H*ck yourself

Silguero recommends reviewing your app before attackers do, starting with its APK or IPA. He demonstrates inspecting Android manifests, resources, Smali code, and JavaScript bundles for hardcoded keys and other sensitive information. Hermes bundles can also be disassembled into instructions for inspection. He names APKnown, APKX, and MobSF as automated analysis tools.

Silguero recommends avoiding secrets in client apps where possible, since they cannot be made completely safe there. He discusses Hermes with Obfuscator.io for making JavaScript harder to read, and ProGuard for Android, while noting that obfuscation rules can increase bundle size. He also warns that AsyncStorage data is stored as plain text in an SQLite database that can be retrieved from a rooted device or emulator.

As alternatives to AsyncStorage, Silguero mentions React Native Encrypted Storage and MMKV, a C++ library from Tencent with React Native wrappers. He says MMKV supports encryption and storing data types beyond strings. Without encryption, its data file is readable; with encryption, it requires the encryption key.

Silguero describes Frida as a tool for hooking app code and changing behavior without modifying the original source. His examples include returning fixed location coordinates and logging AsyncStorage calls with frida-trace. He demonstrates patching an APK with Objection to add Frida Gadget, then hooking a device validation so it returns false, showing how runtime checks can be bypassed.

Silguero says no security approach is bulletproof, but teams can reduce the chance of successful attacks. He suggests learning ethical hacking and practicing on company apps or dedicated testing labs. He also points to network traffic, proxies, public databases, and activities as topics for further investigation.