If an attacker can edit your mobile code, how do you defend your app?

Jun 4, 2025 · Summarized Jun 4, 2025

Listen in Apple Podcasts Pocket Casts Castro

Key takeaways

Mobile engineers must proactively address security due to the sensitive features in mobile applications.
Real-world case studies highlight how attackers can exploit mobile security vulnerabilities.
Understanding reverse engineering techniques is crucial for both attackers and defenders.
Compiler-based defenses can significantly enhance the security of mobile applications.
Developers are encouraged to educate themselves using resources like OWASP to improve security in their applications.

Summary

Importance of Mobile Security

Jan Syradinsky, a security engineer at Guard Square, discusses the increasing necessity for mobile engineers to prioritize application security. Mobile apps often leverage various sensitive features like GPS, biometrics, and payment systems which can become potential attack vectors if not secured properly. He shared that many developers may not initially recognize these risks.

Types of Mobile App Attacks

The episode dives into specific examples of mobile security threats, including a case where delivery app accounts were hijacked using modified apps. Attackers exploited the app's identity verification process by feeding it pre-recorded videos instead of real-time camera feeds. Syradinsky also discusses risks posed to banking apps using malicious accessibility services that compromise user data.

Reverse Engineering and Attack Methods

Syradinsky explains the methodologies attackers use to reverse engineer mobile applications. He outlines a three-step process: understanding how an app works through APK analysis, creating proof of concept (PoC) attacks, and finally modifying the app to bypass security checks, such as license verification.

Compiler-Based Defenses

The discussion emphasizes the importance of compiler-based defenses in securing mobile applications. By utilizing obfuscation techniques during the compilation process, developers can make it significantly harder for attackers to comprehend the code. Techniques such as control flow flattening and randomization are also mentioned as effective strategies to protect against code tampering.

Practical Steps for Developers

Syradinsky advises developers to start improving their app security by using guidelines from established organizations like OWASP. He highlights the importance of incorporating defensive coding practices even in seemingly secure applications, as vulnerabilities in one app can affect interconnected systems.