android-sec-val

Android Security Validator

An automated security validation system for Android applications. This tool orchestrates ADB and Appium to verify:

• Runtime Integrity: Debuggable flags, Logcat leaks, Manifest settings.
• Storage Confidentiality: Plaintext sensitive data in private storage (Requires Root).
• Network Security: Resilience against MITM attacks (Certificate Pinning).

Prerequisites

• Node.js (v14+)
• ADB installed and in PATH.
• Appium Server running (npm install -g appium && appium).
• Android Emulator (AOSP Image recommended for Root access).

Installation

npm install -g android-sec-val
# OR run directly from source
npm install
npm run build

Usage

Start your Appium server and Emulator first.

# General Usage
android-sec-val validate --package com.example.app

# With APK install and custom sensitive strings
android-sec-val validate \
  --package com.example.app \
  --apk ./path/to/app.apk \
  --sensitive password token auth_key

Options

Option	Alias	Description	Default
--package	-p	Target Android Package Name	(Required)
--apk	-a	Path to APK to install	undefined
--sensitive	-s	List of strings to grep for in storage	['password', 'token', ...]
--output	-o	JSON Report Path	security_report.json

Security Checks

Runtime

• Debuggable Flag: Checks android:debuggable.
• Manifest Analysis: Checks allowBackup and usesCleartextTraffic.
• Logcat Leakage: Monitors logs for provided sensitive strings.

Storage (Requires adb root)

• Local Storage Inspection: Recursively greps /data/data/<pkg> for sensitive strings.
• Cache Hygiene: Checks /data/data/<pkg>/cache for excessive data persistence.
• External Storage: Checks /sdcard/Android/data/<pkg> and Downloads for leakage.

Network

• Network Logic: Currently supports manual network validation hooks (see source).

Static Analysis

• Exported Components: Detects insecurely exported Activities/Services.
• Permission Audit: Flags dangerous permissions (SMS, Contacts, Location).
• Hardcoded Secrets: Extracts APK from device and scans for keys (AWS, Bearer, etc.).

Threat Model Coverage (Exploits Detected)

This tool validates defenses against the following specific attack vectors:

Vulnerability Class	Exploit / Threat Scenario	Validated By Check
Insecure Data Storage	Attacker with physical access (or malware) dumps /data/data to steal Auth Tokens or PII.	checkStorageIntegrity (asserts encryption)
Data Leakage	Sensitive data (passwords, tokens) printed to system logs (logcat) visible to other apps/USB.	checkLogcatLeakage
Runtime Tampering	Attacker attaches JDWP debugger to inspect memory or hook methods.	checkDebuggable
Network Interception	Attacker on public WiFi (MITM) presents fake cert to steal inflight data.	checkNetworkSecurity (Pinning)
Backup Theft	Attacker uses adb backup to extract app data without root.	checkManifestSettings (allowBackup)
Cleartext Transmission	App accidentally sends HTTP traffic exposing data to passive monitoring.	checkManifestSettings (usesCleartextTraffic)
Cache Leakage	Sensitive images/responses persist in cache/ after logout/exit.	checkCacheHygiene

Report

The tool generates a JSON report:

[
  {
    "check_name": "debuggable_flag",
    "status": "PASS",
    "severity": "LOW",
    "evidence": "Application is NOT debuggable",
    "category": "RUNTIME"
  }
]