Enhancing Mobile App Security
summary
Company app fails a VAPT and reveals plaintext and recoverable ciphertext; automated Frida scripts expose key algorithms and show keys retrievable in ~30 minutes. Fixes: move keys into Android Keystore strongbox with biometric auth and session expiry, use SSL pinning (OkHttp or network config) to stop MITM, move noncritical secrets into NDK, run regular MobSF CI scan and use Play Integrity API, SQLCipher and Nuclei templates for backend enumeration. EncryptedSharedPreferences (Tink) may be deprecated so don’t rely on it alone.
AI-written summary · about
chapters (17)
- 0:00Mobile app security intro
- 1:51Common app security myths
- 3:58Obfuscation vs encryption
- 5:45MITM attacks and API security
- 7:11Shift left security strategy
- 8:35Vulnerable app demo
- 10:43Android Keystore best practices
- 14:10Biometric auth and sessions
- 17:42API key protection with NDK
- 20:05SSL pinning to prevent MITM
- 22:09Securing Android components
- 24:14Backend exposure risks
- 25:39Broadcast receiver security
- 27:02Security testing tools
- 33:01Multiple ways apps can be exploited
- 33:41Final security checklist
- 35:45Q&A
related talks
47mSecuring Android Applications, The Right Way
37mPractical security for Android apps
45mTen Secrets to Secure Mobile Applications
24mModern Android App Security: Protecting Code, Keys, and Data
46mA More Secure World for Android Apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
48mRemoving Secrets To Make Your Mobile Apps More MASVS-Secure