When Molehill Vulnerabilities Become Mountainous Exploits
summary
Live demo shows an Android money‑manager app whose world‑readable DB and a static encryption key — both rated medium — let a separate exploit app decrypt account passcodes and balances and even verify a changed PIN. Claim: two ignored medium issues chain into a high‑impact breach. Tool focus: static source code analysis / SAST to find those patterns early, plus integrate and automate SAST in CI/CD and shift left remediation so fixes are inexpensive and timely.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:33What doesnt work
- 3:32Initial statements
- 9:13Security conscious organization
- 10:10Prioritize severity
- 11:10Waiting until the end
- 16:20Demo
- 21:10Ontime Delivery
- 23:40QA
- 28:35Developer Adoption
- 32:10Developer Security
- 34:00Questions
related talks
07m"The significance of mobile exploit applications"
32mHack Your Own App: Getting Started with Mobile Penetration Testing
36mI just hacked your app!
24mModern Android App Security: Protecting Code, Keys, and Data
36mEnhancing Mobile App Security
45mI just hacked your app!
45mI just hacked your app!
54m(In-)Security of Backend-As-A-Service