Is Your Android App Secure? Auditing OWASP Mobile Top 10 Flaws
City College professor Sam Bowne demonstrates auditing Android apps for OWASP Mobile Top 10 flaws using APK decompilation and traffic interception.
Summary
The State of Android Application Security
A substantial percentage of commercial and consumer Android applications suffer from critical vulnerabilities identified in the OWASP Mobile Top 10.
Decompiling and Inspecting Android APKs
Sam Bowne walks through using bytecode decompilers (dex2jar, JD-GUI, JADX) to inspect source code for hardcoded API keys and secrets.
Auditing Insecure Data Storage and Transport
Bowne demonstrates intercepting cleartext HTTP traffic, analyzing insecure SharedPreferences files, and exploiting exported Android components.
Remediation Frameworks for Mobile Developers
The author provides developers with code hardening patterns—including certificate pinning, ProGuard obfuscation, and encrypted SQL storage.
Related talks
Village Presentations·44 min
Aaron Guzman
Belkin penetration tester Aaron Guzman breaks down the OWASP IoT Top 10, demonstrating firmware extraction, API reverse engineering, and defensive hardening.
OWASP Foundation·30 min
Analysts investigate attack surfaces and defenses concerning OWASP Global AppSec EU 2025 Closing Ceremony.
OWASP Foundation·46 min
Appdome Consumer Mobile Security Report
Appdome Consumer Mobile Security Report investigates Supercharge Your APPSEC Program with OWASP.