I just hacked your app!
summary
Shows exploited Android flaws with concrete demos: an API spoof that fakes GPS for Pokemon Go, a loyalty app replay that steals authentication tokens in plaintext to claim free beers, and an APK decompile that reveals hardcoded keys leading to a real-world AWS bill of ~$3,500. Walks through mitigations actually implemented: certificate pinning, Android Keystore and NDK storage, SafetyNet and Network Security Configuration, plus tools used like apktool, ProGuard/DexGuard and checks for root/Emulator/Xposed.
AI-written summary · about
chapters (17)
- 0:00Start
- 1:10Disclaimer
- 7:00Motivation
- 16:53Encrypt Your Beacons
- 18:13Certificate Pinning
- 21:25Storing Keys on a Server
- 22:01Storing Keys on the Ndk
- 24:21Key Store
- 29:34Thumbprint Detection
- 30:36Checking Your Application Signature
- 30:54Checking for the Application Signature
- 33:08Checking for Routes of Devices
- 36:57Check Your Emulators
- 37:26Check if the Application Is Debuggable
- 40:30Certificate Checks
- 41:45Safety Nets
- 42:34Implement Network Security Configuration
