I just hacked your app!
summary
Shows concrete Android breaches: intercepted HTTP/HTTPS via MITM attacks (Pokémon Go spoofing), a loyalty app that issues a token allowing a Polish developer to request free beer via loyalty token, and an exposed AWS key that runs up ~$35,000 in 20 minutes. Demonstrates tools and fixes: HTTP proxy and decompilation, certificate pinning, fetching keys from a server or NDK, tamper/root/emulator/debug detection, ProGuard vs. DexGuard costs €4k–€18k, and Google SafetyNet and network security config.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:09Twilio
- 3:24The Men in the Middle Hack
- 15:51Certificate Pinning
- 16:53Do Not Trust the Device
- 17:20Decompiling an Application
- 25:29Checking if Your Device Is Rooted
- 25:44Checking if a Checking for Device Is Rooted
- 27:52Checking if the Application Is Debuggable
- 28:21Check if the Application Is Debuggable
- 28:44How To Make an Application Debuggable
- 35:29The Network Security Configuration
- 41:04Code Obfuscation
related talks
36mI just hacked your app!
44mI just hacked your app!
45mI just hacked your app!
48mMobiconf 2018: Marcos Placona, Twilio
33mHacking and protection of Mobile Apps and backend APIs
42mHack My App: Learn Flutter Security by Breaking It
43mAttacking Android Applications
01h 07mHow to attack (and secure) an Android app: an introduction