Securing Your Android Network Calls, from 2009 to 2019
summary
Covers the history and practical security of Android network calls from 2009–2019, demonstrating attacks (ARP spoofing + Wireshark to capture clear HTTP credentials; Charles/Burp with user-installed certs to intercept TLS) and defenses. Explains platform changes (Android N ignoring user CAs for apps, Android 9 blocking cleartext), shows okhttp certificate pinning as an app-level mitigation and the difficulties around certificate rotation, and lists tools, attack steps, what protections fail, and how rooted or repackaged apps can still be bypassed.
AI-written summary · about
chapters (10)
- 0:00Start
- 5:31July 24, 2008
- 7:47ARP Spoofing in 2 minutes
- 11:31Key Infrastructure
- 21:45Self-signed certificate
- 22:36OkHttp Certificate Pinner
- 24:09Social Engineering
- 25:19Decompiling
- 25:51Call interception
- 26:06Automating Unpinning
related talks
34mDemystifying Android Security
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
37mPractical security for Android apps
29mSecuring Android Applications - The not so se…
53mThe Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
43mSecurity in Android Applications
43mAttacking Android Applications