Bogdan Alecu: Playing buggy Codecamp

•Transferir como PPTX, PDF•

1 gostou•381 visualizações

Codecamp Iasi 2013 - Playing buggy Bogdan Alecu presents some real world examples of bugs, specially the ones related to mobile security For more info go to www.m-sec.net

Tecnologia

Topics
▪ About me
▪ The buggy world
▪ Where does your data go?
Bogdan ALECU

About me
Bogdan ALECU
▪ Independent security researcher
▪ Sysadmin @ LEVI9
▪ Passionate about security, specially when it’s related to
mobile devices, CISSP, CEH, CISA,CCSP
▪ #infosec conferences: DeepSec, DefCamp, EUSecWest
▪ Started with NetMonitor, continued with VoIP and finally
GSM networks / mobile phones
▪ @msecnet / www.m-sec.net / alecu@m-sec.net

The buggy world
Bogdan ALECU
▪Developers
▪Testers
▪Customers
▪How do you test?
▪But is it enough?

The buggy world
Bogdan ALECU
READY FOR SOME
REAL LIFE EXAMPLES?

The buggy world
Bogdan ALECU
© Prisacaru Anatolie

The buggy world
Bogdan ALECU
NEVER trust the user’s input!

The buggy world
Bogdan ALECU
▪ 20K application
▪ Two factor authentication
▪ ACL IP
▪ User authenticated automatically if …
… coming from the right internal IP

The buggy world
Bogdan ALECU
PLEASE CHECK YOUR
ERS

The buggy world
Bogdan ALECU
▪How was the IP address checked?

The buggy world
Bogdan ALECU
▪ X-FORWARDED-FOR HTTP header

The buggy world
Bogdan ALECU
▪ Modify Headers – Firefox Extension
▪ https://addons.mozilla.org/en-US/firefox/addon/modify-headers/

The buggy world
Bogdan ALECU
▪ Try accessing the website while pretending
to be browsing from your mobile device
▪ You would be surprised of the instant
access you get
▪ No luck? Try Googlebot!
▪ If your log shows a sensitive access being
made by GoogleBot, will you worry ?

The buggy world
Bogdan ALECU
▪ Those damn headers …
DEMO time

The buggy world
Bogdan ALECU
▪ Having the right headers (security by
obscurity) can open a lot of doors

The buggy world
Bogdan ALECU
▪ Those damn headers … AGAIN!
Yet another demo

The buggy world
Bogdan ALECU
▪ Don’t bullshit me: admit your weakness!

The buggy world
Bogdan ALECU
▪Implementation gone wild
▪ How many of you use the Internet on
your mobile device?
▪ Do you know what DNS is?

The buggy world
Bogdan ALECU
Setup a VPN server on port 53, UDP (DNS
port)
… and connect to your server
… pass the traffic to the Internet
UNLIMITED
MOBILE DATA TRAFFIC!

The buggy world
Bogdan ALECU
▪ The standard itself may have issues

The buggy world
Bogdan ALECU
▪SIM Toolkit

The buggy world
Bogdan ALECU
▪ SIM Toolkit
▪ Vulnerability discovered in June 2010
▪ Reported on August 26 2010
▪ CVE-2010-3612

The buggy world
Bogdan ALECU
▪ SIM Toolkit
… and the demo

The buggy world
Bogdan ALECU
▪ FIX THIS NOW!

Where does your data go?
Bogdan ALECU
▪Is the data securely transferred?
▪What info is the app sending?
▪When does it sends the info?
▪Does the app accept any certificate?
▪What is it stored locally?

Where does your data go?
Bogdan ALECU
▪Mallory gateway
http://intrepidusgroup.com/insight/
2010/12/mallory-and-me-setting-
up-a-mobile-mallory-gateway/

Where does your data go?
Bogdan ALECU
▪ Short demo

Call to action
Bogdan ALECU
▪ Don’t rely on thing that most users have no
idea how to check if your app is secure.
You might meet someone like me and it
will get ugly 
▪ Write your code in a secure way
▪ Testers: learn how to really tests mobile
apps. It’s not all about the usage
experience!

