Speed Trap Ahead - Avoiding Costly Security and Privacy Issues in SDK Integration
summary
Now Secure pentests show third‑party SDKs cause most problems: a study for the App Defense Alliance finds 85% failed due to integrated SDKs. Concrete failures include a legacy Firebase key allowing global push messages and Elephant Data SDK silently clicking ads and racking user bills. Recommended actions are inventory and updates using tools like OASP dependency check, continuous testing (post‑compile and runtime), and defense‑in‑depth with RASP; use Google Play’s SDK Index and correctly complete the Play Data Safety section.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:50Why this talk matters
- 2:51Third-party code risks
- 4:38SDK implementation pitfalls
- 6:47Firebase misconfiguration
- 8:14Defective SDK components
- 9:40Open vs closed-source SDKs
- 11:47Malicious SDKs example
- 13:13Google Play security limits
- 14:57Regulatory violations
- 15:39Google Play data safety changes
- 17:27Managing app dependencies
- 18:29Due diligence before SDK
- 19:33Security testing and RASP
- 20:16App Defense Alliance
- 21:01Final checklist
related talks
15mAvoiding Security and Privacy Issues in SDK Integration
20mKeeping Google Play Safe: Privacy, Security and SDKs
24mModern Android App Security: Protecting Code, Keys, and Data
37mPerforming Due Diligence as Android Developers
21mUnlocking Mobile App Security- Key Insights for Navigating a Rapidly Evolving Threat Landscape
24mTrusting SDKs
43mTrusting SDKs
39mAndroid App Security Fundamentals