and testing. Consider some scenarios

To test runtime permission – Go to Settings -> Applications -> Application info of the app you are looking for and disable that permission.
To test a fresh install – adb shell pm clear-data com.example
To test your app under the battery saver mode – turn on the battery saver mode by expanding the notification bar
To stop the execution of an app – kill it via activity manager, adb shell am kill com.example
To test your app under doze mode – first, make the device believe that it is unplugged via adb shell dumpsys battery unplug, then, make it think that it is discharging via adb shell dumpsys battery set status 3, and then enable doze mode via adb shell dumpsys deviceidle force-idle. And don’t forget to execute a set of unrelated complementary commands once you are done to bring the device back to the normal state.
To see the overdraw of an app – Go to the developer options and enable/disable it there.

Over time, this became a significant mental burden that I first wrote some of these flows in a text file and then converted them to automated shell scripts. But when even that felt insufficient, I created a tool for myself called adb-enhanced.
How it works:
First, install the tool. I wrote this in Python, so, if the following command does not work, install Python

pip3 install adb-enhanced # I would discourage Python 2 based install at this point

Now, let’s look at the about use-cases again with this tool:

To test a runtime permission :

# Use grant instead of revoke to grant the permission
adbe permission revoke com.example camera  # See all possible such permissions via "adbe -h"

# Use grant instead of revoke to grant the permission
adbe permission revoke com.example camera  # See all possible such permissions via "adbe -h"

To test a fresh install –

# Unlike adb shell pm clear-data com.example, this command will 
# produce an error if com.example is not installed 
# which is good for catching typos
adbe clear-data com.example
# Unlike adb shell pm clear-data com.example, this command will 
# produce an error if com.example is not installed 
# which is good for catching typos
adbe clear-data com.example

To test your app under the battery saver mode –

# As you would guess, use "off" to turn the battery saver off
adbe battery saver on
# As you would guess, use "off" to turn the battery saver off
adbe battery saver on

To stop the execution of an app –

# For a more aggressive kill, try adbe force-stop com.example
adbe stop com.example

To test your app under doze mode

adbe doze on # Use "off" to turn the doze mode off

To see the overdraw of the app

adbe overdraw on

I open-sourced the code at https://github.com/ashishb/adb-enhanced. See the GitHub repository for what all this tool can do. Feedbacks and pull requests are welcome.

DEV Community: Ashish Bhatia

Android Security: Don't leave WebView debugging enabled in production

Introducing ADB-enhanced: A swiss army knife for Android development