Analyzing the Security of Mobile Apps for Automobiles
summary
Analyzes Android client apps from multiple OEMs in Japan and the US using the AndroBugs scanner and manual reverse engineering, producing per-app reports and confirming issues. Finds several apps that accept SSL certificate validation bypass (enabling MITM), some webviews loading plain HTTP endpoints, and exposed code patterns that could enable fragment injection if activities become public. Tests a cheap OBD-II Bluetooth dongle and documents fixed PIN pairing and counterfeit chips; some flaws are confirmed, others remain potential.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:21Automotive security overview
- 5:18Entry points for attacks
- 8:14OBD dongle vulnerabilities
- 11:55Automotive hacking examples
- 15:56Remote automotive system entities
- 18:56Mobile app security analysis
- 22:08Mobile app vulnerabilities
- 27:14SSL/TLS flaws in apps
- 35:10Certificate validation bypass impacts
- 37:04SSL/TLS vulnerabilities persist
- 40:51Security countermeasures
- 44:50Secure app development resources
- 45:37Scan results summary
- 48:55Remote control vulnerabilities
- 51:25Future research
related talks
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
33mHacking and protection of Mobile Apps and backend APIs
57m(In)Security of Mobile Banking
33mBest Practices for Mobile App Security Testing
24mRecent Mobile App Security Incidents from Real-World Cases
41mOverview of common Android app vulnerabilities
58mAndroid Application Security Testing
01h 13mAutomated Static And Dynamic Security Analysis of Mobile Apps