Dinesh Shetty

Dinesh Shetty

United States
7K followers 500+ connections

Join to view profile
Security Innovation
Ramrao Adik Institute of Technology,University of Mumbai

About

As the Director of Security Engineering at Security Innovation, I provide managerial…

Activity

7K followers

See all activities

Experience

  • Security Innovation

  • -

    Boston, Massachusetts, United States

  • -

    Boston, MA

  • -

    Boston, MA

  • -

  • -

    Mumbai Area, India

  • -

  • -

Education

  • Ramrao Adik Institute of Technology,University of Mumbai

    -

    -

  • -

    -

  • -

Licenses & Certifications

  • OSWP - Offensive Security Wireless Professional Graphic

    OSWP - Offensive Security Wireless Professional

    Offensive Security

    Issued
  • OSCP - Offensive Security Certified Professional Graphic

    OSCP - Offensive Security Certified Professional

    Offensive Security

    Issued

  • Hands-On Hardware Hacking

    DakotaCon - Joe Grand

    Issued
  • Certified Hacking Forensic Investigator with score of 94% Graphic

    Certified Hacking Forensic Investigator with score of 94%

    EC-Council

    Issued
  • IBM Certified Specialist - Rational AppScan Standard Edition with score 100% Graphic

    IBM Certified Specialist - Rational AppScan Standard Edition with score 100%

    IBM

    Issued
  • Certified Ethical Hacker with score 98% Graphic

    Certified Ethical Hacker with score 98%

    EC-Council

    Issued
  • Certified Information Security Expert Graphic

    Certified Information Security Expert

    Innobuzz Knowledge Solutions Private Limited

    Issued

  • IPSolutions certified CCNA

    IPSolutions

    Issued

  • Advance Diploma in Software Engineering

    CMIT

  • Certified in RedHat Linux

    Aptech Computers

Join now to see all certifications

Publications

  • Demystifying IoT Attack Vectors

    Security Innovation Blog

    Blog post that explains the various attack vectors that can be used to compromise an IoT device. Also includes a IoT Tipsheet that can be used to secure your IoT devices.

    See publication

  • OWASP Mobile Risks 2014 vs. OWASP Mobile 2016 RC

    Security Innovation Blog

    In March of this year, OWASP released their 2016 edition of the Mobile Top Ten. Now that organizations have had some time to get acclimated to it, I wanted to provide some of my thoughts on it.

    See publication

  • QuadRooter: The 4-Headed Monster That Threatens 900 Million Android Users

    Security Innovation Blog

    A detailed account on QuadRooter - that is a collection of four exploits in Qualcomm's popular graphics and media chipset, which is in more than 900 million mobile devices globally.

    See publication

  • Jailbreaking your iPhone: Worth the Security Risk?

    Security Innovation Blog

    What are the Benefits and Risks Gained by Jailbreaking an iOS device.

    See publication

  • The Blessing and Curse of Apple Security

    Security Innovation Blog

    A lot has been written about whether Apple should comply with the recently publicized FBI demands surrounding the San Bernardino attack last year. However, I’m going to avoid the political side of the debate and focus on the technology instead via this article.

    See publication

  • Android vs. iOS: Security Comparison

    Palisade : Application Security Intelligence

    Smartphones are enjoying an ever-increasing popularity due to the technological advancement taking place on a day-to-day basis and have become a basic need for users, just as a desktop computer. In this article, we shall discuss some of the differences in the security aspects of Google’s Android and Apple’s iOS platforms.

    See publication

  • Demystifying The Android Malware

    Multiple International Security journals and magazines

    Earlier, cybercriminals around the world used to create programs that could create havoc on your network and steal important data. But, now with the immense growth of mobile technology every individual needs to not only worry about the device being stolen but also of malwares that effect their mobile device.
    In this paper, we are going to take you through the various phases so as to understand how and what these malwares are exactly made up of. First of all, we will start with discussing the…

    Earlier, cybercriminals around the world used to create programs that could create havoc on your network and steal important data. But, now with the immense growth of mobile technology every individual needs to not only worry about the device being stolen but also of malwares that effect their mobile device.
    In this paper, we are going to take you through the various phases so as to understand how and what these malwares are exactly made up of. First of all, we will start with discussing the background of Android and then move on to the basics of how an Android package architecture is developed.
    We shall then analyze an android malware in complete detail. In the end we will discuss on the steps to counter these kinds of malware attacks.

