Are your secrets secure? How mobile applications are leaking millions of credentials
summary
GitHub scanning finds about 10 million secrets in public commits (GitGuardian detectors validate keys), compiled mobile apps unzip and reveal hard‑coded credentials, and a Play Store study of 50,000 APKs shows 56% contain credentials. Tools demonstrated include gplay downloader to fetch APKs, decompilers (jdex) and GG Shield to scan decompiled code. Real breaches cited: Toyota tconnect leaked DB creds; a bank’s app exposed an S3 key and 10,000 unencrypted check images. A planted honeytoken sees multiple exploit attempts within minutes.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:52Modern Application
- 29:06Secrets detection workflow (Android)
- 34:46Breach example
- 44:19Limit scope/Restrict Access
- 49:19Preventing leaked secrets
related talks
39mAre your secrets secure - How mobile apps are leaking millions of credentials
32mKeep it Like a Secret: When Android Apps Contain Private Keys
41m[REDACTED]: How to keep your app's secrets, secret
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
33mGaining initial access by exploiting leaked credentials
34mMining and Exploiting (Mobile) Payment Credential Leaks in the Wild
50mHow to keep your app's secrets, secret
31mHow I hacked 30 mobile banking apps & the future of API Security