Avoiding Security and Privacy Issues in SDK Integration
summary
Survey shows ~20% of developers report 50% of their app is third‑party SDKs. Common, specific failures include insecure random number generation, misconfigured FCM misconfiguration that leaves legacy API keys exposed, and ad SDKs that enabled fraudulent billing. Recommendations: vet and update SDKs, run runtime protections like RASP, use Google Play SDK Index, and pursue independent checks such as the Mobile Application Security Assessment and Apps Defense Alliance guidance.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:51Security remediation survey
- 2:33Apps like automobiles
- 3:37Third-party SDK responsibility
- 4:39Random number generation issues
- 6:31FCM misconfiguration risks
- 8:16Reputation risks from SDKs
- 9:23Open vs closed source SDKs
- 10:05Malicious SDK fraud
- 11:35Legal accountability for SDKs
- 12:47Mitigating SDK risks
- 13:52Google Play SDK Index
- 14:13Final thoughts
related talks
23mSpeed Trap Ahead - Avoiding Costly Security and Privacy Issues in SDK Integration
24mModern Android App Security: Protecting Code, Keys, and Data
20mKeeping Google Play Safe: Privacy, Security and SDKs
27mSecurity Issues In OAuth/OIDC Implementations
35mWhen Security is not a Developer's Fault
48mHow to Meet the New Mobile Application Security Imperative
28mEmbracing innovation by building privacy friendly apps
35mTrusting iOS SDKs