Infiltrate Your Own Expo/React Native App
summary
Live demo shows a React Native / Expo app being decompiled, patched and redistributed: APKs/IPAs are opened, the JS bundle and native code are edited with tools like jadx and Hopper, bundles are repackaged and re-signed, and a CodePush update URL is redirected to a malicious zip which installs modified code. Examples include changing a jailbreak check to always return true, modified bundle and re-signed IPA/APK, extracted plain-text Google Maps API key, and replaced CodePush update with malicious zip; attack surface and supply-chain risks are quantified with real incidents and >50% exploitability claims.
AI-written summary · about
chapters (7)
- 0:00Introduction to app vulnerabilities
- 2:29Copycat and fake apps risks
- 4:59Supply chain attack dangers
- 7:26Security best practices overview
- 11:14Know your dependencies
- 13:03Demo tampering with app code
- 24:46Conclusion and Q&A
related talks
45mI just hacked your app!
45mI just hacked your app!
36mI just hacked your app!
45mReverse engineering mobile apps: how, why, and what now?
42mAttack & Defend Mobile Apps
07mI just hacked your app!
33mHacking and protection of Mobile Apps and backend APIs
49mAll Your Code Belongs To Us (Dismantling Android Secrets With CodeInspect)