Android Security: JavaScript Bridge is Falling Down
Kang Hao explores android security: javascript bridge is falling down at DEF CON SG1, examining android-security and practical defenses.
Summary
Architecture and Background
Kang Hao present 'Android Security: JavaScript Bridge is Falling Down' at DEF CON SG1 CSIT Village, detailing technical frameworks, attack surfaces, and core methodologies in android-security, webview, javascript-bridge, mobile-exploitation.
Vulnerability Analysis
The technical analysis dissects structural design flaws, protocol vulnerabilities, and edge cases uncovered during rigorous research.
Exploitation and Demonstrations
An insecure JavaScript bridge (JSB) in Android WebView allows attackers to abuse exposed interfaces to read local files and steal session cookies, leading to full account takeover via malicious deep links and JavaScript injected into the Android WebView context. During this session, we will dive into the details.
Remediation and Defensive Strategies
Security practitioners and defenders receive actionable defensive controls, hardened configurations, and threat detection strategies to mitigate impact.
Related talks
Black Hat·51 min
Adventures in Android Security Hardening
Presenters detail vulnerability discovery and exploitation in Honey, I Shrunk the Attack Surface - Adventures in Android Security Hardening.
Black Hat·49 min
Security researchers examine technical aspects of Android Security State Of The Union.
DragonJAR - Hacking y Seguridad Informática·50 min
Analyzes are you kidding me? Bypassing Android Security Solutions with a few clicks and evaluates key implications for security practitioners.