New answers tagged appsec
1
I agree with Steffen Ullrich's answer - blacklisting leaves too many holes, and it will only be a matter of time until you encounter an unexpected "Gotcha". This is true in general for security, as proper defense in depth should start from the perspective of least privilege. Rather than asking "What shouldn't the user do?" it's much safer to ask "What ...
1
Security is not an universal thing that can just be "improved", just like code can't be "optimized" just like that. You can only optimize code to do something better (e.g. improve execution speed at possibly the cost of readability), just like you can improve security by protecting yourself against something.
So when you want to give your queues random ...
0
It is not ignored by apps as much as your CA certificate is not root. This was changed in Android 7.
You need to root your Android device and install the certificate (renamed to $subject_hash.0) in the /system/etc/security/cacerts/ directory.
As for bypassing certificate pinning, you need to recompile the APK to disable it. Use sh d2j-dex2jar.sh -f your....
0
Typically i wouldnt monitor my network traffic directly on the device that its coming from. You often miss a lot of traffic that is hidden. I would recommand to put it on WLAN and then record all the traffic with a suitable network card (promiscuous mode).
Afterwards un analyse it with wireshark.
This way you can be 100% certain that ur seeing all the ...
Top 50 recent answers are included
