Trusting SDKs

Using third party SDKs significantly speeds up your development process. Felix talks about the risks of depending on external code, and how an attacker can easily inject malicious code in software you bundle within your app.

Transcript

1. Trusting SDKs @KrauseFx Felix Krause <felix@krausefx.com>
2. ☺
3. 31% of the top SDKs affected
4. Worst case?
5. Web Security 101
6. HTTP HTTPS
8. Obligatory OSI layer diagram
11. CocoaPods
13. https://s3.aws.com/localytics-sdks/sdk.zip https://s3.aws.com/localytics-binaries/sdk.zip
25. 32% 68% Not vulnerable to simple network attacks Vulnerable
26. 1 resolved within 3 days 5 resolved within 1 month 5 unresolved to this day 2 resolved within 6 months SDK providers’ reaction time
27. Open Source vs Closed Source
28. github.com/trusting-sdks/https
29. @KrauseFx