App-etite for Destruction: a look into the cookbook of an attacker
summary
Shows a concrete attack where an app reads an intent string extra and passes it into Class.forName, letting any app trigger privileged actions (examples: make calls, factory reset, install/uninstall) discovered by JADX static analysis and confirmed in Samsung Flow and a demo Run for Roses app. Introduces AppSweep, an automated MASG scanner that flags the issue via data-flow analysis, scans APK/AAB/SDK, integrates with CI, is free, Android-only, static-only for now and reports file/line locations plus fixes.
AI-written summary · about
chapters (13)
- 0:00Introduction and story setup
- 2:36Mobile app security overview
- 4:43Real-world intent abuse cases
- 11:51Industry standards and acronyms
- 12:55OWASP MASVS explained
- 15:50MASG testing guide
- 17:15Do standards actually work?
- 18:39Introducing AppSweep
- 21:12App lifecycle security approach
- 22:39Live demo of AppSweep
- 25:07AppSweep development roadmap
- 26:56Contributing back to security
- 28:43Call to action and closing
related talks
32mApp-etite for Destruction: a look into the cookbook of an attacker
43mAttacking Android Applications
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mAttacking Android Applications
01h 07mHow to attack (and secure) an Android app: an introduction
44mAuditing Your APKs Like a Black Hat Hacker
45mI just hacked your app!
53mAndroid: He protec, but he also attac