14-829: Mobile Security - Fall 2013

Assignment #1 - How Difficult is it to be a Bad Developer?

Assigned: August 28

Due: September 30

Description: The goal of this assignment is to learn through first hand development just how difficult it is to be a bad developer. The assignment has three components: 1) learn how to develop Android applications that handle user data and/or context, 2) learn about ways that developers can steal users' personal information, and 3) implement and test one of these bad behaviors in an Android app. All of these are significant tasks, so we recommend that you start working on the assignment as soon as possible to avoid a rush before the submission deadline.

Deliverables: Each student will provide two primary deliverables for this assignment:

• Summary - You are expected to submit a summary highlighting the various ways you learned that developers can steal users' personal information and describing the bad behavior that you implemented in your app. This summary should provide detailed descriptions and accurate references to publications, articles, blogs, etc.
• Application code - You are expected to submit the source code and a working Android .apk file demonstrating the bad behavior that you chose to implement. We should be able to run your application in the Android emulator or on a stock Android phone. Please include any configuration or version information assumed by your app.

Submission Instructions: Each student should submit the summary and application code via Blackboard. All students are expected to submit their own work; discussion about the assignment is allowed and encouraged, but the writing and coding should be done individually.

Warning: Students are expected to follow strict ethical guidelines during this assignment. At no point should any malicious applications be deployed or disseminated publicly.

Assignment #1 Alternative

Description: For students with advanced Android experience who want a bigger challenge, you can work with the instructor to create your own homework assignment. The scope must be appropriate for the course, the effort must be at least as significant as the original assignment, and the customized assignment must be discussed with and approved by the instructor well in advance of the assignment deadline.