Think outside the server
summary
Covers why client apps need active defenses: modded APKs remove ads or unlock features, social‑engineered crypto APKs impersonate originals, and game clients suffer runtime cheating and GPS spoofing. Default tools like ProGuard R8 or Flutter obfuscation only rename symbols; stronger measures add string encryption and control‑flow flattening but attackers can attach debuggers or hook functions at runtime. Rotate builds frequently to one day of attacker advantage—empirical data shows first dynamic attacks appear roughly a day after release.
AI-written summary · about
chapters (5)
- 0:00Introduction to client-side security
- 4:19Why client-side security matters
- 9:40Real-world attack scenarios
- 12:07Limitations of obfuscation
- 15:40Balancing attacker and developer costs
related talks
38mAdvanced Techniques for Protecting Android Apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
01h 07mHow to attack (and secure) an Android app: an introduction
32mSecuring Android SDKs: A Defense-in-Depth
45mGoing Beyond Obfuscation: Advanced Techniques for Protecting Android Apps
47mSecuring Android Applications
42mAttack & Defend Mobile Apps