Android Application Security Fundamentals - Basic

1. 01

   Module 1: Android Platform Fundamentals

   11 topics

   • Android operating system architecture
   • Linux kernel-based security model (application-level perspective)
   • Sandbox model and UID isolation
   • Permission model and process architecture
   • ART and Dalvik Virtual Machine fundamentals
   • JIT and AOT compilation processes
   • Dex bytecode structure
   • Android application signing mechanisms
   • SELinux operational model
   • Application lifecycle and memory model
   • Emulator vs physical device differences
2. 02

   Module 2: Permission Model & Secure Component Design

   6 topics

   • Core principles of the Android permission model
   • Normal vs Dangerous permissions
   • Runtime permission flow
   • Over-privileged application concept
   • Secure component design principles
   • Common permission and exported component misconfigurations
3. 03

   Module 3: Inter-Process Communication (IPC) & Data Flow Security

   7 topics

   • Android IPC architecture
   • Data flow through Intents, Binder, and ContentProviders
   • Cross-application communication model
   • Risks associated with exported components
   • Trust boundary concept
   • Security implications of poorly designed data flows
   • Differences between intra-app and inter-app data trust levels
4. 04

   Module 4: Secure Storage & Data-at-Rest Principles

   6 topics

   • Data storage mechanisms in Android
   • Internal vs external storage differences
   • Security risks of SharedPreferences misuse
   • Android Keystore purpose and limitations
   • Consequences of improper sensitive data handling
   • Secure data storage design principles
5. 05

   Module 5: Cryptography in Mobile Applications

   7 topics

   • Confidentiality, integrity, and authenticity concepts
   • Symmetric vs asymmetric encryption
   • The role of AES, RSA, and SHA-256 in mobile applications
   • HMAC and data integrity verification
   • Importance of secure random number generation (SecureRandom)
   • Limitations of client-side cryptography
   • Common cryptographic design mistakes
6. 06

   Module 6: Security Benchmarking & Standards

   4 topics

   • Overview of OWASP MASVS
   • OWASP Mobile Top 10 risk categories
   • Security requirements in mobile architecture
   • Security evaluation mindset
7. 07

   Module 7: Application Structure & Static Security Understanding

   7 topics

   • APK file structure
   • AndroidManifest.xml analysis
   • Activities, Services, Receivers, and Providers
   • Exported components and attack surface identification
   • Intent and deep link mechanisms
   • Introduction to classes.dex structure
   • Security-oriented static review approach
8. 08

   Module 8: Runtime Observation & Analysis Perspective

   4 topics

   • Android Debug Bridge (ADB) fundamentals
   • Basic observation techniques on emulator and physical devices
   • Analyzing application behavior through logcat
   • Evaluating runtime events from a security perspective
9. 09

   Module 9: Transport Security & Trust Model

   7 topics

   • Differences between HTTP and HTTPS
   • Risks of cleartext traffic in mobile applications
   • Android Network Security Configuration
   • High-level TLS handshake flow
   • Certificate validation process
   • Mobile application trust model
   • Limitations of client-side validation
10. 10

    Module 10: Security Analysis Tooling

    8 topics

    • Apktool: APK extraction and AndroidManifest.xml inspection
    • Jadx: Decompiled Java/Kotlin code browsing and logic review
    • Ghidra: High-level native library inspection (conceptual overview)
    • radare2: Native binary structure analysis (introductory navigation)
    • ADB: Runtime observation and application behavior inspection
    • Identifying application structure
    • Reviewing configuration issues
    • Observing runtime behavior

Learning Outcomes

By the end of this package, participants will:

• Analyze Android applications at an architectural level.
• Understand where security controls should be positioned.
• Identify root causes of common mobile security issues.
• Develop a secure design mindset for mobile applications.
• Build a solid foundation for advanced mobile security training.