Android Security Validator

An automated security validation system for Android applications. This tool orchestrates ADB and Appium to verify:

• Runtime Integrity: Debuggable flags, Logcat leaks, Manifest settings.
• Storage Confidentiality: Plaintext sensitive data in private storage (Requires Root).
• Network Security: Resilience against MITM attacks (Certificate Pinning).

Prerequisites

• Node.js (v14+)
• ADB installed and in PATH.
• Appium Server running (npm install -g appium && appium).
• Android Emulator (AOSP Image recommended for Root access).

Installation

npm install -g android-sec-val
# OR run directly from source
npm install
npm run build

Usage

Start your Appium server and Emulator first.

# General Usage
android-sec-val validate --package com.example.app

# With APK install and custom sensitive strings
android-sec-val validate \
  --package com.example.app \
  --apk ./path/to/app.apk \
  --sensitive password token auth_key

Options

| Option | Alias | Description | Default | |--------|-------|-------------|---------| | --package | -p | Target Android Package Name | (Required) | | --apk | -a | Path to APK to install | undefined | | --sensitive | -s | List of strings to grep for in storage | ['password', 'token', ...] | | --output | -o | JSON Report Path | security_report.json |

Security Checks

Runtime

1. Debuggable Flag: Checks android:debuggable.
2. Manifest Analysis: Checks allowBackup and usesCleartextTraffic.
3. Logcat Leakage: Monitors logs for provided sensitive strings.

Storage (Requires adb root)

4. Local Storage Inspection: Recursively greps /data/data/<pkg> for sensitive strings.
5. Cache Hygiene: Checks /data/data/<pkg>/cache for excessive data persistence.
6. External Storage: Checks /sdcard/Android/data/<pkg> and Downloads for leakage.

Network

7. Network Logic: Currently supports manual network validation hooks (see source).

Static Analysis

8. Exported Components: Detects insecurely exported Activities/Services.
9. Permission Audit: Flags dangerous permissions (SMS, Contacts, Location).
10. Hardcoded Secrets: Extracts APK from device and scans for keys (AWS, Bearer, etc.).

Threat Model Coverage (Exploits Detected)

This tool validates defenses against the following specific attack vectors:

| Vulnerability Class | Exploit / Threat Scenario | Validated By Check | |---------------------|---------------------------|-------------------| | Insecure Data Storage | Attacker with physical access (or malware) dumps /data/data to steal Auth Tokens or PII. | checkStorageIntegrity (asserts encryption) | | Data Leakage | Sensitive data (passwords, tokens) printed to system logs (logcat) visible to other apps/USB. | checkLogcatLeakage | | Runtime Tampering | Attacker attaches JDWP debugger to inspect memory or hook methods. | checkDebuggable | | Network Interception | Attacker on public WiFi (MITM) presents fake cert to steal inflight data. | checkNetworkSecurity (Pinning) | | Backup Theft | Attacker uses adb backup to extract app data without root. | checkManifestSettings (allowBackup) | | Cleartext Transmission | App accidentally sends HTTP traffic exposing data to passive monitoring. | checkManifestSettings (usesCleartextTraffic) | | Cache Leakage | Sensitive images/responses persist in cache/ after logout/exit. | checkCacheHygiene |

Report

The tool generates a JSON report:

[
  {
    "check_name": "debuggable_flag",
    "status": "PASS",
    "severity": "LOW",
    "evidence": "Application is NOT debuggable",
    "category": "RUNTIME"
  }
]