Mobile App Security
summary
Analyzes the top 200 free iOS apps and reports concrete failures: 80 apps send sensitive data in clear text, 97 apps accept any TLS certificate, 14 apps embed exploitable secrets, total 111 apps with significant flaws and an estimated 170 million insecure monthly downloads. Uses Wi‑Fi MITM proxies and binary string extraction, cites tools like Wi‑Fi Pineapple and app decryption, shows certificate pinning as mitigation but warns of maintenance cost, highlights AWS key reuse and that only one vendor fixed an issue so far.
AI-written summary · about
chapters (12)
- 0:00Start
- 3:44Protected You
- 5:38Remote Access
- 7:12Physical Access
- 10:26App Transport Security
- 15:55Disabling Trust Programmatically
- 18:43Example Code
- 19:03Considerations
- 20:29Needle In A Hay Stack
- 22:34Third-Party Cloud Services
- 24:32Counter Measures
- 26:54Motivation
related talks
48mMobile Security Attacks: A Glimpse from the Trenches
21mUnlocking Mobile App Security- Key Insights for Navigating a Rapidly Evolving Threat Landscape
33mBest Practices for Mobile App Security Testing
48mHow to Meet the New Mobile Application Security Imperative
45mTen Secrets to Secure Mobile Applications
37mOutsmarting Hackers before your App gets pwn'ed
58mUncovering OWASP’s Mobile Risks in iOS Apps
40m 10 Things you Need to Know before Implementing Cryptography