Keep it Like a Secret: When Android Apps Contain Private Keys
summary
Crawled and analyzed 1.8 million apps using GPlayCLI, AndroGuard, apktool, JEB, SQLite and OpenSSL, and finds thousands of embedded private keys (including 60,180 private keys and 2,000 Google Play signing keys). Builds a database and uses John the Ripper / Hashcat to crack PKCS12 and Java keystore passwords, achieving ~76% recoveries from RockYou/strings. Demonstrates a Samsung smart‑home case where reverse‑engineered decryption yields a private key whose modulus matches a certificate; many keys are usable and some signing keys are widely distributed.
AI-written summary · about
chapters (8)
- 0:00Start
- 6:50How Do I Know Which Ones Are Private Keys
- 8:31Pkcs12
- 12:30Why Are We Cracking Passwords
- 22:25Samsung Smart Home
- 22:42Install Counts
- 26:21Compare the Private Key and the Public Key Modulus
- 29:54Enterprise Private Keys
related talks
53mAre your secrets secure? How mobile applications are leaking millions of credentials
39mAre your secrets secure - How mobile apps are leaking millions of credentials
56mThe Android Security Jungle: Pitfalls, Threats & Survival Tips
01h 07mHow to attack (and secure) an Android app: an introduction
39mSign here please!
25mThe art of hiding sensitive info in plain sight
47mSecuring Android Applications, The Right Way
45mI just hacked your app!