Windows Phone App Security For Builders And Breakers
summary
Results from 160 apps surveyed show repetitive, verifiable failures: credentials and tokens saved in clear text in app settings and SQLite files, HTTP endpoints and WebView content without TLS, and one contact backup running a local web server on port 5656 that serves unprotected zips. Platform notes include BitLocker limited to enterprise and Windows Store binaries decrypted at install so many Windows Runtime apps ship extractable. Good fixes are use of the password vault and certificate pinning required plus Data Protection API and code obfuscation.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 5:17Encryption
- 6:58External Services
- 9:47Secure Cutting
- 11:12Secure Transfer
- 12:16Maninthemiddle attacks
- 13:20Digital certificates
- 18:25Internal data leakage
- 19:59Cache data leakage
- 21:00Authentication authorization
- 22:10Example
- 25:44Secure Coding Tips
- 27:40Broken Cryptography
- 28:53Exotic Encryption
- 31:30ClientSide Injection
- 33:57Final Example
- 35:04M8 Security Decision
- 37:27Language
- 38:35Tipsy
- 39:41Encrypt
- 40:21Windows Runtime Application
- 41:24Remediation
- 43:06Browsing the file system
related talks
18mThe Latest in Windows Security for Developers
59mLet’s do it right this time: Security in Xamarin mobile apps
21mUnlocking Mobile App Security- Key Insights for Navigating a Rapidly Evolving Threat Landscape
51mSure, Let Business Users Build Their Own. What Could Go Wrong?
39mMobile App Security
49mHow to Hack Your Own Mobile App
45mTen Secrets to Secure Mobile Applications
24mModern Android App Security: Protecting Code, Keys, and Data