Secrets and Lies: Protecting Mobile Apps Through Cryptography and Obfuscation

This session presents practical approaches to protecting mobile applications, users, services, and business data. It compares cryptography, obfuscation, and steganography and covers secret handling, certificate pinning, attack analysis, debugging, and app hardening, primarily through iOS and Swift examples.

Syllabus

Introduction
Lock Picking
Security Through obscurity
Navajo
Encryption
Risk Management
Raising the Bar
Bots
Strings
Tools
Avoid sensitive strings
Storing sensitive API keys
You cannot authenticate an app
Monitor your logs
Hide some secrets
Base64
ToolD
AES
Stronger strings
Random keys
Real strings
Real life obfuscation
When I hack programs
Random data
steganography
scanning for strings
using Charles
certificate pinning
certificate validator
secret knock
secret key
attack your app
Debugging
Hardening
Protect Data