Trusting SDKs
summary
Claim: 31% of top SDKs vulnerable to simple network attacks where HTTP downloads allow SSL‑stripping or ARP poisoning and let an attacker inject code that runs with app permissions. A Raspberry Pi proof-of-concept takes under an hour using public tools to modify SDK zips, add an iCloud phishing prompt or install a keylogger and SSH backdoor via curl|sh. Vendor response is slow: 3 fixes in 3 days, 5 in a month, 2 in six months, 5 still unresolved.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 1:58iOS SDKs are vulnerable
- 3:26How does it work
- 4:45HTTP vs HTTPS
- 6:11OSI Layers
- 6:35ARP poisoning
- 8:47CocoaPods
- 10:01Localytics
- 11:07Raspberry Pi
- 12:09Amazon SDK
- 13:15Change of topic
- 15:26Requirements
- 16:12Mac
- 16:55Docs
- 17:36Demo
- 19:22How realistic is it
- 20:25Most used SDKs
- 20:51Reaction time
- 21:48Other attack vectors
- 22:42GDPR
- 23:07Conclusion
related talks
43mTrusting SDKs
35mTrusting iOS SDKs
13mKeynote: Hacking the OSS Supply Chain
21mWhen Attackers Go Mobile-First: What Developers Need to Know
23mSpeed Trap Ahead - Avoiding Costly Security and Privacy Issues in SDK Integration
15mAvoiding Security and Privacy Issues in SDK Integration
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
48mMobile Security Attacks: A Glimpse from the Trenches