I just hacked your app!
summary
Concrete exploits include a Pokemon Go-style MITM that spoofs location via an HTTP proxy, a loyalty-app hack that intercepts beacon tokens to mint free beers, and accidental AWS credentials in source that lead to a $3,500 bill. Demonstrations show decompiling with apktool, finding plaintext tokens, and easy replay attacks. Defenses tested are encrypting values, moving keys to a server or NDK module, certificate pinning, tamper-detection (signature/emulator/debug checks), Google SafetyNet, Network Security Config, ProGuard or commercial DexGuard.
AI-written summary · about
chapters (45)
- 0:00Intro
- 0:33What is Twilio
- 1:45Im not a hacker
- 2:35I care about security
- 3:03I just hacked your app
- 3:42Why I cant name names
- 4:21Basic clientserver communication
- 5:00New clientserver communication
- 6:13Pokemon Go hack
- 8:41Cooper Gretzky
- 9:03Loyalty
- 10:56HTTP Request
- 11:52Free Beer
- 12:13How much beer
- 12:27Cooper Gretzkys blog
- 13:36I think they could have
- 14:18Android example
- 15:24Passwords in code
- 16:33Bitcoin mining
- 18:17Using security features
- 18:41Using IBeacons
- 19:23Certificate pinning
- 20:39Do not trust the device
- 21:08Decompiling apps
- 22:33Passwords
- 22:45Encryption
- 23:27Easy and Decay
- 24:48Youre always in trouble
- 25:17App tampering detection
- 25:32App tampering detection example
- 26:26Application signature
- 27:18Root of device
- 27:34Caveat
- 28:00Xposed
- 28:18Hooking
- 29:20Emulators
- 29:41Debuggable
- 30:15What should I do
- 30:27The good news
- 31:18DEX Cards
- 31:46Safety Nets API
- 32:00Device Compatibility
- 32:52Network Security Configuration
- 34:15Important Message
- 35:05My email address is
