Removing Secrets To Make Your Mobile Apps More MASVS-Secure
summary
Claim: eliminate secrets at rest in mobile apps by moving signing keys and API secrets to a cloud App Authentication Service that issues short-lived JWTs, driving an OKHTTP interceptor and optional remote secret storage. Prototype uses an SDK that sends measurements (Play Integrity / SafetyNet, app attestation) while defenders use static tools like mobSF and JADX and attackers use Frida and objection. Attestation costs ~100 ms and telemetry shows ~5–10% probing on multi‑million user apps; live rotation and remote verdicts reduce exposed hard‑coded keys.
AI-written summary · about
chapters (22)
- 0:00Intro
- 2:27Danger - Hardcoded API Keys
- 3:11Mobile Attack Surfaces
- 5:33Attack: Static Analysis
- 6:15Defense: Obfuscation
- 9:01Defense: Play Integrity
- 11:51Attack: Manipulator in the Middle
- 13:31Defense: Certificate Pinning
- 15:07Attack: Bypass Certificate Pinning
- 16:59Defense: Harden Channel
- 18:29Hide & Seek Observations
- 20:04How Do We Authenticate Our Users?
- 20:55Design Objectives
- 21:45Proposed Architecture
- 23:27Making a 1st Party API Call
- 24:07Changing the Signing Secret
- 25:59Remote Secrets Storage
- 27:19Managing Certificate Pinning
- 28:07Signing a Message
- 28:46Updating Security Live
- 31:33MASVS Resilience
- 35:34App Auth as a Service
related talks
36mEnhancing Mobile App Security
41m[REDACTED]: How to keep your app's secrets, secret
21mBecome a hero to your DevSecOps team
01h 02mApisecure, 14 & 15 March 2023 - Ted Miracco, CEO at Approov & Attestation.
50mHow to keep your app's secrets, secret
45mTen Secrets to Secure Mobile Applications
23mWhy an SDK is Needed to Protect APIs from Mobile Apps
32mSecuring Android SDKs: A Defense-in-Depth