| This rule was developed in part by Stephanie Colton and Aashirya Kaushik at the October 20-22, 2017 OurCS Workshop (http://www.cs.cmu.edu/ourcs/register.html). For more information about this statement, see the About the OurCS Workshop page. |
|---|
Android allows the attribute android:debuggable to be set to true in the manifest, so that the app can be debugged. By default this attribute is disabled, i.e., it is set to false, but it may be set to true to help with debugging during development of the app. However, an app should never be released with this attribute set to true as it enables users to gain access to details of the app that should be kept secure. With the attribute set to true, users can debug the app even without access to its source code.
Noncompliant Code Example
This noncompliant code example shows an app that has the android:debuggable attribute set to true being accessed to reveal sensitive data.
$ adb shell shell@android:/ $ run-as com.example.someapp sh shell@android:/data/data/com.example.someapp $ id uid=10060(app_60) gid=10060(app_60) shell@android:/data/data/com.example.someapp $ ls files/ secret_data.txt shell@android:/data/data/com.example.some $ cat files/secret_data.txt password=GoogolPlex account_number=31974286
Clearly, with the android:debuggable attribute set to true, sensitive date related to the app can be revealed to any user.
Compliant Solution
Ensure that the android:debuggable attribute is set to false before the app is released:
android:debuggable="false
Note that some development environments (including Eclipse/ADT and Ant) automatically set android:debuggable to true for incremental or debugging builds but set it to false for release builds.
<configuration> <compilation debug="true"/> </configuration>
Risk Assessment
Releasing an app with its android:debuggable attribute set to true can leak sensitive information. In addition, the app is vulnerable to decompilation, resulting in alteration to source code.Attackers can leverage the additional information they gain from debugging output to mount attacks targeted on the framework, database, or other resources used by the application.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DRD10-J | High | Probable | Low | P18 | L1 |
Automated Detection
Automatic detection of the setting of the android:debuggable attribute is straightforward. It is not feasible to automatically determine whether any data that might be revealed by debugging the app is sensitive.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Bibliography
| ASP.NET Misconfiguration: Creating Debug Binary | http://www.ids-sax2.com/Knowledgebase/NetworkSecurity/Creating-Debug-Binary.htm |
1 Comment
Joseph C. Sible
This whole rule seems really broken. In particular:
There's two possible cases here: either that's the app's secret data that the user isn't meant to see, in which case this rule doesn't help anything since the user could just extract it from the APK directly, or it's the user's secret data, in which case this rule doesn't help anything since unless the phone is already completely compromised, only the user has ADB access.
Being decompilable is not a vulnerability, and
android:debuggablehas no effect on whether an app is decompilable.