logo

Database

Debugging enabled in production - APK

Need

Disable debugging in production APKs to prevent unauthorized access

Context

• Usage of Android development for mobile applications

• Ensuring production APKs do not expose debugging capabilities

Description

1. Non compliant code

<manifest ...>
    <application
        android:name=".MyApplication"
        android:debuggable="true"
        android:label="@string/app_name"
        android:theme="@style/AppTheme">
    </application>
...

In this AndroidManifest.xml configuration, the `android:debuggable` attribute is either set to `true` or is missing, which defaults to `false` in release builds but might be enabled due to misconfigurations. If `android:debuggable="true"` is present in a production APK, attackers can connect to the application via ADB and execute debugging commands, potentially exposing sensitive data, internal logic, and even allowing code injection. To mitigate this risk, the `android:debuggable` attribute should be explicitly set to `false` in the AndroidManifest.xml file or managed via build configurations.

2. Steps

• Open the AndroidManifest.xml file of your application.

• Ensure that `android:debuggable` is not set to `true` in the `<application>` tag.

• Open the build.gradle file and verify that `debuggable false` is enforced for release builds.

• Rebuild the application and confirm that the production APK does not have debugging enabled.

3. Secure code example

<manifest ...>
    <application
        android:name=".MyApplication"
        android:label="@string/app_name"
        android:theme="@style/AppTheme">
    </application>
</manifest>
// Ensure proper configuration in build.gradle...

This corrected AndroidManifest.xml configuration explicitly removes the `android:debuggable` attribute, relying on the build system to set it correctly. By default, Android's release builds disable debugging, but to ensure no accidental misconfiguration occurs, it is recommended to verify that `debuggable` is not set to `true` manually. Additionally, the Gradle build configuration should enforce this security setting by ensuring that debugging is only enabled in debug builds.

On this page