CODEWITHSUNDEEP
androidsecurity
Nguyen Minh Binh
Nguyen Minh Binh

Reputation: 24423

How to prevent hacker access my app's database on android?

as you know, we can access to any folder on android device after rooting. My app has a database and some other binary files. I know that I can't prevent user see my files and database. But is there any way to prevent user copy it to other android devices for illegal use?

Upvotes: 4

Views: 2803

Answers (2)

Krishnabhadra
Krishnabhadra

Reputation: 34265

One option is to encrypt the data stored in database. Normally it is stored in plaintext. SQLCipher, I believe works for Android too..

From Android/google official forums,

Users with rooted phones can get access to any files they want. Otherwise, databases in the conventional on-board flash location are secure.

If you want to prevent that (routed access) only option is to encrypt it. However long it takes.

EDIT:

What I am saying is, it is never completely secure. You can make it as much difficult for hackers. You can save the decryption key (only) in the server (if downloading entire data from server is time consuming) but then app needs net connection to work. You can save the key in a hidden file (filename starting with .), but rooted users with knowledge about linux type file system can find them. Or you can do as Teovald suggests it in the comment to this answer, by generating the key in run time using any hash algorithm from any constants (like IMEI number), but it also need some processing. The more you try to secure it, the more works you need to do to use it. So it is a 50-50 kind of situation, and decision should depends on one's requirement.

Upvotes: 4

Wolfram Rittmeyer
Wolfram Rittmeyer

Reputation: 2402

Apart from encryption (see Krishnabhadra's answer) the only way to ensure critical data is to not have everything on the device. So you could access the most critical data always online only.

Of course this has the downside that not all of your app is usable if the user has no connection. You have to balance between your need to keep data safe from prying and allowing instant offline access to data.

If you can alleviate the former problem depends on the data. If all is critical, nothing is allowed on the device. Users will understand and begrudgingly accept this. No one would want a copy of his bank account on his device. But you should allow access to everything that is not critical even in offline mode.

Upvotes: 3

Related Questions