    See publication

  • Penetration Testing With Metasploit Framework

    Multiple International security journals and magazines

    Today security is just an illusion. However safe you think you are, you might just be wrong. Penetration testing of your web application helps you know the vulnerability in your application and you might as well try to find out solutions for it once you know the vulnerability. Metasploit is the leading tool used by penetration testers today which helps test your application security and save you from possible intruders and attacks.

    This paper tried to explain how Metasploit framework…

    Today security is just an illusion. However safe you think you are, you might just be wrong. Penetration testing of your web application helps you know the vulnerability in your application and you might as well try to find out solutions for it once you know the vulnerability. Metasploit is the leading tool used by penetration testers today which helps test your application security and save you from possible intruders and attacks.

    This paper tried to explain how Metasploit framework can be used by penetration testers to exploit flaws in the web application which could be really difficult to find if done manually.

    See publication

  • Route Optimized Ad-Hoc On-Demand Distance Vector Routing Protocol

    Multiple International security journals and magazines

    We suggest a novel approach to constrain route request broadcast which by means of route optimization using cache mechanism.
    The performance of AODV has been modified by using route optimizing technique and thus called Route Optimised AODV (RO-AODV). This protocol optimizes AODV to perform effectively in terms of routing overhead, power consumption and delay during high load.

    See publication

  • Social Engineering - The Human Factor

    Multiple International Journals and Magazines

    Earlier, cybercriminals around the world used to create programs that could create havoc on your network and steal important data and the Security Consultants would try and block every mode of access for these attackers.
    But, now with the immense growth of society, Merely trying to prevent infiltration on a technical level and ignoring the physical-social level, cent percent security can never be achieved. To ensure complete security of an organization from all kinds of internal and…

    Earlier, cybercriminals around the world used to create programs that could create havoc on your network and steal important data and the Security Consultants would try and block every mode of access for these attackers.
    But, now with the immense growth of society, Merely trying to prevent infiltration on a technical level and ignoring the physical-social level, cent percent security can never be achieved. To ensure complete security of an organization from all kinds of internal and external factors, the security consultant must have complete knowledge of the Social Engineering cycle, the techniques that can be used by an attacker and the counter-measures to reduce the likelihood of success of the attack.

    In this paper we are going to take you through the various phases so as to understand what is Social Engineering, Social Engineering Lifecycle, the various Techniques used in Social Engineering attack with detailed examples and then finally conclude with the counter-measures to protect against each of the Social Engineering attack techniques.

    See publication
Join now to see all publications

Projects

  • Detailed Guide to Hacking iOS Applications

    A comprehensive guide created to give hackers, developers and managers alike with an in-depth knowledge about the different kinds of iOS hacking tools and techniques. Explains manual as well as automated techniques of mobile application exploitation.

    See project

  • Android-InsecureBankv2

    -

    This is a major update to one of my previous projects - "InsecureBank". This vulnerable Android application is named "InsecureBankv2" and is made for security enthusiasts and developers to learn the Android insecurities by testing this vulnerable application. Its back-end server component is written in python. The client component i.e. the Android InsecureBank.apk can be downloaded along with the source. The list of vulnerabilities that are currently included in this release are:

    …

    This is a major update to one of my previous projects - "InsecureBank". This vulnerable Android application is named "InsecureBankv2" and is made for security enthusiasts and developers to learn the Android insecurities by testing this vulnerable application. Its back-end server component is written in python. The client component i.e. the Android InsecureBank.apk can be downloaded along with the source. The list of vulnerabilities that are currently included in this release are:

    Flawed Broadcast Receivers
    Intent Sniffing and Injection
    Weak Authorization mechanism
    Local Encryption issues
    Vulnerable Activity Components
    Root Detection and Bypass
    Insecure Content Provider access
    Insecure Webview implementation
    Weak Cryptography implementation
    Application Patching
    Sensitive Information in Memory
    Insecure Logging mechanism
    Android Pasteboard vulnerability
    Application Debuggable
    Android keyboard cache issues
    Android Backup vulnerability
    Runtime Manipulation
    Insecure SDCard storage
    Insecure HTTP connections
    Parameter Manipulation
    Hardcoded secrets
    Username Enumeration issue
    Developer Backdoors
    Weak change password implementation

