All the network is a stage, and the APKs merely players
summary
Shows how an attacker disassembles APKs with apktool/smali and jd gui, intercepts traffic with ProxyDroid and Burp, then loads APK classes into JRuby to call app code directly. Demonstrates grabbing embedded OAuth keys by inserting a logging constant into smali and reading the log, i e extracts OAuth keys via smali edit and log output. Builds and controls thousands of believable accounts using SkullSecurity dumps and US census data, and sells followers as a profitable outcome, many accounts remaining active.
AI-written summary · about
chapters (29)
- 0:00Intro
- 1:53About me
- 5:28Creating fake accounts
- 6:37Assumptions
- 7:30Android
- 8:59Burp Proxy
- 9:42Intercepted Traffic
- 10:29OAuth
- 13:54APK Tools
- 14:39Dalvik
- 16:21Smalley
- 17:06Highlevel overview
- 17:56Lowlevel overview
- 18:11Code Guard
- 19:23Reverse Engineering
- 21:01Comparing the two
- 21:43Stack Overflow
- 23:53Custom crypto code
- 24:37Font size
- 24:51Base64
- 25:48JVM languages
- 27:03Jruby
- 27:30Jruby Client Library
- 30:04Graphing
- 31:44Social bots
- 32:14Fake social accounts
- 34:01Public profile images
- 34:56Spam
- 35:38Monetization
