Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Securing Mobile Devices
Search
Daiane Santos
September 14, 2024
1
21
Securing Mobile Devices
Mind the Sec 2023
Daiane Santos
September 14, 2024
Tweet
Share
More Decks by Daiane Santos
See All by Daiane Santos
A Journey into Mobile Malwares
daianesantos
1
100
Mobile Malwares: how to avoid them
daianesantos
1
19
Pegasus Spyware, a analysis
daianesantos
1
170
Mobile Malwares
daianesantos
1
8
Bypassing APK Protections
daianesantos
1
28
Mobile Hacking
daianesantos
1
34
Bypassing Mobile Protections
daianesantos
1
17
CTF - From 0 to Hero
daianesantos
1
87
GDPR e LGPD: O que eu tenho a ver?
daianesantos
2
310
Featured
See All Featured
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
25
2.8k
Docker and Python
trallard
44
3.4k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
129
19k
Unsuck your backbone
ammeep
671
58k
Keith and Marios Guide to Fast Websites
keithpitt
411
22k
Automating Front-end Workflow
addyosmani
1370
200k
A Modern Web Designer's Workflow
chriscoyier
693
190k
KATA
mclloyd
29
14k
Statistics for Hackers
jakevdp
799
220k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
29
1.7k
Typedesign – Prime Four
hannesfritz
41
2.6k
Why Our Code Smells
bkeepers
PRO
336
57k
Transcript
None
Securing Mobile Devices Daiane Santos
Agenda Common Mobile Vulnerabilities OWASP Top 10 Mobile Securing Mobile
Apps Obfuscation Secure Coding 01 02 03 04 05
$whoami Autist - AH/SD Mobile Security Engineer @ Nubank CTF
Player and Captain @ RATF Neuroscience and Astronomy enthusiast
Common Mobile Vulnerabilities
OWASP Top 10 M1: Improper Platform Usage M2: Insecure Data
Storage M3: Insecure Communication M4: Insecure Authentication M5: Insufficient Cryptography M6: Insecure Authorization M7: Client Code Quality M8: Code Tampering M9: Reverse Engineering M10: Extraneous Functionality
Unauthorized access and fraud; Intelectual property theft; Trust damaged; Negative
end-user experiences; Negative, potentially permanent impact on the brand’s reputation; Ongoing financial losses; Privacy related and confidencial/sensitive data theft. Business Impact
How do I know if I'm vulnerable?
Can someone code-decrypt your app?
Can someone reverse engineer this app with automated tools?
How to Secure Mobile Devices
Source Code Encryption Penetration Tests Secure the Data-in-transit Database Encryption
Cryptography 1. 2. 3. 4. 5.
6. High-level Authentication 7. Secure the Backend 8. Minimize Storage
of Sensitive Data 9. Be careful with Third-Party Services
GENERAL REMOTE ATTESTATION INTEGRITY CHECKS ROOT DETECTION DEVICE BINDING SSL
PINNING EMULATOR DETECTOR RESOURCES ENCRYPTION INTEGRITY CHECKS ANTI-TEMPERING APPLICATION CODE ENCRYPTION CODE OBFUSCATION ANTI-HOOK ANTI-TEMPERING CODE
Obfuscation
None
None
None
None
None
Secure Coding Best practices according to each programming language Map
security requirements at the beginning of the project Include SAST and DAST tools, and a Vulnerability Management process
References OWASP Mobile Top 10 Mobile Testing Guide Secure Coding
Practices
Thank you! If you have any questions, please feel free
to contact me!