Course Outline
-
IT Security and Secure Coding
Core Security Paradigms
Explore foundational principles of information security, with a focus on confidentiality, integrity, and availability within mobile ecosystems.
- Integration of secure development lifecycle practices
- Threat modeling and risk assessment methodologies
- Industry compliance frameworks and secure coding standards
Defense-in-Depth Strategies
Understand how to layer security controls across the application, framework, and operating system to minimize attack surfaces.
Android Security Overview
Platform Architecture and Sandboxing
Analyze the Linux-based kernel foundation and Android's unique sandboxing model that isolates application processes, resources, and permissions.
- Process isolation and SELinux policy enforcement
- Hardware-backed security and trusted execution environments
- System-level security boundaries and update mechanisms
Underlying System Vulnerabilities
Identify critical gaps and architectural shortcomings in the Android runtime environment, file system permissions, and native layers that can be exploited by malicious actors.
Application Security
Permission Model and Data Storage
Master the Android permission system, runtime authorization flows, and secure storage mechanisms for sensitive user data and credentials.
- Declaring, requesting, and managing dangerous permissions
- Encrypted preferences, secure shared storage, and keystore integration
- Intent filtering, broadcast receiver exposure, and content provider leaks
Application Hardening Techniques
Implement anti-tampering measures, code obfuscation, and runtime application self-protection strategies to prevent reverse engineering and dynamic analysis.
Android and Java Vulnerabilities
Common Java Flaws in Mobile Context
Examine language-specific pitfalls and framework misconfigurations that frequently lead to security breaches in Android applications.
- Improper exception handling and information leakage
- Weak cryptographic implementations and insecure key management
- Insecure deserialization, reflection abuse, and resource exhaustion
Framework-Specific Risks and Recent Exploits
Review high-impact CVEs, zero-day vulnerabilities, and attack patterns specifically targeting the Android SDK and Java runtime environment.
Android Native Code Security
Native Development and Memory Management
Investigate security challenges specific to C/C++ development using the Android NDK, focusing on memory safety, pointer arithmetic, and system calls.
- Buffer overflows, underflows, and use-after-free vulnerabilities
- Stack and heap corruption exploitation techniques
- Secure memory allocation, initialization, and zeroization practices
Exploit Mitigation and Hardening
Deploy advanced native-layer mitigations such as stack canaries, ASLR, DEP/NX, and symbol stripping to protect code execution and preserve confidentiality.
Knowledge Sources
Security Testing Tools and Methodologies
Learn to deploy and interpret results from industry-standard static and dynamic analysis tools specifically designed for Android and Java applications.
- Static application security testing configuration and rule sets
- Dynamic analysis, runtime monitoring, and instrumentation techniques
- Automated vulnerability scanning, dependency auditing, and reporting workflows
Requirements
None.
Testimonials (2)
The Burpe suite i need more training in this
Gontse Ntshegi - Vodacom
Course - Android Security
Nothing it was perfect.
