Upgrade to Pro — share decks privately, control downloads, hide ads and more …

The Phantom Menace - How can one mobile App rot...

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for OWASP Japan OWASP Japan
March 02, 2016
Technology
0
140

The Phantom Menace - How can one mobile App rot everything?

Alexey Troshichev
@hackappcom

Avatar for OWASP Japan

OWASP Japan

March 02, 2016
Tweet

More Decks by OWASP Japan

See All by OWASP Japan
OWASP Night 2019.03 Tokyo
Avatar for OWASP Japan owaspjapan
0
380
OWASP SAMMを活用したセキュア開発の推進
Avatar for OWASP Japan owaspjapan
0
1.1k
20190107_AbuseCaseCheatSheet
Avatar for OWASP Japan owaspjapan
0
200
セキュリティ要求定義で使える非機能要求グレードとASVS
Avatar for OWASP Japan owaspjapan
5
1.1k
AWSクラスタに捧ぐウェブを衛っていく方法論と死なない程度の修羅場の価値
Avatar for OWASP Japan owaspjapan
9
3.4k
Shifting Left Like a Boss
Avatar for OWASP Japan owaspjapan
2
320
OWASP Top 10 and Your Web Apps
Avatar for OWASP Japan owaspjapan
2
410
OWASP Japan Proposal: Encouraging Japanese Translation
Avatar for OWASP Japan owaspjapan
1
270
elegance_of_OWASP_Top10_2017
Avatar for OWASP Japan owaspjapan
2
560

Other Decks in Technology

See All in Technology
Codex 5.3 と Opus 4.6 にコーポレートサイトを作らせてみた / Codex 5.3 vs Opus 4.6
Avatar for ama-ch ama_ch
0
200
We Built for Predictability; The Workloads Didn’t Care
Avatar for Michael Stahnke stahnma
0
150
Cloud Runでコロプラが挑む 生成AI×ゲーム『神魔狩りのツクヨミ』の裏側
Avatar for COLOPL Inc. colopl
0
130
仕様書駆動AI開発の実践： Issue→Skill→PRテンプレで 再現性を作る
Avatar for 西岡 賢一郎 (Kenichiro Nishioka) knishioka
2
680
フルカイテン株式会社 エンジニア向け採用資料
Avatar for FULL KAITEN fullkaiten
0
10k
AWS Network Firewall Proxyを触ってみた
Avatar for nagisa_53 nagisa53
1
240
生成AIを活用した音声文字起こしシステムの2つの構築パターンについて
Avatar for Kazuki Miura miu_crescent
PRO
3
220
データの整合性を保ちたいだけなんだ
Avatar for ShoheiMitani shoheimitani
8
3.2k
コスト削減から「セキュリティと利便性」を担うプラットフォームへ
Avatar for SansanTech sansantech
PRO
3
1.6k
Context Engineeringが企業で不可欠になる理由
Avatar for Hirosato Gamo hirosatogamo
PRO
3
660
プロダクト成長を支える開発基盤とスケールに伴う課題
Avatar for yuu26 yuu26
4
1.4k
モダンUIでフルサーバーレスなAIエージェントをAmplifyとCDKでサクッとデプロイしよう
Avatar for みのるん minorun365
4
220

Featured

See All Featured
The Illustrated Children's Guide to Kubernetes
Avatar for Chris Short chrisshort
51
51k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
Avatar for Vitaly Friedman smashingmag
254
22k
Leading Effective Engineering Teams in the AI Era
Avatar for Addy Osmani addyosmani
9
1.6k
Darren the Foodie - Storyboard
Avatar for Kevinho.art khoart
PRO
2
2.4k
Marketing to machines
Avatar for Jono Alderson jonoalderson
1
4.6k
AI in Enterprises - Java and Open Source to the Rescue
Avatar for ivargrimstad ivargrimstad
0
1.1k
Gemini Prompt Engineering: Practical Techniques for Tangible AI Outcomes
Avatar for Mfonobong Umondia mfonobong
2
280
Odyssey Design
Avatar for Ryan Kendrick rkendrick25
PRO
1
500
Navigating Algorithm Shifts & AI Overviews - #SMXNext
Avatar for Aleyda Solis aleyda
0
1.1k
JAMstack: Web Apps at Ludicrous Speed - All Things Open 2022
Avatar for David Neal reverentgeek
1
350
Accessibility Awareness
Avatar for Sarah Abderemane sabderemane
0
56
The SEO identity crisis: Don't let AI make you average
Avatar for Varn varn
0
330

Transcript

  1. The Phantom Menace How can one mobile App rot everything?

  2. Who am I? - Work hard on defense - Have

    fun in offense - Break things 1 Alexey Troshichev @hackappcom

  3. What may be wrong with an App? - Insecure transfer

    - Injections - Insecure storage - Architecture flaws 2 OWASP mobile for details

  4. Common Attacks 3

  5. App is dangerous for users. What’s about vendors? Why should

    we waste time attacking one user, when we can just break into backend to get them all? 4

  6. What can an App tell us? - Environment disclosure -

    Common authentication data - Built-in accounts - Anything you can’t even imagine =) 5

  7. Why it’s interesting? - Static analysis - We are just

    searching strings…and it could be automated =) 6

  8. AWK, STRINGS, GREP? - Not suitable for binary containers -

    Too much garbage 7

  9. App in our dreams 8

  10. App in the real world 9

  11. Steps - Containers recursive traversal - Unusual files search -

    Selective GREP - Structure validation (sqlite, binXML,plist, etc..) 10

  12. Let’s take 21268 top apps from Google Play… …and scan

    it ! 11

  13. Shared cloud storage credentials 12

  14. Environment disclosure 13

  15. Backend sources 8( 14

  16. Free Scanner 15 https://hackapp.com/scanner

  17. Questions Alexey Troshichev @hackappcom 16