Outdated Mobile Security In the Age of AI

AI made old mobile security cheap to break—so obfuscation, SMS OTP, hardcoded secrets, and client-side checks are useless now. The fix, as explained in the slides, is to move trust to the server, use hardware-backed auth (passkeys, Play Integrity), rotate tokens constantly, and treat every client signal as suspicious

Transcript

1. Android SECURITY BRIEFING Outdated Mobile Security Practices in the Age of AI Why yesterday's defenses no longer hold — and what replaces them A one-hour briefing on the collapsed cost of attacking mobile apps
2. Agenda 01 02 03 04 05 Code-Level Defenses Obfuscation, secrets, storage, review, root checks Authentication & Identity SMS OTP, liveness/KYC, token lifetimes Network & Runtime Cert pinning, deep links, static vs. runtime defense Backend & Fraud Defenses Fraud rules, blacklists, rate limiting, client trust The Mindset Shift & Takeaways What this means for how we build Outdated Mobile Security in the Age of AI 2
3. “AI hasn't invented new vulnerabilities. It has collapsed the cost of exploiting old ones.” Every practice in this deck used to work because it assumed an attacker with limited time, limited skill, or limited patience. AI agents remove all three constraints at once. Outdated Mobile Security in the Age of AI 3
4. 01 Code-Level Defenses Where the app itself stops being a safe place to hide logic Outdated Mobile Security in the Age of AI 4
5. ProGuard / R8 Obfuscation Is a Speed Bump, Not a Wall OLD PRACTICE Rename classes and methods to a, b, c and assume attackers can't follow the renamed logic. WHY AI BROKE IT – LLMs are trained on billions of lines of Kotlin/Java — they read control flow and patterns, not names – JADX-AI-MCP: decompile, highlight a method, ask an AI plugin “what does this do?” – Autonomous agents now analyze an APK end-to-end and suggest exploits unattended WHAT REPLACES IT • Move sensitive logic (key handling, signing) to native NDK/Rust — not just renamed Kotlin • Control-flow flattening, not just identifier obfuscation. • Treat obfuscation as buying time, never as secrecy Outdated Mobile Security in the Age of AI 5
6. Secrets Hidden in the APK Are No Longer Hidden OLD PRACTICE Bundle API keys and credentials inside native code or config files shipped in the APK itself. WHY AI BROKE IT – Extracting embedded secrets used to require real JADX/APKTool/Smali experience – An LLM now walks an attacker through key extraction step by step, on request – The skill barrier for finding a hardcoded secret has effectively dropped to zero WHAT REPLACES IT • Remote configuration instead of bundled secrets • Backend-issued, short-lived credentials • Automated secret rotation as a standing practice, not a one-off Outdated Mobile Security in the Age of AI 6
7. Plaintext Local Storage Is a Gift to Compromised Devices OLD PRACTICE Store auth tokens, PII, and KYC data unencrypted in SQLite or SharedPreferences — “the data is on the device, so it's safe.” 77% 1 in 3 2 of financial apps carry vulnerabilities that could cause a data breach Android apps leak sensitive data via logs or insecure local storage high-profile CVEs — PhonePe & Airtel both stored tokens/PII in cleartext WHAT REPLACES IT • EncryptedSharedPreferences / iOS Keychain — never plaintext • Minimum necessary data on-device, with short-lived tokens • Server-side session management over client-side persistence Outdated Mobile Security in the Age of AI 7
8. Manual Code Review Alone No Longer Catches What Matters OLD PRACTICE Senior engineer review of a pull request catches injected or subtly malicious logic before merge. WHY AI BROKE IT – AI-generated code in PRs is now routine and reads as syntactically clean – Broken encryption easily slips past a quick code review because it perfectly mimics the look of secure code on the surface – It looks correct precisely because it was generated to look correct WHAT REPLACES IT • Automated SAST(Static Application Security Testing.) tuned specifically for crypto misuse — not generic linters • Custom rules (e.g. Semgrep) enforced in CI workflow. • Human review stays in the loop, but stops being the only gate Outdated Mobile Security in the Age of AI 8
9. Root Detection Alone Is a Single Point of Failure OLD PRACTICE A boolean client-side check — if the device is rooted, exit the app. Nothing else. WHY AI BROKE IT – AI generates working Frida scripts to bypass root check and Magisk detection on request – One static check means one bypass ends the defense entirely WHAT REPLACES IT • Play Integrity API combined with server-side risk scoring • Multiple layered signals instead of one boolean flag • Bypass attempts feed the fraud/risk engine rather than just crashing the client Outdated Mobile Security in the Age of AI 9
10. 02 Authentication & Identity Proving the phone is real is not the same as proving the human is Outdated Mobile Security in the Age of AI 10
11. SMS OTP Is Dead — Trojans Harvest It at Scale OLD PRACTICE Send a 6-digit code via SMS as “proof of possession” of the phone number — simple, universal, treated as a second factor. Wonderland RAT Registers on the SMS database and intercepts the OTP before the notification even appears — the user never sees it. ClayRat Abuses the Accessibility Service to read the OTP and auto-input it into the banking app live, on the user's own screen. CVE-2025-10184 An Android 14/15 flaw let apps read the SMS content database without the READ_SMS permission at all. WHAT REPLACES IT • Passkeys / FIDO2, device binding, biometrics • Risk-based authentication over a single fixed factor • SMS OTP demoted to weakest fallback, never the primary defense Outdated Mobile Security in the Age of AI 11