The end?!?
Bogdan ALECU
Thank you all!
Don’t forget about feedback
forms
www.m-sec.net / @msecnet

Mais conteúdo relacionado

Semelhante a Bogdan Alecu: Playing buggy Codecamp

Gadgetbridge, a free and open source project, has existed since 2015 to allow wearable device customers to use their hardware without being tied to the online services of the manufacturers. The small but very focused and capable technical community working on the basic functionalities such as retrieving the various data from the wearables (detected activities, sleep, pulse per minute, peripheral oxygen saturation, ...) lacks the expertise on specialised algorithms that could help to perform advanced analysis/diagnostics. The goal of this talk is to explore a potential collaboration between our communities: Gadgetbridge provides local-only support for an extensive list of wearable devices and a community of engineers and privacy minded users, Data4SmartHealth might contribute advanced algorithms and AI on edge devices.

SFSCON23 - Daniele Gobbetti - Gimme! Gimme! Gimme! (Some good algorithms)

South Tyrol Free Software Conference

Introduction to PhoneGap

Raymond Camden

As a web developer it´s easy to feel intimidated by the world of hardware hacking and the physical web, we have to leave our comfort zone and need to get familiar with a completely new development environment. But not anymore, thanks to wonderful possibilities that the WebUSB Api brings to our browsers. In this talk I will give an intro to the endless wonders we can encounter in the hardware world through our browser windows. Aside from leaerning the basics of USB and serial port communication, we´ll paint on USB displays, live tweet to receipt printers, control an Arduino, steal data from Android phones and many more… The only limit is your imagination.

JS Fest 2019. Sebastian Golasch. The Universal Serial Web

JSFestUA

Internet of Things

Andy Gelme

A tale of the Neo900 project about the obstacles on its way to achieve The Ultimate Private Phone. What are the threats for smartphone user's privacy? How to deal with them? Is it possible to make a phone that will protect us so well that it will let us forget about privacy at all? The talk has been given via videoconference on 2014-11-29 at OpenPhoenux Hard- and Software Workshop 2014 in Garching, Munich. Recording: https://www.youtube.com/watch?v=ahPFCFooBv0&list=PL-s0IumBit8Mofxj0Fn2kH6RB9VtnKS4K

Neo900: Crafting The Private Phone

Sebastian Krzyszkowiak

Mobile networks: exploiting HTTP headers and data traffic - DefCamp 2012

DefCamp

Developing wearable technology apps quickly

Raul Chong

Getting started with IoT with only your Laptop - July 2019 - Digital Lincoln

Peter Gallagher

Hyper Island - 2012

Detectify

SWONtech News, January 2012

SWON Libraries Consortium

Getting started with IoT with only your Laptop - March 2019 - DDD North

Peter Gallagher

Introduction google glass en - rev 20 - codemotion

Codemotion

Getting started with IoT with only your Laptop - March 2019 - IoT Leeds

Peter Gallagher

The Universal Serial Web @HolyJS

asciidisco

JavaScript is finding its way further and further out of the browser. Only a couple of years ago, if someone had said they wanted to build robots only using JS you'd think they were crazy. Having tried it at the time those naysayers were correct - it was a disaster. Recently, particularly as a result of the nodebots project, JS Robotics has started to come of age and it's now possible to build simple robots using JavaScript for the majority of the stack - everything from control and sensing to motors to lights, AI and computer vision. This talk will give an overview of what's currently possible, where the current gotchas are, how to get started and have some interactive elements that can be played with during or after the session. Andrew is a creator & destroyer of things that combine mobile web, ubicomp and lots of data. Sometime programmer, interaction researcher & CTO @ JBA. Be Responsive meetup / Melbourne Geek Night Crossover night September 2014

