Security Analysis for Android app APK

Question

I am working on a project where I am asked to manually conduct security analysis on android app APKs, such as Misuse of Phone Identifiers, Exposure of Physical Location ...ect. The burden lies in the fact that I don't know how to go about it. I know how to decompile the apk into java classes but what after that?

My question: are there best practices, tools, universal guide to conduct such analysis?

Answer 1

While this is a very general question that requires extensive understanding the security field, here are some options...

• Decompile the app from dex->jar->java and see how well the code is obfuscated. More info here: decompiling DEX into Java sourcecode
• Intercept the packets that are being sent through a WiFi router using WireShark or some alternative. If the packets are sending raw locations you know something is wrong. A real life example was this: Marijuana app reveals location