12. Liveness & Biometric KYC vs. Real-Time Deepfakes OLD PRACTICE Selfie video plus a basic blink/smile liveness check proves identity during onboarding or high-value transactions. WHY AI BROKE IT – Real-time deepfake video and 3D avatar injection defeat passive visual checks – Synthesized streams can be fed directly into camera drivers via virtual camera hooks – Pre-2023 liveness SDKs were trained against static photo spoofing, not generative video WHAT REPLACES IT • Hardware-backed attestation — Android Keystore / iOS Secure Enclave cryptographic proofs • Unpredictable, per-session challenge-response gestures, not a fixed prompt • NFC e-Passport scanning paired with server-side behavioral biometrics Outdated Mobile Security in the Age of AI 12
13. Long-Lived Tokens Turn One Theft Into Ongoing Access OLD PRACTICE Issue JWTs valid for 30, 60, or 90 days for the sake of convenience and fewer login prompts. WHY AI BROKE IT – A stolen token can now be abused at automated, AI-driven scale – A long validity window is simply a long attack window – No rotation means a single theft compromises the account indefinitely WHAT REPLACES IT • Short-lived access tokens with refresh token rotation • Device-bound tokens that don't travel across devices • Fast, automated revocation the moment an anomaly signal fires Outdated Mobile Security in the Age of AI 13
14. 03 Network & Runtime The session survives login — the defenses have to survive the whole session Outdated Mobile Security in the Age of AI 14
15. Certificate Pinning Bypass Has Become Commoditized OLD PRACTICE Pin the certificate once at build time and assume man-in-the-middle interception is solved for good. WHY AI BROKE IT – SSL unpinning is one of the most publicly documented Frida use cases – Nearly 1 in 3 Android finance apps remain MITM-exposed despite pinning – AI tooling can detect a pinning implementation and suggest the exact bypass WHAT REPLACES IT • A pin rotation strategy, not a static, unchanging pin • Runtime integrity checks that detect hooking or debugger attachment • Request signing, so intercepted traffic still can't be tampered with Outdated Mobile Security in the Age of AI 15
16. Unvalidated Deep Links Are a Hidden Account-Takeover Path OLD PRACTICE Implement deep links for navigation without validating them — they're assumed safe because they're “just navigation.” WHY AI BROKE IT – A rogue app can intercept a deep link request meant for yours – Password-reset tokens passed via deep link can be captured and replayed – Misconfigured WebViews plus unvalidated links can expose JS bridges holding tokens WHAT REPLACES IT • Android App Links, domain-verified, in place of custom URI schemes • Never pass tokens or PII through a deep link, ever • Nonce-based, session-matched challenges for any reset flow Outdated Mobile Security in the Age of AI 16
17. Static Security Ends at Launch — Runtime Doesn't OLD PRACTICE Secure the code before release with static analysis and obfuscation, then treat security as done for that version. WHY AI BROKE IT – Static protections are blind to anything that happens after deployment – Dynamic hooking, tampering, and repackaging all occur at runtime, post-launch – AI-assisted reverse engineering increasingly runs inside emulated environments WHAT REPLACES IT • Runtime Application Self-Protection (RASP): hook, debugger, and tamper detection • App shielding layered on top of static obfuscation, not instead of it • Real-time threat intelligence feeding rule updates, not a fixed ruleset shipped once Outdated Mobile Security in the Age of AI 17
19. Static Fraud Rules & Blacklists Can't Keep Up OLD PRACTICE Fixed-threshold rules (“more than 3 transfers → flag”) and blacklists of known bad devices or IPs. WHY AI BROKE IT – AI-driven fraud rings rotate device and identity signals continuously – Fixed thresholds are trivial to stay just under, once known – A blacklist only catches an identity that has already been seen once before WHAT REPLACES IT • Adaptive ML risk scoring in place of fixed rule thresholds • Trust scores built from behavior and context, not static blacklists • Continuous authentication throughout the session, not a one-time check at login Outdated Mobile Security in the Age of AI 19
20. Rate Limiting, CAPTCHAs, and Client-Side Trust All Break the Same Way OLD PRACTICE IP-based rate limits and CAPTCHAs stop bots; loan limits, balances, and eligibility rules can safely live in the client. WHY AI BROKE IT – LLM-driven bots mimic human timing, touch events, and device telemetry – Many CAPTCHA variants are now solvable by AI agents directly – AI-assisted reverse engineering finds exactly where client-side business logic lives WHAT REPLACES IT • Device attestation-bound tokens with backend behavioral anomaly scoring • Per-session velocity checks across accounts, not per-IP request counts • The client is never the source of truth — balances, limits, and eligibility validated server-side Outdated Mobile Security in the Age of AI 20
21. THE MINDSET SHIFT The barrier to reverse engineering hasn't lowered. It has collapsed. Five years ago, reverse engineering a fintech APK required real Android and security expertise. Today, someone pastes decompiled code into an LLM and asks: “Where is token generation?” or “How do I bypass this root check?” — and gets a usable answer. Security has become an economic problem: the goal is no longer to make attacks impossible — it's to make them expensive enough that attackers move on. Outdated Mobile Security in the Age of AI 21
22. Quick Reference: Old Practice → What Replaces It Practice Old Assumption Now Requires Obfuscation Renamed code hides logic Native crypto + control-flow flattening SMS OTP Code proves it's you Passkeys / FIDO2 + device binding Cert pinning Pin once, done forever Pin rotation + request signing Root detection One boolean check Play Integrity + server-side scoring Fraud rules Fixed thresholds & blacklists Adaptive ML risk / trust scoring Local storage Device is a safe place Encrypted storage + minimal retention Deep links “Just navigation” Verified App Links, no tokens in links Static review Human diff review is enough SAST tuned for crypto misuse in CI Outdated Mobile Security in the Age of AI 22
25. Thank You Questions & Discussion Iyke Emmanuel | Senior Android Engineer Alpha Omondi | Android Engineer Timz Owen | DevRel Android Outdated Mobile Security in the Age of AI 24