Dangers on Android: Vulnerabilities and Defenses
summary
Overview of common Android vulnerabilities including path traversal, SQL injection, and tapjacking, with a focus on WebView issues such as incorrect input validation, flaws in URL-parsing libraries, unsafe JavaScript interfaces, and deep link handling. The talk presents practical examples and mitigation techniques drawn from the presenter’s development experience to help app developers secure user data rather than leaving responsibility solely to security specialists.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:13About Android security
- 3:18Vulnerabilities and exploits
- 5:27SQL injection flaws
- 8:36Defending against SQLi
- 8:58Path traversal flaws
- 11:27Defending path traversal
- 11:49Arbitrary URL loading
- 14:20Safe link handling
- 15:45URI components
- 17:31Validating URIs
- 18:36SSL pinning protection
- 21:08Backslash in URLs
- 23:57Fixing backslash issue
- 24:39JavaScript interfaces
- 27:50Securing JS interfaces
- 28:13Arbitrary intents
- 31:02Defending against intents
- 31:46Type Jacking flaw
- 33:30Defending Type Jacking
- 34:54Security checklist
- 37:22Q&A
related talks
34mDemystifying Android Security
43mAndroid Security (for Developers)
43mSecurity in Android Applications
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
34mOvercoming JavaScript Unsecurities in WebViews
41mOverview of common Android app vulnerabilities
29mSecuring Android Applications - The not so se…
40mSo, You Want To Use A WebView? [BAD AUDIO]