Android Security Internals is out

Baca Juga

Some six months after the first early access chapters were announced, my book has now officially been released. While the final ebook PDF has been available for a few weeks, you can now get all ebook formats (PDF, Mobi and ePub) directly from the publisher, No Starch Press. Print books are also ready and should start shipping tomorrow (Oct 24th). You can use the code UNDERTHEHOOD when checking out for a 30% discount in the next few days. The book will also be available from O'Reilly, Amazon and other retailers in the coming weeks.

This book would not have been possible without the efforts of Bill Pollock and Alison Law from No Starch, who edited, refined and produced my raw writings. +Kenny Root  reviewed all chapters and caught some embarrassing mistakes, all that are left are mine alone. Jorrit “Chainfire” Jongma reviewed my coverage of SuperSU and Jon “jcase” Sawyer contributed the foreword. Once again, a big thanks to everyone involved!

About the book

The book's purpose and structure have not changed considerably since it was first announced. It walks you through Android's security architecture, starting from the bottom up. It starts with fundamental concepts such as Binder, permissions and code signing, and goes on to describe more specific topics such as cryptographic providers, account management and device administration. The book includes excerpts from core native daemons and platform services, as well as some application-level code samples, so some familiarity with Linux and Android programming is assumed (but not absolutely required). 

Android versions covered

The book covers Android 4.4, based on the source code publicly released through AOSP. Android's master branch is also referenced a few times, because master changes are usually a good indicator of the direction future releases will take. Vendor modifications or extensions to Android, as well as  device-specific features are not discussed.

The first developer preview of Android 5.0 (Lollipop, then known only as 'Android L') was announced shortly after the first draft of this book was finished. This first preview L release included some new security features, such as improvements to full-disk encryption and device administration, but not all planned features were available (for example, Smart Lock was missing). The final Lollipop developer preview (released last week) added those missing features and finalized the public API. The source code for Lollipop is however not yet available, and trying to write an 'internals' book without it would either result in incomplete or speculative coverage, or would turn into an (rather though) exercise in reverse engineering. That is why I've chosen not to cover Android 5.0 in the book at all and it is exclusively focused on Android 4.4 (KitKat).

Lollipop is a major release, and as such would require reworking most of the chapters and, of course, adding a lot of new content. This could happen in an updated version of the book at some point. Not to worry though, some of the more interesting new security features will probably get covered right here, on the blog,  first.

With that out of the way, here is the extended table of contents. You can find the full table of contents on the book's official page.

Update: Chapter 1 is now also freely available on No Starch's site.

Table of contents

 Chapter 1: Android’s Security Model

• Android’s Architecture
• Android’s Security Model

Chapter 2: Permissions

• The Nature of Permissions
• Requesting Permissions
• Permission Management
• Permission Protection Levels
• Permission Assignment
• Permission Enforcement
• System Permissions
• Shared User ID
• Custom Permissions
• Public and Private Components
• Activity and Service Permissions
• Broadcast Permissions
• Content Provider Permissions
• Pending Intents

Chapter 3: Package Management

• Android Application Package Format
• Code signing
• APK Install Process
• Package Verification

Chapter 4: User Management

• Multi-User Support Overview
• Types of Users
• User Management
• User Metadata
• Per-User Application Management
• External Storage
• Other Multi-User Features

Chapter 5: Cryptographic Providers

• JCA Provider Architecture
• JCA Engine Classes
• Android JCA Providers
• Using a Custom Provider

Chapter 6: Network Security and PKI

• PKI and SSL Overview
• JSSE Introduction
• Android JSSE Implementation

Chapter 7: Credential Storage

• VPN and Wi-Fi EAP Credentials
• Credential Storage Implementation
• Public APIs

Chapter 8: Online Account Management

• Android Account Management Overview
• Account Management Implementation
• Google Accounts Support

Chapter 9: Enterprise Security

• Device Administration
• VPN Support
• Wi-Fi EAP

Chapter 10: Device Security

• Controlling OS Boot-Up and Installation
• Verified Boot
• Disk Encryption
• Screen Security
• Secure USB Debugging
• Android Backup

Chapter 11: NFC and Secure Elements

• NFC Overview
• Android NFC Support
• Secure Elements
• Software Card Emulation

Chapter 12: SElinux

• SELinux Introduction
• Android Implementation
• Android 4.4 SELinux Policy

Chapter 13: System Updates and Root Access

• Bootloader
• Recovery
• Root Access
• Root Access on Production Builds

Subscribe to receive free email updates: