The Android Security Jungle: Pitfalls, Threats & Survival Tips
summary
Android has 1.4 billion active Android devices and a fragmented codebase, so concrete defenses win: Google reports about 60,000 apps updated after Play Store scans; use SSL/TLS with public-key pinning, enforce strong ciphers, and call the Play Services crypto provider. Protect stored data with password‑based keys or libraries like Conceal and SQLCipher; verify APK signatures and use SafetyNet/Root checks (Rootbeer) to detect compromised devices. Harden binaries with ProGuard/DexGuard and run QARK or Drozer to validate defenses.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 0:35The Jungle
- 1:33Scott Alexander-Bown
- 7:42Security Services
- 10:20Newer version of Android are more secure
- 12:51Threats: App Hijacking
- 17:33OWASP top 10 risks
- 18:55Survival tips
- 21:14Network communications
- 22:33Looks like you're not using SSL pinning?
- 24:12Patch against SSL exploits
- 26:48Password based encryption
- 28:38Encryption libraries
- 33:11Verifying App integrity
- 34:40Signing Certificate Verification
- 35:42Verifying device integrity
- 39:06root@android:/#
- 40:53DO YOU EVEN
- 41:33ProGuard
- 43:20DexGuard
- 46:50Quick Android Review Kit Qua
related talks
43mSecurity in Android Applications
24mModern Android App Security: Protecting Code, Keys, and Data
47mSecuring Android Applications, The Right Way
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
39mAndroid App Security Fundamentals
34mDemystifying Android Security
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
32mDebunking Android Security Myths with Data