Best / Open Automated and Manual Source Code Analysis Tool - Android

Lint :

        Android lint tool is a static code analysis tool that checks your Android project source files for potential bugs and optimization improvements for correctness, security, performance, usability, accessibility, and internationalization.

     Android Studio, the configured lint and other IDE inspections run automatically whenever you compile your program. You can also manually run inspections in Android Studio by selecting Analyze > Inspect Code from the application or right-click menu. The Specify Inspections Scope dialog appears so you can specify the desired inspection profile and scope.

    lint tool processes the application source files.

You can configure lint checking at different levels:

• Globally, for the entire project
• Per project module
• Per production module
• Per test module
• Per open files
• Per class hierarchy
• Per Version Control System (VCS) scopes

Configuring lint in Android Studio

Android Studio allows you to enable or disable individual inspections and configure project-global, directory-specific, and file-specific settings for lint.
You can manage inspection profiles and configure inspection severity within Android Studio using the File > Settings > Project Settings menu to open the Inspections page with a list of the supported profiles and inspections.

Download Link : http://developer.android.com/sdk/index.html#win-bundle

 Agnitio :

           A tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.

Features

• Security code reviews
• Security code review metrics and reporting
• Application security code review tool
• Static analysis security guidance and reporting

Download Link : http://sourceforge.net/projects/agnitiotool/files/latest/download

DroidBench :

                       is an open test suite for evaluating the effectiveness of taint-analysis tools specifically for Android apps. The suite can be used to assess both static and dynamic taint analyses, but in particular it contains test cases for interesting static-analysis problems (field sensitivity, object sensitivity, tradeoffs in access-path lengths etc.) as well as for Android-specific challenges like correctly modeling an application’s lifecycle, adequately handling asynchronous callbacks and interacting with the UI.

Version 1.1 comprises the following categories

• Arrays and Lists
• Callbacks
• Field and Object Sensitivity
• Inter-App Communication
• Lifecycle
• General Java
• Miscellaneous Android-Specific
• Implicit Flows
• Reflection

 Download Link : https://github.com/secure-software-engineering/DroidBench

SuSi:

        is a tool for the fully automated classification and categorization of Android framework sources and sinks

       There exist different kinds of sensitive sources and sinks in the area of Android security. For instance, the user’s location information or address book can be treated as a source, while the network connection or the SMS message sending facilities can be seen as sinks. In general, sources and sinks are accessed through specific API methods (e.g, getLastKnownLocation() for the user’s current location).

     SuSi is a tool that automatically generates a list of Android sources and sinks by analyzing the complete Android source code. Our approach is version-independent and can simply be run again when a new Android version is released. This relieves security analysts from having to regularly create new lists of sources and sinks by hand.


Download Link : https://github.com/secure-software-engineering/SuSi

     

DidFail:

            DidFail (Droid Intent Data Flow Analysis for Information Leakage) uses static analysis to detect potential leaks of sensitive information within a set of Android apps. DidFail combines and augments FlowDroid (which identifies intra-component information flows) and Epicc (which identifies properties of intents such as its action string) to track both inter-component and intra-component data flow in a set of Android applications. DidFail's two-phase analysis allows for fast user-response time by using precomputed phase-1 analysis results.

Note:

• This tool is a research prototype. It is not intended for industrial use. 

Download Link : https://www.cs.cmu.edu/~wklieber/didfail/didfail.zip

Androwarn :

                   is a tool whose main aim is to detect and warn the user about potential malicious behaviours developped by an Android application.

The detection is performed with the static analysis of the application's Dalvik bytecode, represented as Smali.

Download Link : https://github.com/maaaaz/androwarn

FlowDroid – Taint Analysis :

                          FlowDroid is a context-, flow-, field-, object-sensitive and lifecycle-aware static taint analysis tool for Android applications. Unlike many other static-analysis approaches for Android we aim for an analysis with very high recall and precision. To achieve this goal we had to accomplish two main challenges: To increase precision we needed to build an analysis that is context-, flow-, field- and object-sensitive; to increase recall we had to create a complete model of Android’s app lifecycle.

