Android Repository - Security Audit¶

Security Posture: ████████░░░░░░░░░░░░ 45% - NEEDS IMMEDIATE ATTENTION

// Utils.java
public static String AppToken = "f97f3496-a2c8-4c20-84ef-b5a8e6388038"; // Dev token
public static String AppTokenLive = "1234567890abcdef"; // Production token

public static String BaseURL = "https://dev2.innotech-sa.com/Psyter/Master/APIs/";
public static String BaseURLLive = "https://psyter.com.sa/APIs/";

public static boolean isLive = false; // Toggle for dev/prod

// Bearer tokens
public static String TokenPsyter = "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI...";
public static String TokenScheduling = "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI...";

# Anyone can decompile the APK
apktool d Psyter.apk
jadx Psyter.apk

# Search for tokens
grep -r "AppToken" Psyter/

# Result: All tokens exposed

// build.gradle
android {
    buildTypes {
        debug {
            buildConfigField "String", "API_TOKEN", "\"${PSYTER_DEV_TOKEN}\""
            buildConfigField "String", "BASE_URL", "\"${PSYTER_DEV_URL}\""
        }
        release {
            buildConfigField "String", "API_TOKEN", "\"${PSYTER_PROD_TOKEN}\""
            buildConfigField "String", "BASE_URL", "\"${PSYTER_PROD_URL}\""
        }
    }
}

// local.properties (NOT in VCS)
PSYTER_DEV_TOKEN=f97f3496-a2c8-4c20-84ef-b5a8e6388038
PSYTER_DEV_URL=https://dev2.innotech-sa.com/Psyter/Master/APIs/
PSYTER_PROD_TOKEN=<ROTATED_TOKEN>
PSYTER_PROD_URL=https://psyter.com.sa/APIs/

// Usage in code
String apiToken = BuildConfig.API_TOKEN;
String baseUrl = BuildConfig.BASE_URL;

// MySharedPreferences.java
public void SetPassword(String password) {
    editor.putString(this.Password, password); // Plain text!
    editor.commit();
}

public String GetPassword() {
    return prefs.getString(Password, "");
}

// Usage in LoginActivity.java
mySharedPreferences.SetPassword(password); // Stored as plain text

/data/data/com.psyter.www/shared_prefs/[package_name].xml

<?xml version="1.0" encoding="utf-8"?>
<map>
    <string name="UserName">user@email.com</string>
    <string name="Password">MyP@ssw0rd123</string> <!-- Plain text! -->
    <string name="TokenPsyter">Bearer eyJhbGc...</string>
</map>

// Use EncryptedSharedPreferences (AndroidX Security)
import androidx.security.crypto.EncryptedSharedPreferences;
import androidx.security.crypto.MasterKey;

// Create encrypted SharedPreferences
MasterKey masterKey = new MasterKey.Builder(context)
    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
    .build();

SharedPreferences securePrefs = EncryptedSharedPreferences.create(
    context,
    "secure_prefs",
    masterKey,
    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
);

// Store password securely
securePrefs.edit().putString("password", password).apply();

implementation 'androidx.security:security-crypto:1.1.0-alpha06'

// DON'T store passwords at all!
// Use token-based authentication instead
// Store only auth tokens with expiration

// AndroidNetworking calls without certificate pinning
AndroidNetworking.post(Utils.BaseURL + "Authenticate")
    .addHeaders("Authorization", "Bearer " + Utils.TokenPsyter)
    .addJSONObjectBody(jsonBody)
    .build()
    .getAsJSONObject(listener); // No certificate validation!

1. Attacker sets up fake Wi-Fi hotspot "Free Hospital WiFi"
2. User connects and opens Psyter app
3. Attacker intercepts HTTPS traffic using fake certificate
4. Attacker captures:
   - Login credentials
   - Bearer tokens
   - Medical data
   - Payment information

// 1. Add certificate pinning to OkHttpClient
import okhttp3.CertificatePinner;
import okhttp3.OkHttpClient;

CertificatePinner certificatePinner = new CertificatePinner.Builder()
    .add("psyter.com.sa", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
    .add("psyter.com.sa", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=") // Backup
    .add("innotech-sa.com", "sha256/CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC=")
    .build();

OkHttpClient client = new OkHttpClient.Builder()
    .certificatePinner(certificatePinner)
    .build();

// 2. Use with AndroidNetworking
AndroidNetworking.initialize(getApplicationContext(), client);

