Securing Android Applications - The not so se…
summary
Covers concrete Android failures and fixes: demonstrates accidental log info disclosure and how to use R8 strip logs to remove debug statements; reproduces real path and zip traversal exploits and gives canonical-path checks; shows secrets leaked in resources and prescribes Android Keystore plus Java Security SecureRandom; lists IPC flaws — exported components, tapjacking, intent redirection and mutable PendingIntent attacks — and recommends set FLAG_IMMUTABLE (API 23+) and strict intent validation; integrates 57 built-in lint checks and an experimental security-lint with 11 rules to automate detection.
AI-written summary · about
chapters (17)
- 0:00Android security talk
- 0:42Speaker background and talk overview
- 1:02Common Android risks
- 3:08Storage vulnerabilities
- 8:10Path traversal risks
- 9:55Zip traversal handling
- 11:19Cryptography best practices
- 12:45Android KeyStore
- 14:28Weak PRNG fixes
- 14:48Platform security controls
- 15:53Exported component access
- 17:37Tap jacking mitigations
- 19:02Intent redirection attacks
- 22:52Pending intent fixes
- 25:04Security lint checks
- 26:49Google security lint
- 29:00Q&A
related talks
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
43mSecurity in Android Applications
34mDemystifying Android Security
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
42mTesting Android Security
37mPractical security for Android apps
47mSecuring Android Applications, The Right Way
01h 02mDon’t get stung by OWASP: An intro into writing code for greater Android Security