Secrets in Soft Token - A Security Study of HID Global Soft Token

Explore a security study of the Android version of HID Global Soft Token application in this 36-minute conference talk from Hack.lu 2016. Delve into the mechanisms used to protect key functional processes like generating encryption and OTP keys. Uncover two vulnerabilities affecting the application, including cryptographic weaknesses that could allow attackers to retrieve resources, clone configurations, and potentially discover a victim's PIN through brute force attacks. Follow along as security researcher Mouad Abouhali from Airbus Group Innovations breaks down the study objectives, methodology, and solutions, covering topics such as string analysis, Java reflection, code reading, and encryption tasks.

Introduction
Study Objectives
Security Mechanism
Methodology
Strings
Java Reflection
Reading the code
Encryption task
Solution