Securing Android Applications, The Right Way
summary
Explains concrete defenses: use PBKDF2 with ~10,000 iterations and 256‑bit keys instead of hardcoded secrets, store keys in keystore or ask for passwords, and zero out char[] buffers; protect network with public‑key pinning or NetSurfer/OkHttp best‑configs; harden code with ProGuard and DexCard/DexGuard style string/class encryption plus control‑flow obfuscation; detect runtime attacks with SafetyNet checks and root/emulator/hooking detectors (Frida, Xposed, memory dumps via LiME) and minimize in‑memory secret lifetime.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:21Guard Square
- 0:50Outline
- 1:14Malware Injection
- 2:17Sensitive Information Leaks
- 2:56Piracy
- 5:42Some Tools
- 7:53Best Practices
- 12:35Howto: Key Generation
- 14:18Howto: Symmetric Key Management
- 16:46Code Protection
- 19:04For Example
- 19:27API Call Hiding
- 20:09String Obfuscation
- 20:59Name Obfuscation
- 22:43SecurePreferences
- 25:08Conceal Example
- 26:06SSL 101
- 27:26SSL Validation
- 28:30Man-in-the-Middle Attack
- 30:44SSL Pinning with Moxie
- 33:20Dynamic Application Attacks
- 34:29Dynamic Code Injection
- 36:31Memory Dumping
- 37:14Securing Your Environment
related talks
34mDemystifying Android Security
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
45mGoing Beyond Obfuscation: Advanced Techniques for Protecting Android Apps
43mSecurity First Android Apps
38mAdvanced Techniques for Protecting Android Apps
56mThe Android Security Jungle: Pitfalls, Threats & Survival Tips
01h 07mHow to attack (and secure) an Android app: an introduction
43mSecurity First Android Apps