Android Application Security Testing
summary
Claims that 95% of apps are insecure get concrete here: a demo DVIA with 13 challenges shows a checkout form that logs a credit card to centralized logs, shared preferences and SQLite storing credentials in cleartext, a hard‑coded vendor secret in the APK, and an exploitable SQL injection that returns all three users. Static tooling chain includes Dex2jar and JD‑GUI, apktool, adb and sqlite3; fixes shown are ProGuard/dexguard obfuscation, SQLCipher and removing sensitive logs — demonstrations execute successfully.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 2:05About Smit Shah
- 3:08Agenda
- 3:39Android Architecture
- 5:50Linux Kernel
- 6:59Linux Security
- 13:16Content Providers
- 14:25Intents
- 16:10Explicit Intent
- 17:12App Permissions
- 18:43Application Signing
- 21:30What is Sandbox
- 25:44Top 10 Vulnerabilities
- 27:07Insecure Data Storage
- 29:24Insecure Authentication
- 31:02Encryption vs Encoding
- 33:15Reverse Engineering
- 35:49Tools
- 37:45Challenges
- 40:04Logging
- 42:58Dex to Jar
- 48:45File Permission
- 50:14Database
related talks
01h 07mHow to attack (and secure) an Android app: an introduction
44mAuditing Your APKs Like a Black Hat Hacker
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
39mAndroid App Security Fundamentals
28mSecure Development whit Android
43mSecurity in Android Applications
47mSecuring Android Applications
42mTesting Android Security