I just hacked your app!
summary
Walks through specific attacks and fixes: man-in-the-middle interception used to spoof Pokémon Go locations, a Polish loyalty app where plain HTTP beacon requests with an unencrypted auth token let one user request free beers repeatedly, leaked AWS keys that generate a $3,500 bill within minutes, and trivial APK decompilation that exposes hardcoded secrets. Recommends defenses that actually work: certificate pinning, Google SafeNet checks, moving secrets into an NDK module and commercial obfuscation like DexGuard.
AI-written summary · about
chapters (26)
- 0:00Introduction and disclaimer
- 2:42What is security and why care
- 5:53HTTP requests and man-in-the-middle
- 7:18Hacking Pokemon Go
- 9:48Free beer hack explained
- 14:10How to prevent app hacks
- 15:37Encrypting values in apps
- 17:24Avoid committing secrets
- 19:30Utilize security features
- 20:54Certificate pinning explained
- 21:38Do not trust devices
- 22:42Decompiling apps and risks
- 25:54Proactive security measures
- 26:35Adding tamper protection
- 28:01Check app signatures
- 29:06Why apps get copied
- 30:32Handling rooted devices
- 31:55Detecting root with Xposed
- 32:38Hooking and malware risks
- 33:41Preventing emulator use
- 34:44Debug mode vulnerabilities
- 36:09Start securing now
- 36:54ProGuard and DexGuard
- 39:01SafetyNet API benefits
- 41:08Network security configuration
- 42:38Security mindset matters
