Harden an Android app's storage, network and entry points

package com.example.bank

import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.GCMParameterSpec

// AES-256-GCM with a non-exportable Android Keystore key. Store the output in
// context.noBackupFilesDir, which Auto Backup never copies.
object TokenCipher {
    private const val ALIAS = "session-token-key"
    private const val TRANSFORMATION = "AES/GCM/NoPadding"
    private const val IV_BYTES = 12

    private fun key(): SecretKey {
        val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
        (keyStore.getKey(ALIAS, null) as? SecretKey)?.let { return it }
        val spec = KeyGenParameterSpec.Builder(
            ALIAS, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
            .setKeySize(256)
            // Randomized encryption stays on (the default): Keystore picks every IV.
            .build()
        return KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore")
            .apply { init(spec) }
            .generateKey()
    }

    fun encrypt(plaintext: ByteArray): ByteArray {
        val cipher = Cipher.getInstance(TRANSFORMATION)
        cipher.init(Cipher.ENCRYPT_MODE, key())        // no IV argument
        return cipher.iv + cipher.doFinal(plaintext)    // IV, then ciphertext and 16-byte tag
    }

    fun decrypt(blob: ByteArray): ByteArray {
        val cipher = Cipher.getInstance(TRANSFORMATION)
        cipher.init(Cipher.DECRYPT_MODE, key(), GCMParameterSpec(128, blob, 0, IV_BYTES))
        return cipher.doFinal(blob, IV_BYTES, blob.size - IV_BYTES)
    }
}

package com.example.bank

import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG
import androidx.biometric.BiometricPrompt
import androidx.core.content.ContextCompat
import androidx.fragment.app.FragmentActivity
import java.security.KeyPair
import java.security.KeyPairGenerator
import java.security.KeyStore
import java.security.PrivateKey
import java.security.Signature
import java.security.spec.ECGenParameterSpec

private const val STEP_UP_ALIAS = "step-up-signing-key"

// Enrollment: a P-256 key that can sign only right after a Class 3 biometric match.
// Send the public key and its attestation chain to the server.
fun createStepUpKey(attestationChallenge: ByteArray): KeyPair =
    KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore").run {
        initialize(
            KeyGenParameterSpec.Builder(STEP_UP_ALIAS, KeyProperties.PURPOSE_SIGN)
                .setAlgorithmParameterSpec(ECGenParameterSpec("secp256r1"))
                .setDigests(KeyProperties.DIGEST_SHA256)
                .setUserAuthenticationRequired(true)
                .setUserAuthenticationParameters(0, KeyProperties.AUTH_BIOMETRIC_STRONG)
                .setInvalidatedByBiometricEnrollment(true)
                .setAttestationChallenge(attestationChallenge)
                .build())
        generateKeyPair()
    }

// Step-up: the server trusts the signature over its one-time challenge, not a callback.
fun signChallenge(activity: FragmentActivity, challenge: ByteArray, onSigned: (ByteArray) -> Unit) {
    val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
    val signature = Signature.getInstance("SHA256withECDSA")
    // Throws KeyPermanentlyInvalidatedException after a biometric change: re-enroll.
    signature.initSign(keyStore.getKey(STEP_UP_ALIAS, null) as PrivateKey)

    val prompt = BiometricPrompt(activity, ContextCompat.getMainExecutor(activity),
        object : BiometricPrompt.AuthenticationCallback() {
            override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
                val unlocked = result.cryptoObject?.signature ?: return
                unlocked.update(challenge)
                onSigned(unlocked.sign())   // the server verifies with the enrolled public key
            }
        })
    val info = BiometricPrompt.PromptInfo.Builder()
        .setTitle("Confirm transfer")
        .setAllowedAuthenticators(BIOMETRIC_STRONG)
        .setNegativeButtonText("Cancel")
        .build()
    prompt.authenticate(info, BiometricPrompt.CryptoObject(signature))
}

<?xml version="1.0" encoding="utf-8"?>
<!-- res/xml/data_extraction_rules.xml, referenced by android:dataExtractionRules (Android 12+).
     Keep android:fullBackupContent with the same excludes for Android 11 and lower. -->
<data-extraction-rules>
    <cloud-backup disableIfNoEncryptionCapabilities="true">
        <exclude domain="sharedpref" path="session.xml" />
        <exclude domain="database" path="cache.db" />
    </cloud-backup>
    <!-- Leaving this section out would allow everything during device-to-device transfer -->
    <device-transfer>
        <exclude domain="sharedpref" path="session.xml" />
        <exclude domain="database" path="cache.db" />
    </device-transfer>
</data-extraction-rules>

