When Security is not a Developer's Fault
summary
Samsung Brazil lab reports one year of manual app assessments and finds concrete platform-driven failures: 25% open broadcast receivers that default to exported, widespread improper SSL handling caused by developers replacing TrustManager (enabling MITM), and critical cases like an install_package exploited because a preloaded app kept an unnecessary system permission. Proposes platform fixes: secure-by-default exports, SDK mapping of APIs→permissions, and new 4.2 APIs for self-signed certs; measurements come from manual audits plus Android XF project traffic (~10K page views/day).
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 2:53Scope of app assessment
- 4:25Common vulnerabilities
- 6:10Broadcast receiver security
- 13:50Platform design and security
- 18:25SSL handling issues
- 21:52Common developer errors
- 23:55Excessive app permissions
- 29:56Summary and Q&A
related talks
41mFive Years of Android Security Research: the Good, the Bad...
43mSecurity in Android Applications
24mModern Android App Security: Protecting Code, Keys, and Data
29mSecuring Android Applications - The not so se…
39mAndroid App Security Fundamentals
21mUnlocking Mobile App Security- Key Insights for Navigating a Rapidly Evolving Threat Landscape
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security