Mobiconf 2018: Marcos Placona, Twilio
summary
Shows concrete exploits and concrete fixes: an HTTP proxy performs a man‑in‑the‑middle to spoof Pokemon Go geolocation; a Polish developer intercepts ibeacon requests, reads an auth token and beacon ID, and automates free beers (exploit built in an afternoon); leaked AWS keys lead to a $3.5k bill from miners; APKs decompile with apktool so secrets must move to NDK or Android Keystore, and defenses include certificate pinning, ProGuard/DexGuard obfuscation, SafetyNet and network security config plus root/emulator and tamper detection.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:08About Twilio
- 6:59Man in the middle attacks
- 10:32Free beer hack
- 15:14Preventing API hacks
- 21:14Do not trust the device
- 27:59Proactive security measures
- 36:58Mitigating existing risks
- 42:02Developer's responsibility
- 42:48Q&A
