Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Mobile Infrastructure & Security > Lesson 6 (Android OS & Software security) > Flashcards

Lesson 6 (Android OS & Software security) Flashcards

1
Q

When was the first Android phone released?

A

2008, after a early look release in 2007.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

When did google acquire the startup company Android Inc?

A

2005

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Since when is Android open source?

A

2008.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the partitions on an android phone?

A

/boot (kernel)
/system (pre installed apps)
/recovery (alternative boot)

/data (all user data and apps)
/cache (feq. accessed temp data)
/misc (settings)

/scdard0 (internal SD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What partition is wiped when performing a factory reset?

A

/data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name the Android OS layers

A

1 Applications
2 App framework > Managers and providers used when developing/running an app
3 Libraries & runtimes > general helpers that provide access to core libraries and the VM
4 Linux Kernel > drivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are core apps? (Applications layer)

A

Default apps on the device, like SMS, contacts, Call app.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does the Application framework layer constist of?

A

API’s for app developers, like accessing sensors, default activity behaviour and content access on the device etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the Android Library layer?

A

c/c++ libs used by components of the android framework, like SSL, WebKit, OpenGL, SQLite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the android runtime layer?

A

providing realtime access to the core libraries. Possible access to network, files etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the android kernel?

A

A linux kernel (v 2.6). Provides memory/process managent, networking, drivers and security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does linux give the apps? (2 things about security)

A 
Group ID at install time
User ID (UID), can be used as process etc. This is used to store data on the /data partition with only that user (app) rights.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Dalvik?

A

Java Virtual Machine for Android.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are dex files?

A

Byte code (from java) which can be ran by Dalvik. .dex === .class for JVM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When can you publish an android app (security resitrictions) ?

A

Must be signed with a trusted cert, and an valid signature. This can be requested at the dev portal and required at building the .apk for release.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How does the signing of an APK work (5) ?

A
  1. The code is hashed and encrypted with a private key of the author
  2. The author public key is attached to the code
  3. At runtime the mobiel device gets the public key and decrypts the hash (code)
  4. Hashes the code back again to compare it
  5. Finally the public key is checked with the Trust Authorities cert store.
17
Q

What three directories does the APK contain (security things) ?

A

META-INF directory. Contains the MANIFEST.MF file, CERT.RSA (certificate of ownership) And CERT.SF file (contains the data to be signed)

18
Q

What are the 5 resources, apart from META-INF, included in an Android APK file?

A

1 res = resources that couldnt be compiled
2 assets = extra files
3 androidmanifest.xml (projects manifest)
4 classes.dex = All classes compiled
5 resources.arsc = compiled resources in binary format

19
Q

What are application-level interactions?

A

Interactions on components like: Activities, services, content providers, broadcast receivers.

20
Q

What does an activity do?

A

Provides user interaction and GUI

21
Q

What does a service do?

A

provides background processes

22
Q

What does the content provider do?

A

Provides data storage facilities

23
Q

What does the broadcast receiver do?

A

Provides the possibility to receive mails or events from the apps or systems.

24
Q

What are the important methods that work with the Activity Lifecycle?

A 
onCreate()
onStart()
onRestart()
onResume()
onPause() -> goes to resume or create
onStop() > goes to restart or create
onDestroy()
25
Q

How does the Linux system start an app?

A

In one single thread. By default all components of the app run in the main thread. (same process/thread)

26
Q

Does a service run in a different thread?

A

No, it does not. It can still freeze the UI. It works on the same process as the app in the main thread.

27
Q

How can you use a thread or Runnable?

A

Creating a new class that extends the Thread or Runnable class (e.g. as myThread). It has to implement the run() method to execute code in the thread. The run() will be automatically called when calling new myThread().start();

28
Q

What is a way to perform an async task, which can directly access UI?

A

Using the AsyncTask class implementation.

29
Q

What are intents and what forms do you have?

A

Inter-component signaling. Used for starting activities, sending messages and creating background services. There are explicit intents, specifying the component to start with the classname. Implicit is to just perform an action, without a specific component specified.

30
Q

What are the 3 local storage types?

A
  1. SQLite
  2. Content Provider
  3. File storage
31
Q

What are content providers?

A

They are like a database with content where you can perform queries on. However they are also used to retrieve photos/contacts etc.

32
Q

What are broadcast receivers?

A

Events that you can register on. Notifications at runtime, like battery percentage.

33
Q

How are broadcast receivers used?

A

By extending the BroadcastReceiver and implementing the onReceive method.

34
Q

What permissions are required for using broadcast receivers?

A

Putting a tag in the manifest file, with an intent filter, containing an action where you want updates from.

35
Q

How do permissions work?

A

Permissions are all declared in the manifest. Its an all or nothing model. This is to inform the user and to restrict application access.

36
Q

How does cross site scripting work? (XSS)

A

When code is injected in an web app that contains executable code, like javascript code in a regular input field.

37
Q

Which two kinds of XSS are there?

A

Non persistance: Visit a malicious webpage.

Persistance: Often included or stored in forum posts

38
Q

What is SQL injection?

A

Parts of SQL queries that are stored as input parameters. Same like XSS but then as SQL.

39
Q

What is Phising?

A

For examples websites or emails that seem real but are fake websites requesting your personal/login information

Mobile Infrastructure & Security (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions