7 Deadly Sins: Unlock the Gates of Mobile Hacking Heaven
Talkat AppSec California 2014 · on Tuesday, 2014-01-28· at 14:00· Track 1, Annenberg Community Beach House, East Pacific Coast Highway·
summary
Research claims seven common session-management failures and backs them with live manipulations of real apps showing what actually breaks and why. Examples include captured plain‑text credentials and hard‑coded basic auth in Backup Pro, Snapchat phone‑number enumeration, Starbucks storing passwords on device, and Yahoo Fantasy Football sending editable roster XML that allows lineup swaps. Demonstrations use a wi-fi pineapple, repeatable request replay, and fixes like nonces timestamps and request signing called out in the Seven Deadly Sins and NONCE guidance.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:42Overview
- 2:52Hacking Mobile Apps: WiFi Pineapple
- 3:21Hacking Mobile Apps: The ideal setup
- 11:54Hacking AMF: Raw traffic AMF is a binary format
- 17:23Trusting the client
- 17:54Not requiring encryption • Mobile traffic is easy to hijack & sniff . Most mobile apps are not using SSL - A gasp of horror is appropriate • Many of the ones that use SSL do it wrong!
- 18:43Allowing lifetime sessions
- 19:46Not keeping secrets • Session tokens/cookies are sent with each request - Easy to steal • Mobile app can store local data unlike web browser - Web browsers always send their cookies in each request
- 20:32Allowing repeat requests
- 22:40No curfew for requests As discussed, sessions last a long time • Individual requests allowed to stay out partying too long
- 24:01Failing to prevent altered requests
- 26:19Hacking Mobile Apps: Fantasy Football
- 28:58Hacking Mobile Apps: Examples
- 40:36Avoiding the 7 Deadly Sins
related talks
49mHow to Hack Your Own Mobile App
46mRevenge of the Geeks: Hacking Fantasy Sports Sites
45mTen Secrets to Secure Mobile Applications
31mTopics of Interest: Unlocking Mobile App Security Secrets
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
36mI just hacked your app!
59mHack Yourself First
35mPractical Mobile App Attacks By Example