   

                        Our analysis is based on Soot and Heros. FlowDroid uses a very precise callgraph which helps us to ensure flow- and context-sensitivity. Its IFDS-based flow functions guarantee field- and object-sensitivity. Because an accurate and efficient alias search is crucial for context-sensitivity in conjuction with field-sensitivity, we want to highlight this part of our analysis, which is inspired by Andromeda. 

 

Note: soot-infoflow-android is part of FlowDroid, a context-, flow-, field-, object-sensitive and lifecycle-aware static taint analysis tool for Android applications.

 

Download Link : https://github.com/secure-software-engineering/soot-infoflow-android

 

 

Android Application Vulnerability / Security Assessment Tools & Framework

Android Security Evaluation Framework (ASEF) :
                                               performs this analysis while alerting you about other possible issues. It will make you aware of unusual activities of your apps, will expose vulnerable components and help narrow down suspicious apps for further manual research. The framework will take a set of apps (either pre-installed on a device or as individual APK files) and migrate them to the test suite where it will run it through test cycles on a pre-configured Android Virtual Device (AVD).

                            ASEF is a Open Source Project to perform security analysis of Android Apps by various security measures                         

                            ASEF is an Open Source tool for scanning Android Devices for security evaluation. Users will gain access to security aspects of android apps by using this tool with its default settings. An advanced user can fine-tune this, expand upon this idea by easily integrating more test scenarios, or even find patterns out of the data it already collects. ASEF will provide automated application testing and facilitate a plug and play kind of environment to keep up with the dynamic field of Android Security.

YouTude Videos :

Demo : Running ASEF to test all installed android apps from an android device on an Android Virtual Device

Short Demo : Running ASEF to test all installed android apps from an android device on an another physical android device

 

Download Link : Android Security Evaluation Framework


Tools :

Mercury v1.1 Tool - 

                              bug hunters to find vulnerabilities & write proof-of-concept exploits in Android Application. Simple called as Android Apps Vulnerability Scanner. 

 

                            Mercury is a framework for exploring the Android platform; to find vulnerabilities and share proof-of-concept exploits.

                         Mercury allows you to assume the role of a low-privileged Android app, and to interact with both other apps and the system.

• Use dynamic analysis on Android applications and devices for quicker security assessments
• Share publicly known methods of exploitation on Android and proof-of-concept exploits for applications and devices
• Write custom tests and exploits, using the easy extensions interface

Mercury allows you to:

1. Interact with the 4 IPC endpoints - activities, broadcast receivers, content providers and services
2. Use a proper shell that allows you to play with the underlying Linux OS from the point of view of an unprivileged application (you will be amazed at how much you can still see)
3. Find information on installed packages with optional search filters to allow for better control
4. Built-in commands that can check application attack vectors on installed applications
5. Transfer files between the Android device and your computer
6. Create new modules to exploit your latest finding on Android, and playing with those that others have found

                For those of you interested in vulnerabilities in vendor products, the new version is the start of a collection of these in a framework. The first privilege escalation was included, allowing the escalation to root from Mercury’s unprivileged context. A module was created to check for vulnerabilities in content providers discovered on Samsung devices.

Sample results of running this module on a vulnerable version of the Samsung Galaxy SII is shown below:

Running this on the Samsung Galaxy SIII yields the following:
                               

Security consultants Sample Testing :

                  The first set of vulnerabilities found by the MWR team was done manually by reviewing the AndroidManifest.xml of each package on the phone. With Mercury, a combination of the attacksurface command and the the info command in each section will get you the same results in a tenth of the time. If you are interested in looking for common problems on devices, the scanner modules will be of interest to you. As an example, this is scanner.provider.sqlinjection finding SQL injection flaws in default content providers on an Android 4.0.3 Emulator.

                        Don’t get too excited, these SQL injection vulnerabilities don’t lead to any serious information disclosure, but you get the idea right? Don’t just look at content provider problems because these tools are available. Content providers are the tip of the iceberg! Ask us questions or bounce ideas. Create new modules with Mercury. Go forth and innovate!

   Download Link : Mercury v1.1