    Below are some of the other vulnerabilities that I am working on currently - and will be added as soon as I make sure that it does not break any of the other existing features:

    Weak Pseudo Random Implementation
    Path Traversal
    Local SQL Injection
    Intent based Denial-Of-Service - SMS
    LockScreen Bypass
    Location Spoofing
    Dead Code

    See project

Honors & Awards

  • Invited as Trainer at Black Hat USA 2025, 2024, 2023, 2022, 2021, 2020 on Offensive Mobile Exploitation & Reversing

    Black Hat USA

    The class starts with a basic introduction to the ARM instruction set and calling conventions followed by some reverse engineering exercises. We then learn how to write simple exploits for the ARM64 environment. Next, we move to Mobile browser security, understand some of the browser mitigations followed by writing some simple exploits for the mobile browser. We then cover iOS and Android internals in further detail. We then discuss some of the exploitation techniques using real-world…

    The class starts with a basic introduction to the ARM instruction set and calling conventions followed by some reverse engineering exercises. We then learn how to write simple exploits for the ARM64 environment. Next, we move to Mobile browser security, understand some of the browser mitigations followed by writing some simple exploits for the mobile browser. We then cover iOS and Android internals in further detail. We then discuss some of the exploitation techniques using real-world vulnerabilities (e.g., voucher_swap, checkm8, etc) followed by a walkthrough of how jailbreaks are written. We also discuss some of the common vulnerability types (Heap Overflows, Use-after-free, Uninitialized Stack variable, Race conditions).

    The training then moves on to application security based on exploiting the Damn Vulnerable iOS app, Android-InsecureBankv2, and InsecurePass application written by the authors of this course in addition to a broad range of other real-world applications. We then cover a variety of mitigations deployed in real-world apps and discuss how to bypass them.

    After the training, attendees will:

    - Get an understanding of ARM64 instruction set (including ARM 8.3)
    - Understand the Browser Security mitigations on Mobile Devices
    - Understand some common vulnerabilities in Mobile Browsers and learn and how to exploit them
    - Learn the internals of iOS and Android Kernel along with several Kernel security mitigations
    - Understand some of the latest bugs and mitigations (PAC, CoreTrust, PPL, etc)
    - Get an intro to some common bug categories UaF, Heap overflow, etc
    - Understand how jailbreaks and exploits are written (including iOS 13)
    - Reverse engineer iOS and Android binaries (Apps and system binaries)
    - Do basic fuzz testing of iOS and Android apps
    - Learn how to audit iOS and Android apps for security vulnerabilities
    - Understand and bypass anti-debugging and obfuscation techniques
    - Get a quick walkthrough on using IDA Pro, Hopper, Frida, etc

  • Invited as Trainer at POC2019, on Offensive Mobile Exploitation & Reversing

    POC - Seoul, Korea

    This course is designed to introduce beginners as well as advanced security enthusiasts to
    the world of mobile security using a fast-paced learning approach through intensive
    hands-on labs. The class starts with a basic introduction to the ARM instruction set and an
    intro to reverse engineering before moving on to the internals of iOS and Android. We then
    discuss some of the latest exploitation techniques using real-world bugs (e.g.,
    voucher_swap for iOS 12) followed by a…

    This course is designed to introduce beginners as well as advanced security enthusiasts to
    the world of mobile security using a fast-paced learning approach through intensive
    hands-on labs. The class starts with a basic introduction to the ARM instruction set and an
    intro to reverse engineering before moving on to the internals of iOS and Android. We then
    discuss some of the latest exploitation techniques using real-world bugs (e.g.,
    voucher_swap for iOS 12) followed by a walkthrough of how jailbreaks are written. We
    also discuss some of the common vulnerability types (Heap Overflows, Use-after-free,
    Uninitialized Stack variable, Race conditions).

