Outsmarting Hackers before your App gets pwn'ed

on YouTube ↗37m

" summary

Scans of 200,000+ apps find surprising scale: 99% ignore iOS Data Protection APIs, ~70% have login screens but lack proper authorization, and server-side control, insecure local storage and broken transport-layer protections top the list. Concrete fixes shown: mark pasteboard items localOnly and add expiry (one line Obj‑C) to block universal clipboard leaks, add a three‑line splash overlay to stop sensitive app snapshots, enable NSFileProtectionComplete/Data Protection API for on‑disk encryption, and enforce ATS (HTTPS) — all small changes that demonstrably close real exploits like juice‑jacking and XcodeGhost vectors.

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 1:20Agenda
3. 5:30Android vs iOS
4. 8:58Copy Paste
5. 11:34Application Snapshot Vulnerability
6. 11:50Application Switcher
7. 15:49Data Protection API
8. 16:43NS File Protection API
9. 21:22Juicejacking
10. 25:30Top 10 Security Issues
11. 29:44Broken Cryptography
12. 31:43Mobile Security Myths
13. 34:14Questions

" related talks

• 27miOS Attack Vectors and how to protect your appItay Brenner · BA: Swiftable 2022
• 47mSecurity Threats & Mitigations for iOS DevelopersEmil Kvarnhammar · GOTO Copenhagen 2015
• 45mTen Secrets to Secure Mobile ApplicationsJason Haddix, Daniel Miessler · OWASP AppSecUSA 2014
• 39mMobile App SecurityThomas Jansen · code.talks 2017
• 49mHow to Hack Your Own Mobile AppAlec Tucker · NDC Sydney 2016
• 58mUncovering OWASP’s Mobile Risks in iOS AppsPatrick Wardle · AppSec California 2015
• 40mBest practices for shielding mobile apps from emerging threatsJan Vidar Krey · droidcon London 2022
• 32mAndroid iPhone Risks and SolutionsJonathan Carter · AppSec California 2014