Best practices for shielding mobile apps from emerging threats
summary
Covers concrete defenses and failures: shows using Freda debugger and simple repackaging to change app behavior, reports testing 103 banking and finance apps and finding 46% of apps modified still function, and demonstrates an account token stored in plain text that lets attackers unlock cars. Explains common vectors like accessibility services and Strandhog overlay attack, recommends signature checks, manifest hardening and obfuscation as practical mitigations.
AI-written summary · about
chapters (14)
- 0:00Introduction and speaker intro
- 1:11What is application shielding
- 3:40Types of application security
- 6:15At rest versus runtime attacks
- 10:04Attack surface of apps
- 12:53Android security model and sandboxing
- 15:28Breaking the sandbox and rooting
- 18:49Obfuscation and tamper detection
- 20:36Accessibility services risks
- 23:06StrandHogg and simple exploits
- 25:10Repackaging apps and real-world risks
- 26:58Mobile threat report findings
- 28:58OWASP mobile top 10 and solutions
- 29:19Q&A session
related talks
22mBest practices for shielding mobile apps from emerging threats
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
33mHacking and protection of Mobile Apps and backend APIs
15mBest practices for shielding mobile apps from emerging threats
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
45mHacking and protecting Android apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
49mHow to Hack Your Own Mobile App