7

I've just come upon several .apk files hosted with Github projects which are "compiled for debug" (i.e. having application-debuggable set, which one can e.g. check using aapt dump badging /path/to/apk | grep debuggable. Not being an Android dev, I only have vague ideas what that is for (extended debugging via ADB) – but that's not the question here.

My question is from a pure end-user perspective: What are the (security) implications of installing/using such an app? What are the risks one must be aware of?

Of course I searched the web for hints on this, but again only got vague hints like "thou shalt not", and "for a release this should be switched off" – no reasons, no background. For that one could think "obviously no big deal" – but notes like Do spend some time thinking about the security implications for your users in this context (see this answer at SO) suggest differently.

Can anyone here provide some insights?

  • Related reading on Security. Note that with web apps it can be more severe (potentially granting extra access and leaking many users' data at once), but overall it's similar to what I've said below -- there are definitely issues, but they are mostly potential side-effects rather than real holes. – Matthew Read Mar 24 '16 at 0:22
  • 1
    Just a side-note, you can also check if an app is debuggable from Developer options - Select debug app (at least on Nexus stock ROM). Debuggable app's package is always shown on LogCat (compared to the empty package of release apps), making it easier to identify what it's doing (whether for developer, end-user, and attacker). – Andrew T. Mar 24 '16 at 1:56
  • @AndrewT. Thanks for that explanation! I've often wondered how that configuration was to be interpreted. If that offers a possibility to "check the risk" (preferably without much dev knowledge), that would be good to know. Even better if one can switch the app's debug-flag off from there :) – Izzy Mar 24 '16 at 7:19
  • 1
    @AndrewT. request for clarification: what do you mean by "always shown on LogCat"? Can you give a few more details on that? Does this only apply to "logcat via ADB", or does it get visible to other apps as well? – Izzy Mar 24 '16 at 13:10
  • 1
    @MatthewRead Good pointer to check on Security, btw. Also see there: Disabling android application debug mode as a security practice – which makes it rather look an issue for the dev than for the user (though the latter might be affected as well afterwards, if a loop-hole was detected ;) – Izzy Mar 25 '16 at 23:08
5

There aren't really any innate problems with running a debug app. If someone grabs your unlocked phone, enables Developer Mode, and starts debugging they might be able to grab sensitive information from the app's memory slightly more easily — but that's not particularly realistic and easily countered with a lock screen.

Debug information will also make it harder to make use of security through obscurity, which we all know is not real security. This obviously isn't even a factor when it comes to open-source apps, since they can simply inspect the source to find a flaw.

However, the specifics of what code paths you've added for debugging can definitely be security holes. Maybe for testing and verification purposes, the debug version writes the user's password out to logcat when they sign in, for example. There is a great deal of PII that could be exposed this way.

For an end user, all that you know is that it's probably more likely for an arbitrary app to leak information if it's a debug version. Unless you are searching for it yourself, you're not likely to see it. That's probably enough reason to avoid such apps — doubly so since a developer who doesn't know the difference between Release and Debug versions is probably not protecting your data very competently either.

Dan Hulme also made a good point in chat: A debug version probably won't be properly signed, meaning that it could be "upgraded" from a malicious source. I would again presume this to be an unlikely occurrence, but it is another point against it.

  • Thanks, Matthew! So if asked by an average user: would you strongly discourage from using such an app, simply suggest to "be careful", or something in between? – Izzy Mar 24 '16 at 0:14
  • 1
    @Izzy I would moderately advise against it. Given the choice between debug vs. release, always choose release of course. But if you've taken appropriate precautions like not using the same password elsewhere, and it's not something important like your e-mail/Twitter/banking/etc., then it's probably not going to end up being an issue. – Matthew Read Mar 24 '16 at 0:17
  • 1
    "Given the choice between debug vs. release" I wouldn't need to ask :) Problem is, some projects there only offer a debug version, and have no presence in Playstore or on F-Droid. But the last sentence of your edit has a good point: the dev might have "left security holes in other places" too. So it's worth a "strong advice against" with this background – but not as strong as "willingly installing malware". Thanks again! I'll accept your answer then (still open for other insights, of course – like those from Andrew in his comment on my question itself :) – Izzy Mar 24 '16 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.