Become a hero to your DevSecOps team
summary
Demo shows a mobile app (a PS Pizza proof-of-concept) with a hardcoded API key and an HMAC-like challenge/response where an extractor uses ADB and JADX to pull and decompile the APK, find the API and crypto keys (R8 inlining exposes the key), and confirm a replayable secret. The claim is client-side authentication plus key protection can halt API abuse — cited as 80% of traffic disappears — and a white-box cryptography solution is presented to keep keys hidden.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 2:34API abuse and server-side defenses
- 5:05Client-side authentication benefits
- 8:44Reverse engineering risks
- 14:12Cryptographic challenge response
- 18:12White-box cryptography solution
- 19:35Company solutions and conclusion
related talks
48mRemoving Secrets To Make Your Mobile Apps More MASVS-Secure
28mDevSecOps: Balancing development and security
33mHacking and protection of Mobile Apps and backend APIs
50mA Tour of API Underprotection
42mAttack & Defend Mobile Apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
45mI just hacked your app!
36mI just hacked your app!