Attack & Defend Mobile Apps

on YouTube ↗42m

" summary

Live demo shows how to decompile APK to read layouts and classes, locate hardcoded credentials and hidden password strings, and modify package name then repackage and resign the APK to bypass simple integrity checks. Workflow includes installing a user CA and extract certificates to intercept HTTPS traffic and view API calls. Several tested apps reveal plaintext secrets and exploitable flows, the modified builds install and authenticate on device, and network interception successfully captures sensitive fields.

AI-written summary · about

" chapters (5)

1. 0:00Introduction and welcome
2. 11:46Basics for beginners
3. 20:59Android manipulation techniques
4. 33:17Mobile device security concerns
5. 41:40Conclusion and Q&A

" related talks

• 43mAttacking Android ApplicationsDario Incalza · Droidcon Italy 2017
• 01h 07mHow to attack (and secure) an Android app: an introductionBenjamin Adolphi · droidcon Berlin 2023
• 28mSecure Development whit AndroidEnrique López Mañas · Droidcon Italy 2016
• 47mAttacking Android ApplicationsDario Inalza · 360|AnDev 2017
• 33mHacking and protection of Mobile Apps and backend APIsTomáš Soukal · Fluttercon Europe 2024
• 20mAttack & Defend, Defend & Monitor, Monitor & RespondKeir Storrie · droidcon Berlin 2024
• 47mSecuring Android ApplicationsMarek Defeciński, Andrzej Jóźwiak · Confitura 2013
• 37mThe Art of Hiding Sensitive Info in Plain SightGeorge Kortsaridis · Android Summit 2017