Workshop: Mobile Security

Mobile payment appli­ca­tions are already being used to completely replace physical credit cards and accep­tance terminals. Given their sensitive nature, these software solutions must adhere to strict security require­ments that are tested and verified by security labora­tories. 

SRC is an accredited and inter­na­tionally recog­nized testing laboratory for mobile payment and accep­tance appli­ca­tions. Our job is to ensure that security require­ments are imple­mented in the best way possible. 

In this workshop, we delve into critical security require­ments that aim to protect payment appli­ca­tions from tampering and reverse engineering. The audience will see practical examples of reverse engineering tools, techniques, and counter­mea­sures from the perspective of pentesters, cyber­crim­inals, and devel­opers. Through hands-on demon­stra­tions, we highlight the impor­tance of strong counter­mea­sures and demon­strate how weak counter­mea­sures can be bypassed using free and open source tools. 

Agenda

• Intro: Mobile Sec
• Reverse Engineering (RE):  Attacker’s Approach to RE a mobile app 
  • RE and Analysis Environment
  • Static Analysis
  • Dynamic Analysis
• Anti-RE: Developer‘s RE countermeasures 
  • Obfus­cation
  • Use of native code
  • Anti-Emulation
  • Anti-Root/Anti-Jailbreak
  • Anti-Hooking
  • Anti-Debugging
  • Anti-Tampering
• Anti-Anti-RE: Attacker’s counter­mea­sures against RE  counter­mea­sures