Schedule
DEF CON 34 ▾
Friday
Bypassing KYC Vendors on AI Times
In this talk, the Just Mobile Security team walks through KYC (Know Your Customer) implementations, how to bypass them, and some 0-days affecting KYC vendors.
AI Finds and Writes My Android Exploits Now
For years, Ken found and wrote the Android exploits that won multiple Pwn2Own competitions. This year he hasn't written a single one — AI does everything now, from reconnaissance to exploitation to bug bounty reports, thanks to the AI mobile testing tool Djini and its new "Deep Scan" feature. Ken demonstrates Deep Scan live, finding Pwn2Own-level exploits autonomously, and discusses some of the exploits it uncovered.
Offensive Security from Your Pocket
Smartphones are powerful — but so are the threats targeting them. This talk explores real-world mobile attack techniques through live demos: rogue Wi-Fi access points for data interception, Android app manipulation with Frida, and Kali NetHunter on rooted devices. It also covers hardware attacks like BadUSB cables, Bluetooth exploitation, and NFC relay threats, each paired with practical mitigation strategies.
Hacking Android Apps in a Structured Way
Mobile app testing has many pitfalls, and a structured approach is needed to see the full attack surface. This workshop gives a practical introduction to the OWASP Mobile Application Security (MAS) project — MASVS, MASWE, and MASTG — with hands-on static and dynamic analysis of real Android apps using tools like Frida, semgrep, APKLeaks, and jadx. Bring a laptop with 10 GB free disk space, a GitHub account, and git installed.
Mobile Security through Obscurity: From Insecure Client-Side Encryption to Unauthenticated SQL
The Just Mobile Security team explores mobile "security through obscurity" — from insecure client-side encryption to unauthenticated SQL injection — drawing on real cases from LATAM banks and fintechs that shipped these flaws in their applications.
Leveraging Frida to Bypass Mobile Application Security Controls
This talk introduces Frida — what it is, its capabilities, and how to leverage it during a penetration test. Walk through a real engagement using Frida to bypass an app's jailbreak detection on a jailbroken iPad, enumerate classes and methods to pinpoint security protections, and apply pre-built Frida CodeShare scripts to bypass those controls.
Saturday
RedMatter: Let AI Write Your Cross-Platform Mobile Exploits
Redmatter kills the rewrite. Describe an attack in plain language — "bypass the pinning, dump the keychain, defeat the root check" — and an AI layer generates platform-specific Frida instrumentation for both the iOS and Android builds of the same app. The harness orchestrates the run and adapts when the app fights back. Live demo against hardened targets with anti-Frida, pinning, and root detection stacked.
An Android Voyage from Java to Smali with ASM
Java is the backbone of almost all Android apps, yet its compilation process is often overlooked. Behind the scenes, a complex series of bytecode transformations takes place, and tools like ASM let anyone hook in to alter the flow for performance, obfuscation, or compile-time code injection. This talk explores how ASM works, how it can be used, and the deep pitfalls of Java bytecode manipulation.
Triage vs. Reality: Mobile Security Findings in Bug Bounty
Mobile bug bounty has matured, but the way mobile vulnerabilities are evaluated has not kept pace. This talk explores why mobile findings are uniquely hard to assess, the limitations of applying generic scoring systems like CVSS to mobile, and real-world examples where technical severity and triage outcomes diverged.
Hacking iOS Apps in a Structured Way
Mobile app testing has many pitfalls, and a structured approach is needed to see the full attack surface. This workshop gives a practical introduction to the OWASP Mobile Application Security (MAS) project — MASVS, MASWE, and MASTG — with hands-on static and dynamic analysis of real iOS apps on a non-jailbroken device, using tools like Frida, radare2, and AI-assisted reverse engineering. Bring a laptop with 10 GB free disk space, a GitHub account, and git installed.
Beerus Framework – A New Mobile Framework Arises
A year ago, Hakai Security introduced the Beerus Framework to unify mobile tooling and streamline penetration testing directly on Android devices. Now it's a robust platform for offensive mobile analysis with international recognition. This talk revisits Beerus in its current form — its evolution, consolidated capabilities, lessons from real-world scenarios, and the future vision for the project.