Building Droids with JavaScript

Andrew Fisher

WebRTC is an exciting new technology, perhaps the most exciting thing to happen to voice communication since the invention of Voice over IP. With WebRTC, we are no longer limited to a disjointed communication experience with poor quality audio on antiquated networks. Now we have the ability to put high-definition audio and video where it will have the most impact: right in line with the business processes that benefit the most from it. This session will present an overview of how WebRTC works, reviewing both the network services that support it and the user-facing software that delivers it. We will look at how Asterisk can be used to give WebRTC additional capabilities that aren’t possible with browsers alone, and how to deploy Asterisk to get the most out of this powerful combination. As with all new technology, however, there are rough edges. In the final part of this presentation, we will look at the common ways that WebRTC can break down, from technical deployment problems to user interface and design issues. These lessons are drawn from real-world experience deploying WebRTC over the last 3 years and multiple applications that are in production today.

AstriCon 2015: WebRTC: How it Works, and How it Breaks

Mojo Lingo

Getting started with IoT with only your Laptop - February 2019 - Lancs Tech T...

Peter Gallagher

Google glass

baabtra.com - No. 1 supplier of quality freshers

Don Bailey - A Million Little Tracking Devices

Source Conference

Hacking with paper

Sumedt Jitpukdebodin

Semelhante a Bogdan Alecu: Playing buggy Codecamp (20)

SFSCON23 - Daniele Gobbetti - Gimme! Gimme! Gimme! (Some good algorithms)

Introduction to PhoneGap

JS Fest 2019. Sebastian Golasch. The Universal Serial Web

Internet of Things

Neo900: Crafting The Private Phone

Mobile networks: exploiting HTTP headers and data traffic - DefCamp 2012

Developing wearable technology apps quickly

Getting started with IoT with only your Laptop - July 2019 - Digital Lincoln

Hyper Island - 2012

SWONtech News, January 2012

Getting started with IoT with only your Laptop - March 2019 - DDD North

Introduction google glass en - rev 20 - codemotion

Getting started with IoT with only your Laptop - March 2019 - IoT Leeds

The Universal Serial Web @HolyJS

Building Droids with JavaScript

AstriCon 2015: WebRTC: How it Works, and How it Breaks

Getting started with IoT with only your Laptop - February 2019 - Lancs Tech T...

Google glass

Don Bailey - A Million Little Tracking Devices

Hacking with paper

Último

FWD Group - Insurer Innovation Award 2024

The Digital Insurer

presentation ICT roal in 21st century education

jfdjdjcjdnsjd

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

A Beginners Guide to Building a RAG App Using Open Source Milvus

Zilliz

Effective data discovery is crucial for maintaining compliance and mitigating risks in today's rapidly evolving privacy landscape. However, traditional manual approaches often struggle to keep pace with the growing volume and complexity of data. Join us for an insightful webinar where industry leaders from TrustArc and Privya will share their expertise on leveraging AI-powered solutions to revolutionize data discovery. You'll learn how to: - Effortlessly maintain a comprehensive, up-to-date data inventory - Harness code scanning insights to gain complete visibility into data flows leveraging the advantages of code scanning over DB scanning - Simplify compliance by leveraging Privya's integration with TrustArc - Implement proven strategies to mitigate third-party risks Our panel of experts will discuss real-world case studies and share practical strategies for overcoming common data discovery challenges. They'll also explore the latest trends and innovations in AI-driven data management, and how these technologies can help organizations stay ahead of the curve in an ever-changing privacy landscape.

