Upgrade to Pro — share decks privately, control downloads, hide ads and more …

The Phantom Menace - How can one mobile App rot...

Avatar for OWASP Japan OWASP Japan
March 02, 2016
Technology
150
0

The Phantom Menace - How can one mobile App rot everything?

Alexey Troshichev
@hackappcom

Avatar for OWASP Japan

OWASP Japan

March 02, 2016

More Decks by OWASP Japan

See All by OWASP Japan
OWASP Night 2019.03 Tokyo
Avatar for OWASP Japan owaspjapan
0
400
OWASP SAMMを活用したセキュア開発の推進
Avatar for OWASP Japan owaspjapan
0
1.1k
20190107_AbuseCaseCheatSheet
Avatar for OWASP Japan owaspjapan
0
220
セキュリティ要求定義で使える非機能要求グレードとASVS
Avatar for OWASP Japan owaspjapan
5
1.2k
AWSクラスタに捧ぐウェブを衛っていく方法論と死なない程度の修羅場の価値
Avatar for OWASP Japan owaspjapan
9
3.5k
Shifting Left Like a Boss
Avatar for OWASP Japan owaspjapan
2
340
OWASP Top 10 and Your Web Apps
Avatar for OWASP Japan owaspjapan
2
430
OWASP Japan Proposal: Encouraging Japanese Translation
Avatar for OWASP Japan owaspjapan
1
300
elegance_of_OWASP_Top10_2017
Avatar for OWASP Japan owaspjapan
2
580

Other Decks in Technology

See All in Technology
Kaggleで成長するために意識したこと
Avatar for Chikuwabu prgckwb
1
240
依頼文化をやめる日 EM視点で語るPlatform EngineeringとInclusive SRE / Discussing Platform Engineering and Inclusive SRE from an EM's Perspective
Avatar for katsukamaru shin1988
4
5.2k
美しいコードを書くためにF#を学んでみた話
Avatar for yud0uhu yud0uhu
1
400
「ちゃんとやっている」は独りよがりだった ― 不安に寄り添うインシデント対応へ / Towards incident response that addresses anxieties
Avatar for mekka chmikata
1
4.8k
Oracle Base Database Service 技術詳細
Avatar for oracle4engineer oracle4engineer
PRO
15
110k
SRE依存からの脱却 運用を開 発チームへ移す、 フルサイ クル開 発体制の実践
Avatar for joe joooee0000
0
2.6k
Making sense of Google’s agentic dev tools
Avatar for Guillaume Laforge glaforge
1
150
プライバシー保護の理論と実践
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
1
250
Control Planeで育てるBtoB SaaSの認証基盤 - SRE NEXT 2026
Avatar for pokohide pokohide
1
2.2k
脱金融のフューチャー・デザイン / Future Design Beyond Finance
Avatar for Kenji Saito ks91
PRO
0
150
AI Agent SaaS を支える自社仮想化基盤への挑戦と実運用 / ai-agent-saas-virtualization
Avatar for GMO Flatt Security flatt_security
2
3.7k
Zoom2Youtube.Claude
Avatar for Yasunobu Kawaguchi kawaguti
PRO
3
490

Featured

See All Featured
Building Better People: How to give real-time feedback that sticks.
Avatar for Will Jessup wjessup
370
20k
The Art of Delivering Value - GDevCon NA Keynote
Avatar for David Neal reverentgeek
16
2k
How To Speak Unicorn (iThemes Webinar)
Avatar for Michelle Schulp Hunt marktimemedia
1
500
A brief & incomplete history of 
UX Design for the World Wide Web: 1989–2019
Avatar for Jason CranfordTeague jct
2
420
DBのスキルで生き残る技術 - AI時代におけるテーブル設計の勘所
Avatar for soudai sone soudai
PRO
67
56k
The AI Search Optimization Roadmap by Aleyda Solis
Avatar for Aleyda Solis aleyda
1
6k
Navigating the moral maze — ethical principles for Al-driven product design
Avatar for Skipper Chong Warson skipperchong
2
410
The Impact of AI in SEO - AI Overviews June 2024 Edition
Avatar for Aleyda Solis aleyda
5
1.1k
Hiding What from Whom? A Critical Review of the History of Programming languages for Music
Avatar for Tomoya Matsuura tomoyanonymous
3
910
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
515
110k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
Avatar for Marc Duiker marcduiker
35
2.5k
Building a A Zero-Code AI SEO Workflow
Avatar for Ian Lurie portentint
PRO
0
630

Transcript

  1. The Phantom Menace How can one mobile App rot everything?

  2. Who am I? - Work hard on defense - Have

    fun in offense - Break things 1 Alexey Troshichev @hackappcom

  3. What may be wrong with an App? - Insecure transfer

    - Injections - Insecure storage - Architecture flaws 2 OWASP mobile for details

  4. Common Attacks 3

  5. App is dangerous for users. What’s about vendors? Why should

    we waste time attacking one user, when we can just break into backend to get them all? 4

  6. What can an App tell us? - Environment disclosure -

    Common authentication data - Built-in accounts - Anything you can’t even imagine =) 5

  7. Why it’s interesting? - Static analysis - We are just

    searching strings…and it could be automated =) 6

  8. AWK, STRINGS, GREP? - Not suitable for binary containers -

    Too much garbage 7

  9. App in our dreams 8

  10. App in the real world 9

  11. Steps - Containers recursive traversal - Unusual files search -

    Selective GREP - Structure validation (sqlite, binXML,plist, etc..) 10

  12. Let’s take 21268 top apps from Google Play… …and scan

    it ! 11

  13. Shared cloud storage credentials 12

  14. Environment disclosure 13

  15. Backend sources 8( 14

  16. Free Scanner 15 https://hackapp.com/scanner

  17. Questions Alexey Troshichev @hackappcom 16