Secure mobile development 2: platform, code quality, resilience and privacy
You apply the remaining four areas of MASVS-style requirements: building components and WebViews safely, handling input and dependencies, strengthening your own app against tampering and designing privacy in.
Level 301 · 23 lessons · 21 practice labs
Lessons
Platform interaction
- Secure component design: exported, permissions and signature protection
- Validating deep links
- WebView hardening: JavaScript, bridges and file access
- PendingIntents and data leaking through notifications
- UI security: overlays, screen protection, autofill
- Short task: harden a WebView whose bridge can read local files
Code quality
- Input validation: SQL, file path and intent injection
- Third-party library and SDK hygiene
- Memory safety in native code and compiler protections
- Enforcing updates and retiring old versions
- Short task: close the SQL injection in a provider with a parameterised query
Resilience
- What resilience can and cannot do
- Obfuscation with R8 and protecting the mapping file
- Integrity checks: signature verification and tamper detection
- Root, debugger and emulator detection: the limits
- App integrity verification on the server side
- Short task: turn off the debug flag and verbose logs in the release build
Privacy
- Data minimisation and purpose limitation
- Consent flows and permission rationale
- Identifiers: advertising ID, device ID and tracking
- A privacy-by-design review
- Short task: remove the unneeded fields sent to the analytics SDK
Capstone
- Capstone: review and fix a health app against all eight requirement areas
Practice labs
- Match an exported component in code and manifest: Find what data an exported activity reads from its intent in a project.
- Validate a deep link parameter: Fix code that uses an account number from a link without validation by adding a format check, and test it.
- Fix data leaking from a notification and its PendingIntent: Hide sensitive text shown on the lock screen, make the PendingIntent immutable and verify both fixes by test.
- List the WebView settings: Find the class that creates the WebView and write down which settings are on.
- Harden a WebView with file access on: Turn off file and content access, allow only your own domain and test the configuration with Robolectric.
- Narrow the JavaScript bridge: Reduce the bridge's exposed methods to the minimum, check the loaded URL against an allowlist and test that the bridge is not attached for a foreign URL.
- Block screenshots on a sensitive screen: Add the secure window flag to the balance screen and test that it is set.
- Turn off autocorrect and clipboard on a password field: Add the attributes in the login layout that stop leaks to the keyboard cache and the clipboard.
- Refuse touches under an overlay: Add the obscured-touch filter to the confirm button and show by unit test that an obscured event is ignored.
- Find the SQL query built by concatenation: Find the query concatenated with user input in the provider code.
- Close the SQL injection in a provider: Parameterise the query and test that a hostile selection string is rejected.
- Close a path traversal with a canonical path check: Fix download code that uses a file name directly with a canonical path check and write tests for three bad inputs.
- Find the unused SDK in the project: Find the library in the dependency list never called in the code and remove it.
- Turn on build protections for the native library: Add stack protection and FORTIFY to the CMake settings and confirm them in the built .so file.
- Write the check that retires old versions: Write logic that forces an update based on a minimum version from the server and test the boundary cases.
- Check the debug flag in a release build: Confirm the debuggable value in the release APK's manifest.
- Strip verbose logs from release with R8: Add the rule that removes log calls from the release build and show the strings are gone from the dex.
- Design the flow that verifies the integrity verdict on the server: Write the flow that moves a client-side signature check to server verification and test that a forged verdict is refused.
- Find the needless field in an analytics call: Find the email address added to an analytics event and remove it.
- Delay an SDK that starts before consent: Move a tracking SDK initialised at launch to after consent and test the order.
- Replace a permanent device ID with a resettable one: Move code that uses a hardware ID to an app-scoped random ID and test that it is renewed on account deletion.
About this course
You apply the remaining four areas of MASVS-style requirements: building components and WebViews safely, handling input and dependencies, strengthening your own app against tampering and designing privacy in.
What you will learn
- Platform interaction
- Code quality
- Resilience
- Privacy
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.