2026.09.03 14:20 ~ 15:00 Panda

Securing Android SDKs: A Defense-in-Depth

Security / Identity / Privacy English Interpretation available

Mobile SDKs ship inside apps that attackers can reverse-engineer. The moment your SDK is distributed, its logic, constants, and API keys are potentially readable by anyone with a decompiler. This isn't a theoretical risk, API key extraction, event injection, and bot-driven fraud are real problems that attribution and analytics SDKs face at scale. Standard good practices like HTTPS and code review are simply not enough. In this session, we will walk through a layered, defense-in-depth strategy for hardening an Android SDK against the most common attack vectors. Starting from code obfuscation to prevent internals from being trivially exposed, we will move up to request signing using HMAC-SHA256 with timestamps and nonces to make replayed or fabricated API calls impossible. We will then cover Android's Play Integrity API and how device attestation provides cryptographic proof that a request originates from a genuine, unmodified app on a real device. not a script hitting your backend directly. Finally, we will discuss the architectural shift away from static API keys towards short-lived, server-issued session tokens obtained through a device-attested handshake at SDK initialization, eliminating the risk of long-lived credential compromise entirely. Each layer will be illustrated with concrete implementation examples drawn from a real-world SDK. Attendees will leave with a practical threat model, reusable patterns, and a clear roadmap for applying the same defense-in-depth strategy to their own Android libraries.

Intended audience

Familiarity with Android, and some basics in security would be great.

Sessions in the same time slot

View all sessions