Break your App before Someone Else Does
summary
Lists concrete checks and tools: run static analyzers (PMD FindBugs Checkstyle and lint), scan DevKnox (84 warnings including tab jacking), push apks out with adb shell pm path then pull, unpack and inspect AndroidManifest and strings, decode and rebuild with apktool/baksmali (rebuilds often work but may need framework files and must be resigned so upgrades fail), run ClassyShark or Androguard for deeper analysis, proxy traffic with Charles proxy to MITM and emulate broken JSON; one user reproduced a crash 219 times exposing a deploy risk.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:04Agenda and best practices
- 3:33Static analysis tools
- 6:24Automated testing importance
- 8:52Testing on devices and beta
- 10:18Production issue tools
- 12:50Penetration testing basics
- 15:59Extracting APKs
- 18:31Analyzing APK contents
- 24:10Modifying and resigning APKs
- 27:04Reverse engineering tools
- 31:23APK tampering risks
- 31:44Advanced APK analysis tools
- 33:50Charles Proxy for traffic
- 37:03Reverse engineering reasons
related talks
45mBreak your app before someone else does
43mBreak your app before someone else does
41mFirst, Do No Harm
31mI have no idea what my app is doing ¯\_(ツ)_/¯ - Protecting your application from unintended side eff
44mAuditing Your APKs Like a Black Hat Hacker
38mAdvanced Techniques for Protecting Android Apps
28mDevSecOps: Balancing development and security
30mDoes your Android app expose you to excess risk?