Trusting SDKs
summary
Demonstrates that 31% of the top 50 SDKs are trivially hijackable and that a Raspberry Pi plus public tools performs a full man‑in‑the‑middle to inject modified SDK binaries via SSL stripping. Shows concrete attacks: replacing SDK downloads, adding 20 lines of malicious code, piping curl | sh to install a keylogger, installing a rogue root cert, and triggering an iCloud phishing prompt. Recommends treating closed binary SDKs as high risk and locking down unencrypted downloads.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:00Felix Kraus
- 2:24Risks of SDKs
- 6:55ARP poisoning
- 11:14Mixed content
- 12:09Fishing
- 14:38Attacking Developers
- 17:04Realistic Attacks
- 20:14Summary
- 21:04Questions
- 26:51Security Blacklists
- 27:53Known Exploits
- 30:01Statistics
- 31:24HTTPS
- 35:36Android
- 36:50Browser
- 39:28HTTP
- 40:08Fast Networks
related talks
24mTrusting SDKs
35mTrusting iOS SDKs
13mKeynote: Hacking the OSS Supply Chain
21mWhen Attackers Go Mobile-First: What Developers Need to Know
15mAvoiding Security and Privacy Issues in SDK Integration
23mSpeed Trap Ahead - Avoiding Costly Security and Privacy Issues in SDK Integration
43mHow to hack and defend (your) open source
21mSecurity is Everyone's Responsibility