tags:

views:

55

answers:

1
+2  Q: 

Identify Calling Application in Android NDK

I have a native android library (.so) I am bundling with some application. In the native code I want to verify the signer/package name of the calling application.

The reason is, currently anyone can open up the .apk file take my .so file and use it to built their own applications.

Is there a way to securely identify the calling application from Java side? This could be package name, signature or anything else that can identify the Android application in a unique way.

+2  A: 

JNI code is coupled with Java package name, and can be called only from the same package and class. To improve security further, you can check some Java private static final field from the JNI code.

ognian  2010-07-27 05:45:54
Another application can just use the same package and class name to call the functions. That is not difficult, they just need to look at the list of exported functions from the .so file.But I guess, private static final field could add additional security. An attacker still can get around this by disassembling my application but that is a long shot.Thank you for the answer!
Szere Dyeri  2010-07-27 07:46:18
An attacker could always bring your defenses down. The best security is the legal defense
ognian  2010-07-27 08:08:42
fadden  2010-07-27 19:33:30

related questions

How do I write Firefox add-on that automatically enters proxy passwords?
Login Integration in PHP
Strange Rails Authentication Issue
Concurrent logins in a web farm
Is there a browser equivalent to IE's ClearAuthenticationCache?
How can I authenticate using client credentials in WCF just once?
Why can't I connect to my CAS server with Perl's AuthCAS?
Best Solution For Authentication in Ruby on Rails
Authenticate on an ASP.Net Forms Authorization website from a console app
How do I use NTLM authentication with Active Directory
What have you used Windows CardSpace for, if anything
Forms Authentication across Applications
Retreiving the PC Name of a Client? (Windows Auth)
How would you implement FORM based authentication without a backing database?
What's the best way to authenticate over WCF?
Only accepting certain ajax requests from authenticated users
OpenID authentication in Ruby on Rails
OpenID Attribute Exchange - should I use it?
OpenID: which provider should I recommend to my users?
What to use for login ID?
ASP.NET authentication: user name Vs User ID
How do I add SSL to a .net application that uses httplistener - it will *not* be running on IIS
How can I get the authenticated user name under Apache using plain HTTP authentication and PHP?
Checklist for IIS 6/ASP.NET Windows Authentication?
The Definitive Guide To Website Authentication