Five Years of Android Security Research: the Good, the Bad...
summary
Five years of research catalogs concrete wins and persistent failures: app-store scanning and OS hardening (mandatory access control, memory mitigations, hardware enclaves) reduce large-scale risk, while 75% background permission prompts and 10–50% revenue loss to app piracy remain significant. Practical tools include binary rewriting for in-app monitoring — effective and widely used but fragile against native code and tampering — and side‑channel exploits (shared memory, motion sensors) and WebView/SSL mistakes that repeatedly expose credentials. Library churn leaves many apps running outdated third‑party SDKs that keep vulnerabilities alive.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:56Attack Spectrum
- 4:44Primer on Android Security
- 11:15What Is Android Security Research
- 16:00Improving the Operating System
- 16:48Mandatory Access Control
- 19:53Reference Monitoring
- 32:39User Driven Access Control
- 37:50The Danger of Third-Party Libraries
- 38:07What Is the Difference between Advertisements on the Web and Advertisements in Your App
related talks
43mSecurity in Android Applications
24mModern Android App Security: Protecting Code, Keys, and Data
35mWhen Security is not a Developer's Fault
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
56mThe Android Security Jungle: Pitfalls, Threats & Survival Tips
41mOverview of common Android app vulnerabilities
53mThe Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
34mDemystifying Android Security