Uploaded August 2020 | Updated September 2026, 2 hours ago
When it comes to Android APKs, size matters. Which is why developers often leverage code obfuscation in release builds. While such tactics can make it cumbersome to reverse engineer these applications, a false sense of security may also present opportunities for bug bounty hunters. In this talk, Nerdwell will demonstrate simple techniques to identify open source libraries in obfuscated APKs. Then he'll present new research that shows how common obfuscation techniques can lead to unexpected, and vulnerable, Java object deserialization.
Matt is passionate about securing the Internet and helping others achieve their infosec career goals. He has been building and breaking IT systems for 20 years and has experience in regulated industries, like healthcare and public utilities.
Recorded at #Levelup0x07 22 Aug, 2020.
Presented by Bugcrowd.
Follow Matt Nerdwell: twitter.com/TheRealNerdwell
Sign up on Bugcrowd: bugcrowd.com
Join the conversation: https://discord.levelup.sh.
Follow Bugcrowd: twittter.com/Bugcrowd
When it comes to Android APKs, size matters. Which is why developers often leverage code obfuscation in release builds. While such tactics can make it cumbersome to reverse engineer these applications, a false sense of security may also present opportunities for bug bounty hunters. In this talk, Nerdwell will demonstrate simple techniques to identify open source libraries in obfuscated APKs. Then he'll present new research that shows how common obfuscation techniques can lead to unexpected, and vulnerable, Java object deserialization.
Matt is passionate about securing the Internet and helping others achieve their infosec career goals. He has been building and breaking IT systems for 20 years and has experience in regulated industries, like healthcare and public utilities.
Recorded at #Levelup0x07 22 Aug, 2020.
Presented by Bugcrowd.
Follow Matt Nerdwell: twitter.com/TheRealNerdwell
Sign up on Bugcrowd: bugcrowd.com
Join the conversation: https://discord.levelup.sh.
Follow Bugcrowd: twittter.com/Bugcrowd
