Hacking and protection of Mobile Apps and backend APIs
summary
Overview of concrete threats and countermeasures: repackaging and app cloning can cut revenue by about 4× in a real case, and decompiling a BMW Flutter app reveals JWTs with emails that allow replaying trunk/unlock calls. Popular attack tools shown include Frida for hooking and MobSF and apktool for static analysis, plus Burp for traffic replay. Defenses demonstrated include runtime shielding (FreeRASP) that detects rooting, hooking and repackaging and server-side attestations (Epicrypt / Play Integrity) to block unauthorized API clients.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 3:01Flutter security awareness
- 6:37Thread modeling fundamentals
- 8:29Trust on first use
- 10:16Attack vectors beyond sandboxing
- 12:03Mobile hacking tools
- 13:54App cloning threats
- 16:06Repackaging attack demo
- 17:49Hooking attacks
- 19:14Runtime protection with freeRASP
- 21:04Reverse engineering risks
- 22:34API protection and JWT theft
- 24:30Securing backend APIs
- 27:01API abuse and botnets
- 28:07Malware threats
- 31:39Mitigation strategies
- 33:08Q&A
related talks
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
40mBest practices for shielding mobile apps from emerging threats
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
45mI just hacked your app!
45mHacking and protecting Android apps
42mAttack & Defend Mobile Apps
36mI just hacked your app!
47mSecuring Android Applications