Ten Secrets to Secure Mobile Applications
summary
Mobile traffic grows 26x from 2010–2015 and most risks live on the backend and on-device file misconfiguration: examples include NSUserDefaults storing passwords and Core Data/SQLite files written without NSFileProtection so cache.db and photo-roll images expose sensitive data. Practical fixes and tools shown include SQLCipher, Android Keystore, Charles/Burp/ZAP, tcpdump+tshark for host-splitting pcaps, SSL checklist and a certificate pinning repository (pinning measurably slows attackers), plus ProGuard/DexGuard, Conceal and jailbreak/root detection to raise attacker cost.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:13Introductions
- 0:49Considerations: Mobile traffic increases
- 1:24Considerations: Mobile ubiquity
- 2:56Considerations: Mobile insecurity
- 4:01OWASP Mobile Top 10
- 5:23Don't Store or Store Securely
- 12:21Protect the Server (highlights)
- 15:15OWASP ProActive Controls
- 15:56Over the Wire
- 17:39Poor TLS Implementations
- 19:42Unintended Data Leakage
- 25:36Know Your Libraries
- 28:56Mobile Network Traffic
- 32:50Make it hard for the attacker
- 38:08Takeaways
- 39:43iOS 8 Security
- 40:28Swift
- 41:26Android ART
- 42:11We need help!
- 43:38Additional References/Resources
- 44:48Reach out! Questions?
related talks
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
43mSecurity in Android Applications
47mSecuring Android Applications, The Right Way
48mHow to Meet the New Mobile Application Security Imperative
24mModern Android App Security: Protecting Code, Keys, and Data
37mSecuring our apps: anticipate threats, protect users
36mEnhancing Mobile App Security
21mWhen Attackers Go Mobile-First: What Developers Need to Know