Going Beyond Obfuscation: Advanced Techniques for Protecting Android Apps
summary
Shows concrete defenses: use R8/ProGuard or DexGuard for obfuscation, detect tampering by checking CRC hash of classes.dex and validating signatures from the Gradle signing report, block launch and send telemetry when checks fail, use device attestation like Play Integrity API or Firebase App Check to deny untrusted devices, detect root and hooking tools (RootBeer, Talos X, Frida) and hard-fail or degrade features, and expect attackers to bypass any single layer.
AI-written summary · about
chapters (16)
- 0:00Welcome
- 10:09Standard obfuscation limits
- 13:40Mobile security risks
- 14:02Runtime self-protection
- 17:46Binary tampering exploits
- 22:22Integrity checks for tampering
- 24:09Certificate validation
- 25:55DEX for tamper detection
- 27:19Untrusted environment protection
- 29:06Root detection challenges
- 31:54Rooted device handling
- 33:39Frida anti-debugging
- 37:31Debugging prevention
- 39:59Swiss cheese security model
- 40:42Summary and next steps
- 42:26Q&A
related talks
38mAdvanced Techniques for Protecting Android Apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
01h 07mHow to attack (and secure) an Android app: an introduction
32mSecuring Android SDKs: A Defense-in-Depth
47mSecuring Android Applications, The Right Way
47mSecuring Android Applications
33mShielding Your Android App from Attackers
46mDiscovering and Mastering Obfuscation on Android