Replicant

basic hardening

• prevent "shoulder surfing" attacks
  • uncheck: Settings -> Security -> make passwords visible [_]
    (this make password entries looks like °°°° instead of switching them digit per digit into dots like °°°s)
  • and of course, don't let anybody standing around you and reading your password entries "over your shoulder"
    (this is really important. Please watch out and hide your device as good as you can from other eyes than your own)

• protect Superuser
  • Settings -> Superuser -> Menu -> Settings -> PIN Protection
    (this prevent people with allowed physical access to you device from using or adding apps with root rights)
  • Be aware of: Settings -> Superuser -> Menu -> Settings -> Declare Permission [_]
    (for sure, this point will be deprecated in the future, like done already here: http://su.chainfire.eu/#updates-permission
    this means that if you enable this option, some root apps without this declaration will be rejected automatically from Superuser)

• Enable screen lock
  • Settings -> Security -> Screen lock
    and choose:
    • PIN (if using this, please use more than just 4 digits)
    • Password (IMHO the better choice)
    • (Pattern is per se insecure and don't work for device encryption)
    • (Slide finally isn't a security mechanism)

• Encrypt your device
  • Settings -> Security -> Encrypt phone
    (this encrypt your /data folder and your /storage/{sdcard0} folder, which is a symlink to a virtual sdcard that lies under /data
    used cipher mode: aes-cbc-essiv:sha256 with 128-bit keys; source: http://isyou.info/jowua/papers/jowua-v5n1-4.pdf)
  • change encryption password, the easiest way to do this is over an open source apps like (Cryptfs Password):
    https://f-droid.org/repository/browse/?fdfilter=cryptfs&fdid=org.nick.cryptfs.passwdmanager
    keep in mind, that for example this app, need your Superuser "Declare Permission" to be unchecked.
    (Response of the app developer in this context: https://github.com/nelenkov/cryptfs-password-manager/issues/6)

• disable ADB (in the meantime you don't use it; or you probably don't need it at all)
  • uncheck: Settings -> Developer Options -> Android debugging [_]
    (this prevent "P2P-ADB" attacks like shown here: https://www.youtube.com/watch?v=OmDwl50usZg)

advanced hardening

• use a firewall
  • for example the following open source app (AFWall+):
    https://f-droid.org/repository/browse/?fdfilter=afwall&fdid=dev.ukanth.ufirewall
  • inside that app, check: Menu -> Preferences -> IPv6 Support [X]
    (AFAIK basic IPv6 supported is present since Android 2.1. Since Android 4.0 IPv6 is also enabled for 3G Networks by default.
    So if your Router and/or ISP supports IPv6, you'll get an IPv6 address automatically and should definitely include this point)
  • also check: Menu -> Preferences -> Fix Startup Data Leak [X]
    (this prevent data leaks at boot, before the firewall service is started)
  • personally, I'm working with "White list" mode, which only allows manually selected apps to have network access (in and out)
    if you want to do this, too and want to use NTP (automatic time adjustment over internet), you should enable this two points:
    • (NTP) - Internet time service = of course ;-)
    • (root) - applications running as root = in my tests, NTP only worked if the UDP-packets sent to my DNS server(s) with root rights were not be blocked; while the "why" is a really good question, I sadly don't know the answer :-/

• enable Pricacy Guard by default
  • check: Settings -> Security -> Privacy Guard -> Enable by default [X]
    (to activate the Privacy Guard setting for every new installed app automatically; of course you can disable it per app afterward;
    you should keep in mind, that apps which need access to your contacts, calendar or GPS should be disabled inside the Privacy Guard)
  • check: Settings -> Security -> Privacy Guard -> Menu -> Show built-in-apps [X]
    (to list all available apps inside the Privacy Guard. You should definitely test the functions you need of the enabled apps)