Creator Stage
IsMyPhonePwned: Analyzing Android/iOS Phones at Scale
Mobile devices are prime targets for sophisticated spyware and state-sponsored surveillance, yet validating a suspected compromise remains hard — traditional forensics is destructive and cost-prohibitive. This talk introduces IsMyPhonePwned, an open-source, non-destructive mobile forensic framework that scans for Indicators of Compromise directly from a web browser over USB. Built in Rust with WebAssembly, it enables client-side extraction, log parsing, and Sigma rule evaluation with no rooting, no installation, and no device downtime.
A Droidwork Orange: A Longitudinal Study of Android Security Research
Android has dominated mobile for over a decade, yet we lack an understanding of how Android security research has evolved. This first comprehensive longitudinal study presents Ludovico, a curated corpus of 11,691 Android security papers (2008–2025) plus 464 iOS papers and a survey of 86 researchers. It traces the field's rapid growth to a 2016–2018 peak and subsequent contraction — not because Android security is solved, but because the ecosystem has matured — and the structural shift from app privacy toward AI-driven malware detection.
Friday – Sunday
Mobile CTF
Capture the Flag events featuring mobile application security challenges at varying levels of difficulty, with a ranking system to evaluate and compare participants' skills.
DEF CON 33 ▾
Friday
Testing Environment Setup and Local Storage Enumeration
This session will walk you through setting up a mobile testing environment and extracting APKs from installed apps. You'll also explore how to locate and analyze sensitive data stored locally, including shared preferences, databases, and more.
Rooting the Rootless: Kernel Tactics to Nullify RASP Protections
Mobile apps today depend heavily on Runtime Application Self-Protection (RASP) to stay secure while running. But attackers are getting smarter. They're finding new ways to slip past these defenses by going deeper into the mobile operating system and targeting the kernel itself. This session explores how attackers manipulate mobile kernels to bypass modern RASP protections through live demos, covering kernel architecture, vulnerabilities, and memory manipulation techniques.
Matrioska: A User-Centric Defense Against Virtualization-Based Repackaging Malware on Android
The Android virtualization technique allows an app to create independent virtual environments running on top of the Android native one. While the technique has legitimate uses, attackers have identified ways to exploit it — researchers have found 71,303 malicious samples. This talk presents Matrioska, a new defense mechanism that achieves 99% accuracy in detecting virtualization-based repackaging attacks, outperforming state-of-the-art solutions.
Bypassing Security Mechanisms Using Application Patching and Code Instrumentation
This session will walk you through bypassing mobile app security protections like root detection and SSL pinning using tools like Frida and apktool. It covers both static patching and dynamic code instrumentation to help you manipulate app behavior for testing and analysis.
Saturday
Cracking the Vault: Runtime API Testing in MDM-Locked Apps
This workshop dives deep into bypassing typical MDM-imposed restrictions to perform dynamic runtime API testing on apps that rely heavily on MDM policies. Walk through the Appknox approach for injecting custom instrumentation and intercepting APIs in live environments — without root, jailbreak, or MDM tampering.
Hunting Advanced Mobile Vulnerabilities with AI
What if AI could perform autonomous vulnerability research? This talk demonstrates how AI agents, powered by LLMs and custom tooling, can analyze Android applications, uncover advanced vulnerabilities, and assist in exploit development. Starting with the open-source JADX MCP plugin for static analysis, discover how AI can reason about app structure and find real-world vulnerabilities.
Examining Access Control Vulnerabilities in GraphQL - A Feeld Case Study
Using the Feeld dating app as a case study, this talk dives into how the lack of access controls in GraphQL and REST endpoints led to exposure of users' personal data — including sensitive photos, videos, and private messages. Covering common access control vulnerabilities, real-world examples, and remediation strategies.
Traditional Pentest Meets AI: New Challenges in Android Security
This presentation explores the evolving landscape of Android application security testing as artificial intelligence becomes increasingly integrated into mobile devices. The talk bridges traditional penetration testing methodologies with emerging AI-specific security challenges, providing practitioners with updated frameworks and tools for comprehensive Android security assessments.
Friday – Sunday
Demonstration
A dedicated area equipped with the necessary tools, where visitors can experiment with various techniques and concepts under expert guidance.
Mobile CTF
Capture the Flag events featuring mobile application security challenges at varying levels of difficulty. This beginner-friendly contest includes challenges across: Dynamic Code Instrumentation, Reversing Native Code, Code Obfuscation/Deobfuscation, Exploiting App Components, Malware Analysis, Mobile Forensics, Bypassing Security Mechanisms, and Exploiting WebViews.