Are your secrets safe - How mobile applications are leaking millions of credentials

The talk starts from the problem that machine-to-machine credentials such as API keys, certificates and service tokens are often hardcoded or left in the wrong place, because people handle them even though systems use them. Mobile apps make this worse, since a simple app usually connects to many third-party services, and each connection needs its own secret.

The speaker looks at public GitHub data, where a yearly GitGuardian report counted about 10 million validated secrets in 2023, and notes that mobile-specific files such as Android manifests, strings.xml and iOS plist files appear often in leaks. The talk then walks through downloading Android and iOS apps, decompiling the APK and unzipping the IPA, and scanning the extracted code. The live scan found valid Google API keys, Slack webhooks and other service credentials in a store app. A penetration test on a bank app is described, where a hardcoded S3 bucket credential exposed thousands of stored check images. Third-party studies of Play Store apps are also summarised, with a large share containing hardcoded credentials.

The takeaways are that secrets belong on the server side behind a login, since obfuscation, Base64 encoding and splitting keys do not protect them. Where a key must live in the app, it should be tightly scoped, restricted by IP or service, and paired with app signing. Teams should assume source code will be read, scan repositories and builds for secrets, and rotate credentials on a regular schedule.