• Network settings modifications (over Terminal Emulator app, switched to su)
  you should set the following values on every boot, because they will be set back to default at the next boot,
  (to do this, I've made a little flashable zip with an init.d script inside to run at every boot: hardening_v0.1.zip):
  • prevent "DoubleDirect" vulnerability
    sysctl -w net.ipv4.conf.all.accept_redirects=0 # disable all IPv4 ICMP redirect messages
    sysctl -w net.ipv4.conf.default.accept_redirects=0 # disable all IPv4 ICMP redirect messages on all new interfaces
    sysctl -w net.ipv6.conf.all.accept_redirects=0 # disable all IPv6 ICMP redirected packets
    sysctl -w net.ipv6.conf.default.accept_redirects=0 # disable all IPv6 ICMP redirect messages on all new interfaces
  • prevent "SYN flood" attacks
    sysctl -w net.ipv4.conf.all.rp_filter=1 # do source validation by reversed path (RFC1812) on all interfaces
    sysctl -w net.ipv4.conf.default.rp_filter=1 # do source validation by reversed path (RFC1812) on all new interfaces
  • disable router functionalities
    sysctl -w net.ipv4.conf.all.send_redirects=0 # disables acceptance of all IPv4 ICMP redirected packets on all interfaces
    sysctl -w net.ipv4.conf.default.send_redirects=0 # disables acceptance of all IPv4 ICMP redirected packets on all new interfaces
    sysctl -w net.ipv4.conf.all.secure_redirects=0 # disables acceptance of secure ICMP redirected packets on all interfaces
    sysctl -w net.ipv4.conf.default.secure_redirects=0 # disables acceptance of secure ICMP redirected packets on all new interfaces
    sysctl -w net.ipv4.conf.default.accept_source_route=0 # disable source routing on all new interfaces; drop packets with SRR option
  • miscellaneous
    sysctl -w net.ipv4.tcp_no_metrics_save=1 # TCP will not cache metrics on closing connections
    sysctl -w net.ipv4.icmp_echo_ignore_all=1 # the kernel will ignore all ICMP ECHO requests sent to it
  • enable "IPv6 privacy extensions" (RFC3041)
    sysctl -w net.ipv6.conf.all.use_tempaddr=2 # enable Privacy Extensions and prefer temporary addresses over public addresses
    sysctl -w net.ipv6.conf.default.use_tempaddr=2 # enable Privacy Extensions and prefer temporary addresses over public addresses
    note to the value: "net.ipv4.icmp_echo_ignore_all". Usually this point is bad for debugging network stuff on your target device.
    In te past, this point was known as some kind of security feature, but IMHO, today this is more an urban legend. Becaus this point is set back fast with the following Terminal Emulator command, I've decided to leave it enabled in my init.d script:
    • echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
      or
    • sysctl -w net.ipv4.icmp_echo_ignore_all=0

paranoid hardening

• prevent "privilege escalation" attacks
  • removing SUID bits from binaries
    you can change the file permissions over the Terminal Emulator app, switched to su (UNTESTED!):
    mount -o remount, -rw /system/bin
    chmod 0755 /system/bin/ping
    chmod 0750 /system/bin/netcfg
    chmod 0750 /system/bin/run-as
    mount -o remount, -ro /system/bin
    mount -o remount, -rw /system/xbin
    chmod 0755 /system/xbin/librank
    chmod 0755 /system/xbin/procmem
    chmod 0755 /system/xbin/procrank
    mount -o remount, -ro /system/xbin
    or just use my (TESTED!) flashable zip (which also includes the "network settings modifications" from above) named paranoid_hardening_v0.1.zip

fallback note
Don't be afraid; if you want to set the changes back to default (behavior), just "install" the Replicant .zip file (over CWM Recovery) again.
Over this way you don't lose any personal data or settings you made - even on encrypted devices.

disclaimer
Please don't make me responsible for any damage on your device. I've researched and tested very carefully, but if you want to try this at home, please do it at your own risk.

Any suggestions or comments are appreciated!¶