<?xml version="1.0" encoding="utf-8"?>
<!-- res/xml/network_security_config.xml, referenced by android:networkSecurityConfig -->
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
        <!-- On by default when targeting API 37; needed on API 36 -->
        <certificateTransparency enabled="true" />
    </base-config>
    <!-- Applies only when android:debuggable is true, so release builds ignore it -->
    <debug-overrides>
        <trust-anchors>
            <certificates src="user" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config>
        <domain includeSubdomains="false">api.bank.example.com</domain>
        <!-- After this date Android stops checking the pins: ship new ones before it. -->
        <pin-set expiration="2027-06-30">
            <!-- SPKI SHA-256 of the issuing CA in use today -->
            <pin digest="SHA-256">44viFzTC+h/L+3OHRg4Rs5v4+AcpzHZvI9Tne2RDNGk=</pin>
            <!-- Backup: a CA or key you could switch to without an app update -->
            <pin digest="SHA-256">9C7mf4J789KvLX59lcMyYpsH6bpdmoAGTByZNhcusLA=</pin>
        </pin-set>
    </domain-config>
</network-security-config>
<!-- Compute a pin from a PEM certificate:
openssl x509 -in ca.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 -->

<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.example.bank">
    <permission android:name="com.example.bank.permission.SYNC"
        android:protectionLevel="signature" />
    <application>
        <!-- Reachable from other apps and the browser: verified links only -->
        <activity android:name=".InvoiceLinkActivity" android:exported="true">
            <intent-filter android:autoVerify="true">
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />
                <data android:scheme="https" android:host="bank.example.com"
                    android:pathPrefix="/invoices/" />
            </intent-filter>
        </activity>
        <!-- Internal: other apps can't start it, even by naming it -->
        <activity android:name=".TransferReviewActivity" android:exported="false" />
        <!-- Shared only with apps signed with the same key -->
        <service android:name=".SyncService" android:exported="true"
            android:permission="com.example.bank.permission.SYNC" />
    </application>
</manifest>

package com.example.bank

import android.app.PendingIntent
import android.content.Context
import android.content.Intent

// Vulnerable: mutable and implicit. The holder can fill in a component and launch it
// with your app's identity. Apps targeting API 34+ get IllegalArgumentException instead.
fun badReminder(context: Context): PendingIntent =
    PendingIntent.getActivity(context, 0, Intent("com.example.bank.REVIEW_TRANSFER"),
        PendingIntent.FLAG_MUTABLE)

// Fixed: explicit component, immutable, usable once.
fun reminder(context: Context, transferId: String): PendingIntent {
    val intent = Intent(context, TransferReviewActivity::class.java)
        .putExtra("transferId", transferId)
    return PendingIntent.getActivity(context, transferId.hashCode(), intent,
        PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_ONE_SHOT)
}

package com.example.bank

import android.app.Activity
import android.content.Intent
import android.webkit.WebResourceRequest
import android.webkit.WebResourceResponse
import android.webkit.WebView
import androidx.webkit.WebViewAssetLoader
import androidx.webkit.WebViewClientCompat
import androidx.webkit.WebViewCompat
import androidx.webkit.WebViewFeature

private const val HOST = "appassets.androidplatform.net"

// Bundled help pages served over https:// by WebViewAssetLoader instead of file://.
fun WebView.showHelp(activity: Activity) {
    val assets = WebViewAssetLoader.Builder()
        .addPathHandler("/assets/", WebViewAssetLoader.AssetsPathHandler(activity))
        .build()
    settings.javaScriptEnabled = true     // off by default; the help pages need it
    settings.allowFileAccess = false      // false by default only for targetSdk 30+
    settings.allowContentAccess = false

    webViewClient = object : WebViewClientCompat() {
        override fun shouldInterceptRequest(view: WebView, request: WebResourceRequest): WebResourceResponse? =
            assets.shouldInterceptRequest(request.url)

        override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest): Boolean {
            val url = request.url
            if (url.scheme == "https" && url.host == HOST) return false
            if (url.scheme == "https") activity.startActivity(Intent(Intent.ACTION_VIEW, url))
            return true   // never load other origins in this WebView
        }
        // Don't override onReceivedSslError to call proceed(); let TLS errors fail.
    }