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Miguel Araújo

Webinar Recording: https://www.panagenda.com/webinars/why-teams-call-analytics-is-critical-to-your-entire-business Nothing is as frustrating and noticeable as being in an important call and being unable to see or hear the other person. Not surprising then, that issues with Teams calls are among the most common problems users call their helpdesk for. Having in depth insight into everything relevant going on at the user’s device, local network, ISP and Microsoft itself during the call is crucial for good Microsoft Teams Call quality support. To ensure a quick and adequate solution and to ensure your users get the most out of their Microsoft 365. But did you know that ‘bad calls’ are also an excellent indicator of other problems arising? Precisely because it is so noticeable!? Like the canary in the mine, bad calls can be early indicators of problems. Problems that might otherwise not have been noticed for a while but can have a big impact on productivity and satisfaction. Join this session by Christoph Adler to learn how true Microsoft Teams call quality analytics helped other organizations troubleshoot bad calls and identify and fix problems that impacted Teams calls or the use of Microsoft365 in general. See what it can do to keep your users happy and productive! In this session we will cover - Why CQD data alone is not enough to troubleshoot call problems - The importance of attributing call problems to the right call participant - What call quality analytics can do to help you quickly find, fix-, and prevent problems - Why having retrospective detailed insights matters - Real life examples of how others have used Microsoft Teams call quality monitoring to problem shoot problems with their ISP, network, device health and more.

Why Teams call analytics are critical to your entire business

panagenda

Real Time Object Detection Using Open CV

Khem

Following the popularity of "Cloud Revolution: Exploring the New Wave of Serverless Spatial Data," we're thrilled to announce this much-anticipated encore webinar. In this sequel, we'll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you're building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Safe Software

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Modernizing Securities Finance: The cloud-native prime brokerage platform transforming capital markets. Madhu Subbu, Managing Director, Head of Securities Finance Engineering Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu

apidays

AXA XL - Insurer Innovation Award Americas 2024

The Digital Insurer

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Juan lago vázquez

Join our latest Connector Corner webinar to discover how UiPath Integration Service revolutionizes API-centric automation in a 'Quote to Cash' process—and how that automation empowers businesses to accelerate revenue generation. A comprehensive demo will explore connecting systems, GenAI, and people, through powerful pre-built connectors designed to speed process cycle times. Speakers: James Dickson, Senior Software Engineer Charlie Greenberg, Host, Product Marketing Manager

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

DianaGray10

In this session, we will delve into strategic approaches for optimizing knowledge management within Microsoft 365, amidst the evolving landscape of Copilot. From leveraging automatic metadata classification and permission governance with SharePoint Premium, to unlocking Viva Engage for the cultivation of knowledge and communities, you will gain actionable insights to bolster your organization's knowledge-sharing initiatives. In this session, we will also explore how to facilitate solutions to enable your employees to find answers and expertise within Microsoft 365. You will leave equipped with practical techniques and a deeper understanding of how there is more to effective knowledge management than just enabling Copilot, but building actual solutions to prepare the knowledge that Copilot and your employees can use.

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Drew Madelung

Bogdan Alecu: Playing buggy Codecamp

2. Playing boogie buggy Bogdan ALECU

3. Topics ▪ About me ▪ The buggy world ▪ Where does your data go? Bogdan ALECU

4. About me Bogdan ALECU ▪ Independent security researcher ▪ Sysadmin @ LEVI9 ▪ Passionate about security, specially when it’s related to mobile devices, CISSP, CEH, CISA,CCSP ▪ #infosec conferences: DeepSec, DefCamp, EUSecWest ▪ Started with NetMonitor, continued with VoIP and finally GSM networks / mobile phones ▪ @msecnet / www.m-sec.net / alecu@m-sec.net

5. The buggy world Bogdan ALECU ▪Developers ▪Testers ▪Customers ▪How do you test? ▪But is it enough?

6. The buggy world Bogdan ALECU READY FOR SOME REAL LIFE EXAMPLES?

7. The buggy world Bogdan ALECU

8. The buggy world Bogdan ALECU

9. The buggy world Bogdan ALECU

11. The buggy world Bogdan ALECU NEVER trust the user’s input!

12. The buggy world Bogdan ALECU

13. The buggy world Bogdan ALECU NEVER trust the user’s input!

14. The buggy world Bogdan ALECU

15. The buggy world Bogdan ALECU NEVER trust the user’s input!

16. The buggy world Bogdan ALECU

17. The buggy world Bogdan ALECU ▪ 20K application ▪ Two factor authentication ▪ ACL IP ▪ User authenticated automatically if … … coming from the right internal IP