# Using openssl
openssl s_client -servername psyter.com.sa -connect psyter.com.sa:443 | \
    openssl x509 -pubkey -noout | \
    openssl rsa -pubin -outform der | \
    openssl dgst -sha256 -binary | \
    openssl enc -base64

<!-- res/xml/network_security_config.xml -->
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">psyter.com.sa</domain>
        <domain includeSubdomains="true">innotech-sa.com</domain>
        <pin-set expiration="2026-01-01">
            <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
            <pin digest="SHA-256">BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=</pin>
        </pin-set>
    </domain-config>
</network-security-config>

<!-- AndroidManifest.xml -->
<application
    android:networkSecurityConfig="@xml/network_security_config"
    ...>
</application>

// build.gradle

// BEFORE (Vulnerable)
implementation 'org.webrtc:google-webrtc:1.0.28513'
implementation 'com.google.firebase:firebase-messaging:15.0.0'
implementation 'com.google.code.gson:gson:2.8.5'
implementation 'com.squareup.picasso:picasso:2.4.0'

// AFTER (Secure)
implementation 'org.webrtc:google-webrtc:1.0.32006'
implementation 'com.google.firebase:firebase-messaging:23.4.0'
implementation 'com.google.code.gson:gson:2.10.1'
// Remove Picasso, use Glide only
// implementation 'com.squareup.picasso:picasso:2.4.0'

// PaymentWebActivity.java
String paymentUrl = Utils.BaseURLPayment + 
    "?amount=" + bookingAmount +
    "&userId=" + userId +
    "&bookingId=" + bookingId +
    "&userName=" + userName +
    "&userEmail=" + userEmail;

webView.loadUrl(paymentUrl); // Sensitive data in URL!

https://dev2.innotech-sa.com/Psyter/Master/Web/Client/BookingPaymentFromMobile
?amount=500
&userId=12345
&bookingId=67890
&userName=John+Doe
&userEmail=john.doe@email.com
&phoneNumber=+966501234567

// Use POST request with encrypted body
String paymentData = encryptPaymentData(jsonObject);

webView.postUrl(
    Utils.BaseURLPayment,
    paymentData.getBytes()
);

// OR use native payment SDK
PaymentSdkConfigurationDetails config = new PaymentSdkConfigurationDetails.Builder()
    .merchantId("merchant_id")
    .amount(bookingAmount)
    .currency("SAR")
    .build();

PaymentSdk.startCardPayment(this, config, paymentCallback);

// Unencrypted storage
SetUserName("user@email.com")          // Plain text
SetPassword("MyPassword123")           // Plain text
SetTokenPsyter("Bearer eyJhbGc...")    // Plain text
SetFirstName("John")                   // Plain text
SetDOB("1990-01-01")                   // Plain text (PHI)
SetGender("Male")                      // Plain text (PHI)

/data/data/com.psyter.www/shared_prefs/*.xml
/data/data/com.psyter.www/files/*.json
/data/data/com.psyter.www/cache/*

// Migrate to EncryptedSharedPreferences
// Encrypt files using androidx.security

implementation 'androidx.security:security-crypto:1.1.0-alpha06'

// Encrypted file storage
File encryptedFile = new EncryptedFile.Builder(
    context,
    file,
    masterKey,
    EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB
).build();

public void removePreferences() {
    try {
        editor.clear().apply(); // Simple clear, not secure wipe
    } catch (Exception e) {
        e.printStackTrace();
    }
}

public void secureLogout(Context context) {
    // 1. Clear SharedPreferences
    editor.clear().apply();

    // 2. Delete cache
    deleteCache(context);

    // 3. Clear WebView data
    WebStorage.getInstance().deleteAllData();
    CookieManager.getInstance().removeAllCookies(null);

    // 4. Clear image cache
    Glide.get(context).clearMemory();
    new Thread(() -> Glide.get(context).clearDiskCache()).start();

    // 5. Finish all activities and restart
    Intent intent = new Intent(context, LoginActivity.class);
    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK);
    context.startActivity(intent);
}

<!-- No network security config specified -->
<application
    android:usesCleartextTraffic="true" <!-- Default on API < 28 -->
    ...>
</application>

<application
    android:usesCleartextTraffic="false"
    android:networkSecurityConfig="@xml/network_security_config"
    ...>
</application>

<!-- res/xml/network_security_config.xml -->
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
</network-security-config>

OkHttpClient okHttpClient = new OkHttpClient.Builder()
    .connectTimeout(30, TimeUnit.SECONDS)
    .readTimeout(30, TimeUnit.SECONDS)
    .writeTimeout(30, TimeUnit.SECONDS)
    .build();

