The art of hiding sensitive info in plain sight
summary
Decompiles an Android APK with APK Lab + jadx to show source, layouts, strings and a constants file that contains a hard-coded AWS secret key; the “encryption” is just string reversal so the secret prints on the second activity. Builds the demo APK, opens manifests/resources/layouts, and locates the secret in Constants.getAwsSecretKey(). Recommends: avoid storing keys in SharedPreferences or external storage, use EncryptedSharedPreferences with separate master keys, keep keys in Android Keystore, verify APK signature, and prefer server-side secrets; NDK only slightly raises the bar.
AI-written summary · about
chapters (15)
- 0:00Hiding data in Android apps
- 1:05Reverse engineering attacks
- 3:14How Android apps are built and packaged
- 4:41Reverse engineering demo
- 13:07Defending against reverse engineering
- 13:48Securing location data
- 14:33Secure HTTP responses
- 16:20Safe local storage
- 18:05Encrypted shared preferences
- 19:10Android Keystore security
- 19:56Protecting secrets with NDK
- 20:40APK signature verification
- 22:25Logic in backend services
- 23:06Security limitations
- 23:50Threat modeling final thoughts
related talks
37mThe Art of Hiding Sensitive Info in Plain Sight
28mSecure Development whit Android
32mKeep it Like a Secret: When Android Apps Contain Private Keys
42mAttack & Defend Mobile Apps
47mAttacking Android Applications
47mSecuring Android Applications, The Right Way
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
39mAre your secrets secure - How mobile apps are leaking millions of credentials