Attacking Android Applications
summary
Shows how an APK unzips into classes.dex and resources and how static tooling (apktool, JADX, dex2jar, a custom bytecode viewer) finds things like a hard-coded encryption key in a cipher instantiation; demonstrates dynamic techniques using LD_PRELOAD, Xposed and Frida inject JavaScript to hook methods (example hooks WebView loadUrl) and memory dump, performs MITM with mitmproxy/Burp to reveal an ad SDK exfiltration of contacts, and explains mitigations: obfuscation, packers, SSL pinning and server-side SafetyNet verification.
AI-written summary · about
chapters (24)
- 0:00Start
- 0:38Android Platform Stack
- 1:11Android Application
- 1:42APK Content
- 2:08Build Process
- 2:47DEX Bytecode
- 4:49Smali Bytecode
- 6:07Attack Models
- 7:57Research Questions
- 9:37Reverse Engineering Process
- 12:43DroidGraph
- 14:05Cryptography 101
- 15:35Locate Cryptography
- 18:30WHAT WOULD ACTUALLY HAPPEN
- 19:23Motivation
- 20:05Tools
- 23:23Frida frida client.py
- 24:44Frida - hooks.js
- 26:17xPosed Framework
- 29:05SSL 101
- 31:17Problem
- 32:13MITM Attack
- 34:49Countermeasures
- 40:28SafetyNet API - Insecure
related talks
43mAttacking Android Applications
37mThe Art of Hiding Sensitive Info in Plain Sight
28mSecure Development whit Android
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mSecuring Android Applications
33mShielding Your Android App from Attackers
01h 07mHow to attack (and secure) an Android app: an introduction
45mReverse engineering mobile apps: how, why, and what now?