AndroidNetworking.initialize(getApplicationContext(), okHttpClient);

OkHttpClient client = new OkHttpClient.Builder()
    .addInterceptor(new SslErrorInterceptor())
    .eventListener(new EventListener() {
        @Override
        public void connectionFailed(Call call, InetSocketAddress address, 
                                     Proxy proxy, Protocol protocol, 
                                     IOException exception) {
            // Log SSL failures
            if (exception instanceof SSLException) {
                FirebaseCrashlytics.getInstance()
                    .recordException(exception);
            }
        }
    })
    .build();

1. Token expires after X hours
2. API call fails with 401 Unauthorized
3. User sees generic error message
4. User must manually log in again

// Implement token refresh interceptor
public class TokenInterceptor implements Interceptor {
    @Override
    public Response intercept(Chain chain) throws IOException {
        Request original = chain.request();

        // Add current token
        Request.Builder builder = original.newBuilder()
            .header("Authorization", "Bearer " + getCurrentToken());

        Response response = chain.proceed(builder.build());

        // If 401, refresh token and retry
        if (response.code() == 401) {
            synchronized (this) {
                String newToken = refreshToken();
                if (newToken != null) {
                    response.close();
                    Request newRequest = original.newBuilder()
                        .header("Authorization", "Bearer " + newToken)
                        .build();
                    return chain.proceed(newRequest);
                }
            }
        }

        return response;
    }
}

public class SessionManager {
    private static final long TIMEOUT = 15 * 60 * 1000; // 15 minutes
    private long lastActivityTime;

    public void onUserActivity() {
        lastActivityTime = System.currentTimeMillis();
    }

    public boolean isSessionValid() {
        return System.currentTimeMillis() - lastActivityTime < TIMEOUT;
    }

    public void checkSession() {
        if (!isSessionValid()) {
            // Auto-logout
            logout();
        }
    }
}

// In base activity
@Override
public void onUserInteraction() {
    super.onUserInteraction();
    SessionManager.getInstance().onUserActivity();
}

@Override
protected void onResume() {
    super.onResume();
    SessionManager.getInstance().checkSession();
}

// Implement BiometricPrompt
BiometricPrompt.PromptInfo promptInfo = new BiometricPrompt.PromptInfo.Builder()
    .setTitle("Psyter Login")
    .setSubtitle("Authenticate using biometric")
    .setNegativeButtonText("Use password")
    .build();

biometricPrompt.authenticate(promptInfo);

// LoginActivity.java - No client-side validation
String email = etEmail.getText().toString();
String password = etPassword.getText().toString();

// Direct API call without validation
loginUser(email, password); // SQL injection risk, XSS risk

// Implement input validation
public class InputValidator {

    public static boolean isValidEmail(String email) {
        return email != null && 
               Patterns.EMAIL_ADDRESS.matcher(email).matches() &&
               email.length() <= 255;
    }

    public static boolean isValidPassword(String password) {
        // At least 8 chars, 1 upper, 1 lower, 1 digit, 1 special
        String passwordRegex = "^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[@$!%*?&])[A-Za-z\\d@$!%*?&]{8,}$";
        return password != null && password.matches(passwordRegex);
    }

    public static String sanitizeInput(String input) {
        if (input == null) return "";

        // Remove HTML tags
        input = input.replaceAll("<[^>]*>", "");

        // Escape special characters
        input = StringEscapeUtils.escapeHtml4(input);

        // Limit length
        if (input.length() > 1000) {
            input = input.substring(0, 1000);
        }

        return input.trim();
    }
}

// Usage
if (!InputValidator.isValidEmail(email)) {
    showError("Invalid email format");
    return;
}

if (!InputValidator.isValidPassword(password)) {
    showError("Password must be at least 8 characters with uppercase, lowercase, digit, and special character");
    return;
}

// Sanitize before sending
String sanitizedDiaryEntry = InputValidator.sanitizeInput(diaryText);

public class RateLimiter {
    private Map<String, Queue<Long>> requestTimestamps = new HashMap<>();
    private static final int MAX_REQUESTS = 5;
    private static final long TIME_WINDOW = 60 * 1000; // 1 minute

    public boolean allowRequest(String apiEndpoint) {
        Queue<Long> timestamps = requestTimestamps.getOrDefault(
            apiEndpoint, new LinkedList<>());

        long now = System.currentTimeMillis();

