Apisecure, 14 & 15 March 2023 - Ted Miracco, CEO at Approov & Attestation.
summary
Static analysis of 650 Android apps finds only 5 clean apps and 23% exposed high-value secrets; obfuscation shows negligible benefit and only 4% use certificate pinning. Attackers iterate from static to runtime (Frida, emulator, root) to channel (MITM); defenses that work move secrets off-device and split measurement from decision: an SDK sends attestation measurements to a backend auth service that returns short‑lived JWTs or rotated API keys/certificate pins, enabling live secret rotation, forensic telemetry, and safer third‑party API use.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:48Speakers
- 4:56Mobile attack surfaces
- 9:10API secrets in fintech
- 16:44Hiding API secrets
- 20:59Runtime checks limits
- 24:31MITM on API channels
- 31:38Hardening API security
- 33:42Runtime secrets architecture
- 41:49Live updates benefits
- 46:05Summary & Q&A
related talks
48mRemoving Secrets To Make Your Mobile Apps More MASVS-Secure
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
24mModern Android App Security: Protecting Code, Keys, and Data
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
36mEnhancing Mobile App Security
32mSecuring Android SDKs: A Defense-in-Depth
28mDevSecOps: Balancing development and security
39mAndroid App Security Fundamentals