Shielding Your Android App from Attackers
summary
Shows decompiling a mock “Money Bank” APK using Bytecode Viewer and dex2jar, then applies R8/ProGuard renaming (mapping file shown) and Preemptive’s DashO to add string encryption and control-flow obfuscation. Demonstrates modifying a decompiled Volley request wrapper, rebuilding and resigning an APK that exfiltrates JSON login bodies to an attacker server, and shows simple tamper checks that crash a repackaged app. Recommends combining renaming, encryption, control-flow obfuscation and runtime root/emulator/package-integrity checks for best effect.
AI-written summary · about
chapters (9)
- 0:00Introduction to app protection
- 1:19Attacker motivations and risks
- 4:31Decompilation demo and risks
- 8:33Static defenses with obfuscation
- 17:53Runtime analysis threats
- 21:30Creating a counterfeit app demo
- 27:06Runtime defenses and tamper checks
- 31:43Layered protection strategies
- 32:49Conclusion and resources
related talks
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mAttacking Android Applications
45mGoing Beyond Obfuscation: Advanced Techniques for Protecting Android Apps
47mSecuring Android Applications
28mSecure Development whit Android
01h 07mHow to attack (and secure) an Android app: an introduction
37mThe Art of Hiding Sensitive Info in Plain Sight
43mAttacking Android Applications