The AI Threat Multiplier: Securing Mobile Apps in the Automated Era - Ryan Lloyd, Jason Cortlund - ASW #400
Summary
In this episode of Application Security Weekly, host Mike Shima interviews Ryan Lloyd and Jason Cortland from Guardsquare to discuss how AI agents and LLMs are accelerating mobile app threats. The guests explain that while LLMs do not invent new attack techniques, they significantly scale and automate phishing, reverse engineering, and credential harvesting. They highlight the rise of hardcoded secrets in production code due to rapid AI-assisted development and the use of AI to bypass security controls.
Topics discussed
Introduction and Episode 400 Milestone
Guest Introductions: Ryan Lloyd and Jason
Mobile App Threat Model: Untrusted Devices
AI Impact on Attack Volume and Scale
AI-Enhanced Phishing and Fraud Profitability
High-Value Targets: Banking and Sports Betting
Democratization of Reverse Engineering Tools
Hardcoded Secrets and AI-Generated Code Risks
Extracting Secrets from Obfuscated Apps
LLM-Generated Malware and C2 Endpoints
Debunking Hype: Undetectable AI Malware
Defense Strategies: Architecture and Telemetry
API Attestation and Device Integrity Checks
Skill Augmentation vs. Noise in Attacks
Bug Bounty Noise and Vulnerability Trends
Open Source Components and Testing Needs
Prompt Injection and Mobile Threat Models
Mobile Top 10: Secure Communications
Future Threats: Deepfakes and KYC Bypass
API Layer Security and Shared Responsibility
AppSec in 3 Words: Misunderstood, Evolving, Empathy
Announcements and Closing Remarks
Listen ad-free on Castria