Securing Android Applications - The not so secret guide explained
summary
Workshop provides APKs and live exercises that use JADX, APKTool, ADB and Android Studio to find real flaws: a debug build that logs credentials (login checks for "droidSF" / "20 23!"), a hardcoded AES key in code allowing easy decryption of a packaged Base64 blob, a misconfigured FileProvider permitting path traversal, and a pending intent mutable exploit that reads contacts without permission. Security linting is shown (about 40–54 security linters) with links to mitigation articles.
AI-written summary · about
chapters (19)
- 0:00Workshop introduction
- 1:13Security articles overview
- 2:24Speaker background
- 8:05Workshop tools and APKs
- 12:26Storage vulnerabilities
- 17:31Demo with JADX tool
- 30:33File provider vulnerabilities
- 35:59Path traversal issues
- 40:03Cryptography pitfalls
- 45:59Break time
- 47:03Hardcoded secrets demo
- 52:50Platform interaction risks
- 1:00:47Intent redirection demo
- 1:07:03Pending intent vulnerabilities
- 1:12:24Debug flag risks
- 1:13:25Zip password traversal
- 1:14:52Android security linters
- 1:19:54Using security linters
- 1:21:45Closing remarks
related talks
29mSecuring Android Applications - The not so se…
47mSecuring Android Applications, The Right Way
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
34mDemystifying Android Security
37mPractical security for Android apps
01h 02mDon’t get stung by OWASP: An intro into writing code for greater Android Security
43mSecurity First Android Apps