Demystifying Android Security
summary
Covers three concrete Android attack vectors: network (use HTTPS, trust chains, certificate pinning, OkHttp and plan for certificate rotation), local storage (avoid plain SQLite or SharedPreferences for secrets, prefer server-side storage or Android Keystore and session tokens), and reverse engineering (apk → dex → jar with dex2jar, mitigate with ProGuard/NDK layers). Mentions SafetyNet for root detection, intent/deep‑link risks, keyboard exfiltration, screenshot leakage and practical build pitfalls like ProGuard breaking releases.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 4:24Open Web Application Security Project
- 5:05Securing Your Servers
- 5:58Communication
- 6:10Story
- 7:07What happened
- 8:06Solution
- 9:44Analogy
- 10:25Asymmetric Encryption
- 11:26Actors
- 13:35Certificate Authority
- 14:36Certificate Pinning
- 15:20Certificate Library
- 17:03Storage
- 17:17Story Time
- 18:08Android Stories
- 19:40Printed Storage
- 20:53Cloud Storage
- 21:13Local Passwords
- 22:33Amber Nap
- 23:04Mom
- 23:19Compile
- 25:32NDK Libraries
- 26:19Safety Net API
- 27:23untrusted
- 28:12thirdparty
- 29:01sequel injection
- 29:29keyboards
- 30:51screen capture
- 31:43we are screwed
- 31:56Security is laptop
related talks
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
43mSecurity in Android Applications
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mSecuring Android Applications, The Right Way
28mSecure Development whit Android
29mSecuring Android Applications - The not so se…
37mPractical security for Android apps
56mThe Android Security Jungle: Pitfalls, Threats & Survival Tips