title: ÐÐ½Ð°Ð»Ð¸Ð· android-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð¼ÐµÑÐ¾Ð´Ð°Ð¼Ð¸ SAST
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Android SAST analysis
Creators: name: ÐÐ¸Ð½Ð°ÐµÐ², ÐÐ¸ÐºÐ¸ÑÐ°
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2022
Subjects: Ð°Ð½Ð°Ð»Ð¸Ð·
Ð°Ð½Ð´ÑÐ¾Ð¸Ð´
Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ðµ
Ð¼ÐµÑÐ¾Ð´ sast
sast
android
devsecops
ssdl
ci/cd

description: Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¸Ð½ÑÑÑÑÐ¼ÐµÐ½Ñ Ð´Ð»Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° android Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¸Ì, ÐºÐ¾ÑÐ¾ÑÑÐ¸Ì Ð¼Ð¾Ð¶Ð½Ð¾ Ð²ÑÑÑÐ°Ð¸Ð²Ð°ÑÑ Ð² Ð¿Ð°Ð¸ÌÐ¿Ð»Ð°Ð¸ÌÐ½ CI/CD Ð¸Ð»Ð¸ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÑ Ð´Ð»Ñ ÑÑÑÐ½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð»Ð¾ÐºÐ°Ð»ÑÐ½Ð¾. ÐÑÐ»Ð° Ð²ÑÐµÑÑÐ¾ÑÐ¾Ð½Ð½Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð° Ð¿ÑÐµÐ´Ð¼ÐµÑÐ½Ð°Ñ Ð¾Ð±Ð»Ð°ÑÑÑ, Ð¾Ð¿Ð¸ÑÐ°Ð½Ñ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÐµ Ð¿Ð¾Ð½ÑÑÐ¸Ñ Ð¸ ÑÑÐ°Ð½Ð´Ð°ÑÑÑ, Ð¿ÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÐµÑÐµÐ½Ð¸Ð¸Ì Ð½Ð° Ð¿ÑÐµÐ´Ð¼ÐµÑ Ð¿ÑÐµÐ¸Ð¼ÑÑÐµÑÑÐ²Ð° Ð¸ Ð½ÐµÐ´Ð¾ÑÑÐ°ÑÐºÐ¾Ð². ÐÑÐ»Ð° Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð° ÑÐµÐ½Ð½Ð¾ÑÑÑ ÑÐ¾Ð·Ð´Ð°Ð½Ð½Ð¾Ð³Ð¾ ÑÐºÐ°Ð½ÐµÑÐ° Ð¸ ÑÐµÐ¼ Ð¾Ð½ Ð²ÑÐ³Ð¾Ð´Ð½Ð¾ Ð¾ÑÐ»Ð¸ÑÐ°ÐµÑÑÑ Ð¾Ñ ÑÐ¶Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ. Ð¢Ð°ÐºÐ¶Ðµ Ð±ÑÐ»Ð¸ Ð¾Ð¿Ð¸ÑÐ°Ð½Ñ Ð²ÑÐµ Ð´ÐµÑÐµÐºÑÑ, Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÐ¸Ì Ð¿Ð¾Ð¸ÑÐº ÐºÐ¾ÑÐ¾ÑÑÑ Ð±ÑÐ» ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½, Ð±ÑÐ»Ð¸ Ð¿ÑÐ¸Ð²ÐµÐ´ÐµÐ½Ñ Ð¿ÑÐ¸Ð¼ÐµÑÑ ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ°ÑÐ¸Ð¸ Ð¸ Ð²ÐµÐºÑÐ¾ÑÑ Ð°ÑÐ°Ðº. ÐÑÐ» ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½ ÑÐºÑÐ¸Ð¿Ñ Ð´Ð»Ñ ÑÐºÐ°ÑÐ¸Ð²Ð°Ð½Ð¸Ñ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¸Ì Ð¸Ð· Google Play, ÐºÐ¾ÑÐ¾ÑÑÐ¸Ì Ð¿Ð¾Ð¼Ð¾Ð³ Ð² Ð°Ð½Ð°Ð»Ð¸Ð·Ðµ ÑÐµÐ°Ð»ÑÐ½ÑÑ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¸Ì. ÐÑÐ»Ð° Ð¿ÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ñ ÑÐ°Ð¼ÑÑ Ð¸Ð·Ð²ÐµÑÑÐ½ÑÑ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¸Ì Ð² ÑÐ¸ÑÑÐµÐ¼Ðµ Ð´Ð¸ÑÑÑÐ¸Ð±ÑÑÐ¸Ð¸ Google Play Market, Ð² ÑÐ¾Ð´Ðµ ÐºÐ¾ÑÐ¾ÑÐ¾Ð¸Ì Ð±ÑÐ»Ð° ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ð° Ð¿ÑÐ¾Ð²ÐµÑÐºÐ° ÐºÐ¾ÑÑÐµÐºÑÐ½Ð¾ÑÑÐ¸ ÑÐ°Ð±Ð¾ÑÑ Ð¸Ð½ÑÑÑÑÐ¼ÐµÐ½ÑÐ°. Ð¢Ð°ÐºÐ¶Ðµ Ð±ÑÐ»Ð¸ Ð¾Ð±Ð¾Ð·Ð½Ð°ÑÐµÐ½Ñ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½ÑÐµ Ð¿ÑÑÐ¸ ÑÐ°Ð·Ð²Ð¸ÑÐ¸Ñ Ð¸ ÑÐ»ÑÑÑÐµÐ½Ð¸Ñ. Ð Ð¸ÑÐ¾Ð³Ðµ Ð±ÑÐ» Ð¿Ð¾Ð»ÑÑÐµÐ½ Ð¸Ð½ÑÐµÑÐµÑÐ½ÑÐ¸Ì Ð¾Ð¿ÑÑ, Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð° Ð±Ð¾Ð»ÑÑÐ°Ñ Ð°Ð½Ð°Ð»Ð¸ÑÐ¸ÑÐµÑÐºÐ°Ñ Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ°Ñ ÑÐ°Ð±Ð¾ÑÐ°, Ð¿Ð¾ÑÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÐµ ÑÐµÐ»Ð¸ Ð±ÑÐ»Ð¸ Ð´Ð¾ÑÑÐ¸Ð³Ð½ÑÑÑ.
description: In the graduation work I developed a tool for static analysis of android applications, which can be embedded into the CI/CD pipeline or used for manual analysis locally. The subject area was comprehensively researched, the basic concepts and standards were described, existing solutions were analyzed for advantages and disadvantages. I defined the value of the created scanner and compared it favorably to existing ones. Also, I described all the defects, which automated search was implemented, I gave examples of exploitation and attack vectors. I implemented a script for downloading applications from Google Play, which helped a lot for scanning real world applications. Research work was done while analyzing top-tier applications in the Google Play Market distribution system, during which I was convinced that my tool is working correctly. Possible ways of development and improvement were also outlined. As a result, I got an interesting experience, did huge research, create my SAST tool and achieved my goals.