Are your secrets secure - How mobile apps are leaking millions of credentials
summary
Findings show hard facts not vague promises: 10 million secrets on GitHub, including ~2 million cloud provider keys and 23,000 AndroidManifest.xml files with secrets; decompilation of Play Store apks reveals problems too — 50,000 apks scanned with 55% of apps containing hard‑coded secrets and ~13,000 Firebase URLs of which ~1,000 are public. Reproducible methods use an APK downloader, decompiler jadex and secret scanner GG Shield; real breaches include Codecov, SolarWinds and Toyota t‑connect.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:07Hard-coded secrets problem
- 6:4510M secrets leaked on GitHub
- 11:21Finding secrets on GitHub
- 13:49Live demo: AWS credentials leak
- 14:52Real-world breaches
- 16:58Secrets in private repos
- 18:42Codecov supply chain attack
- 20:30Secrets in APKs
- 21:34Demo: extracting secrets
- 25:28Play Store secret leaks
- 28:58Secure secret storage
- 31:27Common exposure ways
- 34:40Prevention best practices
- 37:06Honey tokens detection
- 38:10Live leaked credentials results
related talks
53mAre your secrets secure? How mobile applications are leaking millions of credentials
41m[REDACTED]: How to keep your app's secrets, secret
50mHow to keep your app's secrets, secret
32mKeep it Like a Secret: When Android Apps Contain Private Keys
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
33mGaining initial access by exploiting leaked credentials
31mThe internet is broken: breaking down the software supply chain
34mMining and Exploiting (Mobile) Payment Credential Leaks in the Wild