penetration testing

EncryptedSharedPreferences is Dead: Here’s What You Should Use Instead

—

Android application developers often store sensitive data to disk, relying on physical device security and process isolation to prevent attackers from obtaining that data. This goes against security best practices, and doesn’t take advantage of the latest tools made available by Google to mitigate the risk of locally-stored sensitive data. This post explores what those tools are, discusses previous (now deprecated) methods for securing data locally, and provides recommendations for what Android developers should do if storing sensitive data is unavoidable.

Immutable Strings in Java – Are Your Secrets Still Safe?

—

Java programmers might not be aware their secrets could be floating around in system memory long after it’s assumed those secrets have been removed. The problem is a combination of immutability and garbage collection in Java. Our most recent post explores the unpredictability of Java garbage collection and the implications that has for secrets in code. We developed a simple proof of concept designed to measured these “secret ghosts” and demonstrate how to avoid them.

LLMs in Applications – Understanding and Scoping Attack Surface

—

In this post we consider how to think about the attack surface of applications leveraging LLMs and how that impacts the scoping process when assessing those applications. We discuss why scoping matters, important points to consider when mapping out the LLM-associated attack surface, and conclude with architectural tips for developers implementing LLMs within their applications.