18. The buggy world Bogdan ALECU PLEASE CHECK YOUR ERS

19. The buggy world Bogdan ALECU ▪How was the IP address checked?

20. The buggy world Bogdan ALECU ▪ X-FORWARDED-FOR HTTP header

21. The buggy world Bogdan ALECU ▪ Modify Headers – Firefox Extension ▪ https://addons.mozilla.org/en-US/firefox/addon/modify-headers/

22. The buggy world Bogdan ALECU

23. The buggy world Bogdan ALECU ▪ Try accessing the website while pretending to be browsing from your mobile device ▪ You would be surprised of the instant access you get ▪ No luck? Try Googlebot! ▪ If your log shows a sensitive access being made by GoogleBot, will you worry ?

24. The buggy world Bogdan ALECU ▪ Those damn headers … DEMO time

25. The buggy world Bogdan ALECU

26. The buggy world Bogdan ALECU ▪ Having the right headers (security by obscurity) can open a lot of doors

27. The buggy world Bogdan ALECU ▪ Those damn headers … AGAIN! Yet another demo

28. The buggy world Bogdan ALECU

29. The buggy world Bogdan ALECU ▪ Don’t bullshit me: admit your weakness!

30. The buggy world Bogdan ALECU ▪Implementation gone wild ▪ How many of you use the Internet on your mobile device? ▪ Do you know what DNS is?

31. The buggy world Bogdan ALECU Setup a VPN server on port 53, UDP (DNS port) … and connect to your server … pass the traffic to the Internet UNLIMITED MOBILE DATA TRAFFIC!

32. The buggy world Bogdan ALECU

33. The buggy world Bogdan ALECU ▪ The standard itself may have issues

34. The buggy world Bogdan ALECU ▪SIM Toolkit

35. The buggy world Bogdan ALECU ▪SIM Toolkit

36. The buggy world Bogdan ALECU ▪ SIM Toolkit ▪ Vulnerability discovered in June 2010 ▪ Reported on August 26 2010 ▪ CVE-2010-3612

37. The buggy world Bogdan ALECU

38. The buggy world Bogdan ALECU

39. The buggy world Bogdan ALECU ▪ SIM Toolkit … and the demo

40. The buggy world Bogdan ALECU ▪ FIX THIS NOW!

41. Where does your data go? Bogdan ALECU

42. Where does your data go? Bogdan ALECU ▪Is the data securely transferred? ▪What info is the app sending? ▪When does it sends the info? ▪Does the app accept any certificate? ▪What is it stored locally?

43. Where does your data go? Bogdan ALECU ▪Mallory gateway http://intrepidusgroup.com/insight/ 2010/12/mallory-and-me-setting- up-a-mobile-mallory-gateway/

44. Where does your data go? Bogdan ALECU ▪ Short demo

45. Where does your data go? Bogdan ALECU

46. Call to action Bogdan ALECU ▪ Don’t rely on thing that most users have no idea how to check if your app is secure. You might meet someone like me and it will get ugly  ▪ Write your code in a secure way ▪ Testers: learn how to really tests mobile apps. It’s not all about the usage experience!

47. The end?!? Bogdan ALECU Thank you all! Don’t forget about feedback forms www.m-sec.net / @msecnet

Bogdan Alecu: Playing buggy Codecamp

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a Bogdan Alecu: Playing buggy Codecamp

Semelhante a Bogdan Alecu: Playing buggy Codecamp (20)

Último

Último (20)

Bogdan Alecu: Playing buggy Codecamp