The Art of Hiding Sensitive Info in Plain Sight
summary
Shows exactly what gets exposed and how: renames an .apk to .zip, extracts AndroidManifest, resources and classes.dex, runs apktool, runs dex2jar to get a .jar and open it in a Java decompiler, and inspects layouts, strings and third‑party libs (Picasso, wearable module). Demonstrates ProGuard/obfuscation and recommends signing checks, moving secrets to a server, HTTPS and auth. Cites concrete mistakes: credit card strings in res and an embedded AWS admin key that led to an $8,000 bill.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:37Information That We Need To Hide
- 2:35Gps Mock Locations
- 3:45The Network Layer
- 5:12Authentication
- 5:42Apk Compiling
- 8:39Decompiling Demo
- 10:48Resources
- 13:37Strings
- 17:09Virtual Methods
- 19:36The Picasso Library
- 22:08Java Decompiler
- 24:00The Apk Signing Process
- 24:53Code Example
- 26:18String Confiscation
- 28:06Android Proguard
- 34:23Is proguard Not Enough
related talks
47mAttacking Android Applications
25mThe art of hiding sensitive info in plain sight
44mAuditing Your APKs Like a Black Hat Hacker
28mSecure Development whit Android
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
33mShielding Your Android App from Attackers
43mAttacking Android Applications
47mSecuring Android Applications