Search code examples
androidsecurityvariablesandroid-security

Global variable security implications


I have Global Variable in my application. This is something I don't want to store, but which the user should be able to access whilst the app is running. All works.

My question is, what security implications does using a global variable have? Is it accessible from other apps?


Solution

  • Global variables cannot be accessed by other apps , the only case if you have rooted devices and some malicious app (low-level) can access memory , create dump of the memory used by your application and than search for your variable, but I am not sure that it will be easy even with root access.

    But anyone can decompile your APK file into the smali code, and find this variable easily.
    If you data is really sensitive there are some ways you can protect it.

    1. Encrypt it with you application signature and when you need decrypt it. But it still can be hacked via getting public key from app signature and so on.

    2. Do not store it on a device (inside you app like global variable) at all, parse this variable from the server, furthermore using SSL connection.

    3. By default shared preferences are not accessible by other apps,as well as database, if you are not using Content Provider. But it is quite easy to get you app data with root access.

    I would prefer second variant, everything stored on device can be accessed much more easier than if it is stored on the external storage.

    But even if you are parsing data from the server, keep in mind that different network attacks come into play.

    Also if you data( variable) is the same for all apps and if stolen all resources will accessible consider using something like temporary token or other mechanism that has expiration time.

    P.S.

    Android is running on the linux based kernel, all secure mechanism are applicable. So each process has it own memory address space and doesn't know about any other process in the system (generally).