#HITB2022SIN #COMMSEC Building An Army Of Bots By Hijacking a Twitter Handle
Details #HITB2022SIN #COMMSEC Building An Army Of Bots By Hijacking a Twitter Handle and evaluates key implications for security practitioners.
Summary
From mobile privacy to secrets
Rahul and Vishal explain how their BeVisual mobile privacy project evolved into broader mobile-app security research. They responsibly disclosed findings to affected vendors after discovering widespread hard-coded secrets in Android and iOS applications indexed at scale.
Scale of exposed credentials
Scanning hundreds of thousands of apps, they found hard-coded AWS API keys, Firebase URLs with default write access, Zendesk keys exposing support tickets, and more. They built over 200 YARA-style signatures to hunt these patterns automatically across decompiled packages.
BeVisual analysis pipeline
Their platform decompiles apps with tools like JADX, performs static analysis, and uses grep-style pattern matching to surface leaked keys. The talk connects mobile supply-chain risk—where backend credentials ship inside consumer apps—to downstream abuse such as bot armies and infrastructure takeover when handles or APIs are compromised.
Related talks
Hack In The Box Security Conference (HITBSecConf)·25 min
Hao Chen
Outlines #HITB2022SIN #COMMSEC Fuzzing The MCU Of Connected Vehicles For Security And Safety and evaluates key implications for security practitioners.
Hack In The Box Security Conference (HITBSecConf)·31 min
Thomas Weber
Provides #HITB2022SIN #COMMSEC Faking At Level 1: How Digital Twins Save Your PLCs and evaluates key implications for security practitioners.
Hack In The Box Security Conference (HITBSecConf)·34 min
Zoltan Balazs
Details #HITB2022SIN #COMMSEC Web3 + Scams = Its A Match and evaluates key implications for security practitioners.