    // Unlike addJavascriptInterface, the bridge exists only in frames from this exact origin.
    if (WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
        WebViewCompat.addWebMessageListener(this, "bankBridge", setOf("https://$HOST")) { _, message, _, isMainFrame, _ ->
            if (isMainFrame && message.data == "openSettings") activity.startActivity(Intent(android.provider.Settings.ACTION_SETTINGS))
        }
    }
    loadUrl("https://$HOST/assets/help/index.html")
}

package com.example.bank

import android.net.Uri

private val INVOICE_PATH = Regex("/invoices/([A-Z0-9]{8,20})")

// The only link this app accepts: https://bank.example.com/invoices/<id>
fun invoiceIdFrom(uri: Uri?): String? {
    if (uri == null || uri.scheme != "https" || uri.host != "bank.example.com") return null
    if (uri.port != -1 || uri.userInfo != null || uri.query != null || uri.fragment != null) return null
    // uri.path is percent-decoded, so %2F and %0A can't slip past the full-path match.
    return INVOICE_PATH.matchEntire(uri.path ?: return null)?.groupValues?.get(1)
}
// In the activity: open a read-only invoice screen for that id. Paying still goes
// through the normal confirmation flow, and the server checks the user owns the invoice.

import { createHash } from 'node:crypto';

// The app sends requestHash = SHA-256 of the same canonical request it is about to make.
export const requestHash = (canonicalRequest) =>
  createHash('sha256').update(canonicalRequest).digest('base64url');

// Decode on Google's server; never let the app evaluate its own verdict.
export async function decodeToken(token, packageName, accessToken) {
  const res = await fetch(
    `https://playintegrity.googleapis.com/v1/${packageName}:decodeIntegrityToken`,
    { method: 'POST',
      headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
      body: JSON.stringify({ integrityToken: token }) });
  if (!res.ok) throw new Error(`decode failed: ${res.status}`);
  return (await res.json()).tokenPayloadExternal;
}

// Returns a decision tier, not a yes/no answer.
export function decide(p, { packageName, canonicalRequest, now = Date.now(), maxAgeMs = 60_000 }) {
  const req = p.requestDetails ?? {};
  if (req.requestPackageName !== packageName) return 'deny';
  if (req.requestHash !== requestHash(canonicalRequest)) return 'deny';      // bound to this request
  if (now - Number(req.timestampMillis) > maxAgeMs) return 'deny';           // stale token
  if (p.appIntegrity?.appRecognitionVerdict !== 'PLAY_RECOGNIZED') return 'deny';
  if (p.appIntegrity?.packageName !== packageName) return 'deny';
  if (p.accountDetails?.appLicensingVerdict !== 'LICENSED') return 'step-up';
  const labels = p.deviceIntegrity?.deviceRecognitionVerdict ?? [];
  if (labels.includes('MEETS_STRONG_INTEGRITY') || labels.includes('MEETS_DEVICE_INTEGRITY')) return 'allow';
  if (labels.includes('MEETS_BASIC_INTEGRITY')) return 'allow-with-limits';
  return 'step-up';
}

APK=app-release.apk; PKG=com.example.bank

# 1. What does the release manifest expose?
aapt2 dump xmltree --file AndroidManifest.xml "$APK" \
  | grep -E 'E: (activity|service|receiver|provider)|exported|debuggable|allowBackup|networkSecurityConfig|dataExtractionRules'

# 2. Signing certificate SHA-256 for assetlinks.json (with Play App Signing, copy it from Play Console)
keytool -printcert -jarfile "$APK" | grep SHA256

# 3. A non-exported activity must refuse other callers: expect "Permission Denial ... not exported"
adb shell am start -n "$PKG/.TransferReviewActivity"

# 4. Feed the link handler hostile URIs; none may reach an invoice screen
for u in 'https://bank.example.com/invoices/INV0000123%0A' \
         'https://bank.example.com/invoices/INV0000123?pay=1' \
         'https://evil.test%5C@bank.example.com/invoices/INV0000123'; do
  adb shell am start -a android.intent.action.VIEW -d "'$u'" -n "$PKG/.InvoiceLinkActivity"
done

# 5. Every App Links domain should end up "verified"
adb shell pm verify-app-links --re-verify "$PKG"; sleep 20; adb shell pm get-app-links "$PKG"

# 6. Nothing secret in the system log while you exercise the app
adb logcat -d --pid="$(adb shell pidof "$PKG")" | grep -iE 'token|bearer|password' && echo 'LEAK'