Securing Android SDKs: A Defense-in-Depth
summary
Four concrete defenses combine: start with obfuscation via R8/ProGuard to remove symbols and delay APK decompilation, add request signing using HMAC-SHA256 over method/path/timestamp/nonce/body-hash with a ~5-minute freshness window, perform a single-device attestation using Play Integrity API to prove the app and device, then exchange that attestation for short-lived session tokens (example 15-minute TTL with a refresh window at the last 20%). Tools: JADX/APKTool for decompilation, Frida for dynamic testing.
AI-written summary · about
chapters (20)
- 0:00Securing Android SDKs intro
- 1:14SDK trust boundaries problem
- 3:21Click spamming fraud example
- 4:25Threat model and four-layer defense
- 5:31Reverse engineering risks
- 7:39HTTPS fails to secure SDKs
- 8:40Obfuscation fundamentals
- 10:51Obfuscation limitations
- 13:17Request signing mechanism
- 16:55Timestamp windows in signing
- 17:17Device attestation with Play Integrity
- 20:51Play Integrity limitations
- 23:00Session tokens for safety
- 24:47Token lifecycle policies
- 26:51Putting layers together
- 27:55Why multiple layers matter
- 28:58Implementation order
- 29:20Key takeaways
- 30:42Tools and resources
- 31:26Q&A
related talks
38mAdvanced Techniques for Protecting Android Apps
45mGoing Beyond Obfuscation: Advanced Techniques for Protecting Android Apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mSecuring Android Applications, The Right Way
01h 07mHow to attack (and secure) an Android app: an introduction
47mDefending Your Users
47mSecuring Android Applications
28mSecure Development whit Android