Главная
Study mode:
on
1
Intro
2
Overview
3
Hacking Mobile Apps: WiFi Pineapple
4
Hacking Mobile Apps: The ideal setup
5
Hacking AMF: Raw traffic AMF is a binary format
6
Trusting the client
7
Not requiring encryption • Mobile traffic is easy to hijack & sniff . Most mobile apps are not using SSL - A gasp of horror is appropriate • Many of the ones that use SSL do it wrong!
8
Allowing lifetime sessions
9
Not keeping secrets • Session tokens/cookies are sent with each request - Easy to steal • Mobile app can store local data unlike web browser - Web browsers always send their cookies in each request
10
Allowing repeat requests
11
No curfew for requests As discussed, sessions last a long time • Individual requests allowed to stay out partying too long
12
Failing to prevent altered requests
13
Hacking Mobile Apps: Fantasy Football
14
Hacking Mobile Apps: Examples
15
Avoiding the 7 Deadly Sins
Description:
Explore the seven most common security mistakes in mobile app development in this revealing conference talk. Delve into the critical area of session management, uncovering vulnerabilities that can compromise user authentication and data security. Learn about the dangers of trusting the client, improper use of NONCE, and other risky practices that make mobile apps susceptible to attacks. Discover practical strategies to avoid these "Seven Deadly Sins" and strengthen your mobile application's security. Gain insights from real-world examples, including demonstrations using tools like WiFi Pineapple and analysis of AMF (Action Message Format) traffic. Understand the importance of encryption, proper session handling, and protecting against altered requests. Walk away with actionable knowledge to enhance your mobile app development practices and create more secure applications.

Seven Deadly Sins of Mobile Application Development - Unlocking Mobile Hacking Vulnerabilities

OWASP Foundation
Add to list
0:00 / 0:00