Androsia: Securing Data in Process for Your Android Apps

Architecture and Background

Each Android application executes in an isolated runtime environment with finite heap memory managed by a garbage collector. The Android runtime does not distinguish between ordinary objects and security-sensitive constructs such as cryptographic keys, session tokens, or personal identifiers.

Vulnerability Analysis

Java does not provide deterministic object destruction APIs, causing security-critical data to linger in process memory indefinitely until system memory pressure triggers garbage collection. During this retention window, runtime memory dumps, side-channel attacks, or local process compromises can extract unencrypted secrets.

Exploitation and Demonstrations

Anwer highlights the inadequacy of standard java.security APIs for zeroing memory and demonstrates how secrets persist across heap allocations. He introduces Androsia, an open-source static analysis and bytecode transformation framework that performs interprocedural data flow analysis to pinpoint where sensitive objects are last referenced, automatically injecting bytecode that wipes secret values.

Remediation and Defensive Strategies

Mobile developers should adopt automated bytecode instrumentation during build pipelines to overwrite sensitive memory structures immediately following usage. Combining deterministic zeroization with secure hardware-backed keystores minimizes the attack window for in-memory credential harvesting.