        // Remove old timestamps
        while (!timestamps.isEmpty() && 
               now - timestamps.peek() > TIME_WINDOW) {
            timestamps.poll();
        }

        if (timestamps.size() >= MAX_REQUESTS) {
            return false; // Rate limit exceeded
        }

        timestamps.offer(now);
        requestTimestamps.put(apiEndpoint, timestamps);
        return true;
    }
}

// Usage
if (!rateLimiter.allowRequest("login")) {
    showError("Too many requests. Please try again in 1 minute.");
    return;
}

<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

<!-- Use scoped storage instead -->
<application
    android:requestLegacyExternalStorage="false"
    ...>
</application>

<!-- Only for specific media types -->
<uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
<!-- No WRITE permission needed with scoped storage -->

// Use MediaStore API
ContentValues values = new ContentValues();
values.put(MediaStore.Images.Media.DISPLAY_NAME, "profile.jpg");
values.put(MediaStore.Images.Media.MIME_TYPE, "image/jpeg");

Uri imageUri = getContentResolver().insert(
    MediaStore.Images.Media.EXTERNAL_CONTENT_URI, values);

<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />

// For Android 10+, use full-screen intent instead
Intent intent = new Intent(context, IncomingCallActivity.class);
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);

NotificationCompat.Builder builder = new NotificationCompat.Builder(context, CHANNEL_ID)
    .setFullScreenIntent(PendingIntent.getActivity(context, 0, intent, flags), true)
    .setPriority(NotificationCompat.PRIORITY_HIGH)
    .setCategory(NotificationCompat.CATEGORY_CALL);

# proguard-rules.pro
-keepattributes Signature
-keepattributes *Annotation*

# Too many -keep rules (weakens obfuscation)
-keep class com.psyter.www.** { *; } # Keeps EVERYTHING!

# Aggressive obfuscation
-repackageclasses ''
-allowaccessmodification
-optimizationpasses 5

# Encrypt strings
-adaptclassstrings
-adaptresourcefilenames
-adaptresourcefilecontents

# Remove logging in release
-assumenosideeffects class android.util.Log {
    public static *** d(...);
    public static *** v(...);
    public static *** i(...);
}

# Keep only necessary classes
-keep class com.psyter.www.DataModels.** { *; }
-keep class * implements android.os.Parcelable { *; }

# Don't keep everything!
# -keep class com.psyter.www.** { *; } # REMOVE THIS

// CollaborationMain.java
org.webrtc.Logging.enableLogToDebugOutput(Logging.Severity.LS_VERBOSE);
// Should only be in debug builds!

// Utils.java
Log.d("Psyter", "User password: " + password); // REMOVE!

// Use BuildConfig
if (BuildConfig.DEBUG) {
    org.webrtc.Logging.enableLogToDebugOutput(Logging.Severity.LS_VERBOSE);
}

// Use Timber for conditional logging
if (BuildConfig.DEBUG) {
    Timber.plant(new Timber.DebugTree());
}

**Priority:** MEDIUM

---

### 🟢 LOW-002: No Root Detection

**Location:** App initialization

**Description:**  
App doesn't detect or warn when running on rooted devices.

**Enhancement:**
```java
public class RootDetector {
    public static boolean isDeviceRooted() {
        return checkBuildTags() || checkSuperUserApk() || 
               checkRootManagementApps() || checkSuBinary();
    }

    private static boolean checkBuildTags() {
        String buildTags = Build.TAGS;
        return buildTags != null && buildTags.contains("test-keys");
    }

    private static boolean checkSuperUserApk() {
        return new File("/system/app/Superuser.apk").exists();
    }

    private static boolean checkRootManagementApps() {
        String[] packages = {
            "com.noshufou.android.su",
            "com.thirdparty.superuser",
            "eu.chainfire.supersu",
            "com.koushikdutta.superuser"
        };

        PackageManager pm = context.getPackageManager();
        for (String packageName : packages) {
            try {
                pm.getPackageInfo(packageName, 0);
                return true;
            } catch (PackageManager.NameNotFoundException e) {
                // Package not found
            }
        }
        return false;
    }

    private static boolean checkSuBinary() {
        String[] paths = {
            "/system/xbin/su",
            "/system/bin/su",
            "/sbin/su",
            "/data/local/su",
            "/data/local/xbin/su"
        };

        for (String path : paths) {
            if (new File(path).exists()) {
                return true;
            }
        }
        return false;
    }
}

// Usage
if (RootDetector.isDeviceRooted()) {
    showWarningDialog("This device appears to be rooted. " +
        "This may compromise the security of your sensitive data.");
}

# GitHub Actions
- name: Dependency Scan
  uses: dependency-check/dependency-check-action@main