Android App Hacking: Threat Modeling and Reverse Engineering Basics

Summary

Fabian outlines a beginner workflow for Android app security testing: assess the attacker’s position and reachable surface, learn app-development concepts, then compare a self-built app with its decompiled APK using Android Studio and Jadx.

Key points

Start by defining the attacker’s position and what the attacker can reach; consider whether the security boundary is reasonable for that threat model.
Assess app inputs and inter-app communication to understand how another app might trigger components or pass data.
Learn Android development concepts—including activities, broadcast receivers, and services—to better understand how apps are built and where logic may be exposed.
The presenter recommends building a simple app, compiling it, and comparing its source with the decompiled APK to learn reverse engineering.
Review the AndroidManifest for declared components and permissions that help reveal an app’s exposed surface; dynamically registered receivers and app-started servers are noted exceptions.
The demonstration uses Android Studio for app development and Jadx to decompile DEX code into Java for inspection.
Trace visible UI elements through layouts, resource IDs, and event handlers to understand the corresponding app logic.

Article Details

Topics: [02:19] Android threat modeling: attacker position, reachable surfaces, and reasonable security boundaries.
[07:01] Understanding app inputs and inter-app communication to identify what an attacker may be able to reach.
[08:08] Learning Android development concepts, including activities, broadcast receivers, and services.
[10:33] Using a build-and-compare approach to learn Android reverse engineering.
[11:18] Building a sample app in Android Studio and inspecting its compiled APK with Jadx.
[14:50] Reviewing the AndroidManifest for exposed components and permissions.
[16:42] Connecting layouts, resource IDs, and event handlers to app behavior in decompiled code.

People

FabianFabian, a security consultant who audits code and reports vulnerabilities, presents a beginner-oriented Android app security and reverse-engineering workflow.

Vendors

GoogleGoogle co-created Android application security courses with Hextree and sponsors the free courses; its mobile VRP is cited for Android threat-model categories and rewards.

Products

AndroidThe talk applies threat modeling, attack-surface review, and reverse engineering to Android applications, including manifest permissions and inter-app components.