From Discovery to Disclosure: Securing Android Applications at Scale
Ibad Shah shares the journey of discovering critical flaws in a million-user Android app, navigating vendor communication, and executing coordinated vulnerability disclosure.
Summary
Vulnerability Discovery in Large-Scale Android Apps
When auditing an Android application with over 1.5 million downloads, security researcher Ibad Shah discovered flaws that compromised premium feature controls and user data.
Technical Flaws in Mobile Application Architecture
Shah analyzes the decompiled APK, demonstrating client-side validation bypasses, insecure local data storage, and improper authorization checks communicating with backend APIs.
The Challenges of Responsible Vulnerability Disclosure
Finding vulnerabilities is often easier than finding the right point of contact; the speaker details navigating organizational hierarchies, legal hurdles, and vendor responsiveness.
Best Practices for Researchers and Organizations
The presentation offers actionable advice for bug hunters approaching vendors professionally, alongside guidance for development teams to establish clear vulnerability disclosure programs.
Related talks
DCGVR Village·50 min
The journey of reverse engineering a budget Android smartphone, uncovering pre-installed carrier bloatware vulnerabilities and navigating responsible disclosure.
Red Team Village·1 hr 1 min
Kyle Benac
Kyle Benac presents a structured methodology for auditing Android applications, analyzing hybrid frameworks, IPC intent vulnerabilities, and insecure storage.
Village Presentations·45 min
Theodora Titonis
Veracode VP Theodora Titonis demonstrates using supervised machine learning algorithms to automatically detect malicious Android applications at scale.