Android Security Improvement update: Helping developers harden their apps, one thwarted vulnerability at a time




Posted by Patrick Mutchler and Meghan Kelly, Android Security & Privacy Team




Helping Android app developers build secure apps, free of known vulnerabilities, means helping the overall ecosystem thrive. This is why we launched the Application Security Improvement Program five years ago, and why we're still so invested in its success today.


What the Android Security Improvement Program does





When an app is submitted to the Google Play store, we scan it to determine if a variety of vulnerabilities are present. If we find something concerning, we flag it to the developer and then help them to remedy the situation.




Think of it like a routine physical. If there are no problems, the app runs through our normal tests and continues on the process to being published in the Play Store. If there is a problem, however, we provide a diagnosis and next steps to get back to healthy form.



Over its lifetime, the program has helped more than 300,000 developers to fix more than 1,000,000 apps on Google Play. In 2018 alone, the program helped over 30,000 developers fix over 75,000 apps. The downstream effect means that those 75,000 vulnerable apps are not distributed to users with the same security issues present, which we consider a win.


What vulnerabilities are covered





The App Security Improvement program covers a broad range of security issues in Android apps. These can be as specific as security issues in certain versions of popular libraries (ex: CVE-2015-5256) and as broad as unsafe TLS/SSL certificate validation.



We are continuously improving this program's capabilities by improving the existing checks and launching checks for more classes of security vulnerability. In 2018, we deployed warnings for six additional security vulnerability classes including:



  1. SQL Injection
  2. File-based Cross-Site Scripting
  3. Cross-App Scripting
  4. Leaked Third-Party Credentials
  5. Scheme Hijacking
  6. JavaScript Interface Injection



Ensuring that we're continuing to evolve the program as new exploits emerge is a top priority for us. We are continuing to work on this throughout 2019.



Keeping Android users safe is important to Google. We know that app security is often tricky and that developers can make mistakes. We hope to see this program grow in the years to come, helping developers worldwide build apps users can truly trust.

Komentar

Posting Komentar

Postingan populer dari blog ini

Google Play Referrer API: Track and measure your app installs easily and securely

Gambar
it is crucial to helping you make the right product and marketing decisions. This is especially important when you're deciding your advertising strategy and budget. "> Posted by Neto Marin, Developer Advocate Understanding how people find your app and what they do once they've installed it is crucial to helping you make the right product and marketing decisions. This is especially important when you're deciding your advertising strategy and budget. Today many app measurement companies and ad networks offer ad attribution solutions based on referral data. As such accurate install referral data is vital for correctly attributing app installs, as well as discounting fraudulent attempts for install credit. To help you obtain more accurate and reliable data about your installs, we're introducing the Google Play Install Referrer API , a reliable way to securely retrieve install referral content. Using this API, your app will get precise information straight from the P...
Baca selengkapnya

Boosting developer success on Google Play

Gambar
Posted by Sameer Samat, VP, Product Management Helping developers build sustainable businesses is a core part of Google Play’s mission. We work with partners every day to understand the challenges they face and help them bring their innovative ideas to life. Getting a new app off the ground and into orbit is not easy! To aid their quest for growth we provide a broad range of support, from powerful marketing tools and actionable data in the Play Console , education via Play Academy , "> best practices and thought leadership resources, programs such as the Indie Games Festival , Indie Corner , and accelerator programs around the world. We’re always looking for new ways to give them an added boost. Starting on July 1, 2021 we are reducing the service fee Google Play receives when a developer sells digital goods or services to 15% for the first $1M (USD) of revenue every developer earns each year. With this change, 99% of developers globally that sell digital goods and servic...
Baca selengkapnya

And the 2019 Google Play Award nominees are...

Gambar
Posted by Purnima Kochikar, Director, Apps and Games Business Development, Google Play Drum roll please! To kick off Google I/O this year, the 2019 Google Play Awards will take place on Monday, May 6th. We’re excited to highlight nine categories this year, some familiar and some new, to recognize developers that continue to set the bar for quality apps and games on Google Play. Building on previous years, we celebrate our fourth year by recognizing some of the best experiences available on Android, with an emphasis on overall quality, strong design, technical performance, and innovation. The nominees were selected by various teams across Google, and meet criteria thresholds covering high star rating, Android vitals, and have had a launch or major update since April 2018. Congratulations to this year’s nominees below and remember to check them out on Google Play at play.google.com/gpa2019 . Stay tuned as we announce the winners of each category at Google I/O. Standout Well-Being App App...
Baca selengkapnya