Provider Installer

Update your security provider to protect against SSL exploits

Android relies on a security Provider to provide secure network communications. However, from time to time, vulnerabilities are found in the default security provider. To protect against these vulnerabilities, Google Play services provides a way to automatically update a device's security provider to protect against known exploits. By calling Google Play services methods, your app can ensure that it's running on a device that has the latest updates to protect against known exploits.

For example, a vulnerability was discovered in OpenSSL (CVE-2014-0224) that can leave apps open to a "man-in-the-middle" attack that decrypts secure traffic without either side knowing. With Google Play services version 5.0, a fix is available, but apps must ensure that this fix is installed. By using the Google Play services methods, your app can ensure that it's running on a device that's secured against that attack.

Patch the security provider with ProviderInstaller

To update a device's security provider, use the ProviderInstaller class. You can verify that the security provider is up-to-date (and update it, if necessary) by calling that class's installIfNeeded() method.

When you call installIfNeeded(), the ProviderInstaller does the following:

• If the device's Provider is successfully updated (or is already up-to-date), the ProviderInstallerEvent.INSTALLED event is dispatched.

• If the device's Google Play services library is out of date, the method throws ProviderInstallerEvent.INSTALL_FAILED event is dispatched. The app can then handle this event and show the user an appropriate dialog box to update Google Play services.

ProviderInstaller.instance.addEventListener( ProviderInstallerEvent.INSTALLED, providerInstalledHandler );
ProviderInstaller.instance.addEventListener( ProviderInstallerEvent.INSTALL_FAILED, providerInstallFailedHandler );
			
ProviderInstaller.instance.installIfNeeded();


function providerInstalledHandler( event:ProviderInstallerEvent ):void
{
    // Provider is installed and up-to-date
}


function providerInstallFailedHandler( event:ProviderInstallerEvent ):void
{
    // Check availability and retry
    var result:int = GoogleApiAvailability.instance.isGooglePlayServicesAvailable();
    if (result != ConnectionResult.SUCCESS)
    {
        if (GoogleApiAvailability.instance.isUserRecoverableError( result ))
        {
            // The error can be resolved
            GoogleApiAvailability.instance.showErrorNotification( event.errorCode );
        }
        else 
        {
            // This is an unresolvable error and Google Play Services functionality will not be available on this device 
        }
    }
    else 
    {
        // Provider could not be updated !! Fatal error
    }

}