    The training then moves on to application security and is based on exploiting Damn
    Vulnerable iOS app, Android-InsecureBankv2, InsecurePass written by the authors of this course and a
    broad range of other real-world applications. Slides and detailed documentation on the
    labs will be provided to the students for practice after the class.
    After the training, the attendees will:
    - Get an understanding of ARM64 instruction set (including ARM 8.3)
    - Learn the fundamentals of iOS IPC (XPC, Mach)
    - Get an intro to some common bug categories UaF, Heap overflow, etc
    - Understand how jailbreaks and exploits are written (including iOS 12)
    - Reverse engineer iOS and Android binaries (Apps and system binaries)
    - Be able to audit iOS and Android apps for security vulnerabilities
    - Understand some of the latest bugs and mitigations (PAC, CoreTrust, Code Signing)
    - Understand and bypass anti-debugging and obfuscation techniques
    - Get a quick walkthrough on using IDA Pro, Hopper, Frida, etc

  • Invited as Trainer at Black Hat USA 2019, on Offensive Mobile Exploitation & Reversing

    Black Hat USA 2019

    Sold out class that was designed to introduce beginners as well as advanced security enthusiasts to the world of mobile security using a fast-paced learning approach through intensive hands-on labs. The class started with a basic introduction to the ARM instruction set and an intro to reverse engineering before moving on to the internals of iOS and Android. We then discussed some of the latest exploitation techniques using real-world bugs (e.g., voucher_swap for iOS 12) followed by a…

    Sold out class that was designed to introduce beginners as well as advanced security enthusiasts to the world of mobile security using a fast-paced learning approach through intensive hands-on labs. The class started with a basic introduction to the ARM instruction set and an intro to reverse engineering before moving on to the internals of iOS and Android. We then discussed some of the latest exploitation techniques using real-world bugs (e.g., voucher_swap for iOS 12) followed by a walkthrough of how jailbreaks are written. We also discussed some of the common vulnerability types (Heap Overflows, Use-after-free, Uninitialized Stack variable, Race conditions).

    The training then moved on to application security and is based on exploiting Damn Vulnerable iOS app, Android-InsecureBankv2, Android-InsecurePass written by the authors of this course and a broad range of other real-world applications.

  • Invited as Trainer at Black Hat USA 2018, on Offensive Mobile Exploitation & Reversing

    Black Hat USA 2018

    Sold-out class on the latest Android and iOS exploitation techniques. Updated course with hands-on for all of the iOS and Android vulnerabilities and attacks.

  • Invited as Trainer at FS-ISAC 2018 Annual Summit - Florida, on Introduction to Cyber Ranges

    FS-ISAC 2018 Annual Summit

    Ran an application security cyber range training to enable developers and security professionals in the financial services industry to stop hackers in their tracks by building more secure code.

    Training was conducting using Security Innovation's CMD+CTRL Cyber Range. CMD+CTRL comprises real websites, traffic, technologies, and vulnerabilities that represent actual application behavior. This unmatched realism brings the immediate gratification and long-term memory benefits of “learning…

    Ran an application security cyber range training to enable developers and security professionals in the financial services industry to stop hackers in their tracks by building more secure code.

    Training was conducting using Security Innovation's CMD+CTRL Cyber Range. CMD+CTRL comprises real websites, traffic, technologies, and vulnerabilities that represent actual application behavior. This unmatched realism brings the immediate gratification and long-term memory benefits of “learning by doing" teams need to protect the enterprise.

  • Invited as Trainer at Hackfest Canada 2017, on Mobile Application Exploitation

    HackFest

    A 3 day handson class teaching manual as well as automated techniques for exploiting Mobile Applications. Covers testing on Jailbroken/Rooted as well as on non-Jailbroken devices.

  • Invited as Trainer at Black Hat USA 2017, on Offensive Mobile Application Exploitation

    Black Hat USA 2017

  • Invited as Trainer at Def Con USA 2017, on Practical BLE Exploitation for Internet of Things

    Def Con 25

    The Practical BLE Exploitation for Internet of Things is a new training class focusing on exploiting the numerous IoT devices using BLE as the medium.

    Bluetooth Low Energy (or BLE) is found in most of the popular IoT and smart devices - be it smart home automation, retail, medical devices and more. This class will go through the internals of BLE from a security perspective, and then jump right into how you could interact with BLE devices all the way to taking control over a complete IoT…

    The Practical BLE Exploitation for Internet of Things is a new training class focusing on exploiting the numerous IoT devices using BLE as the medium.

    Bluetooth Low Energy (or BLE) is found in most of the popular IoT and smart devices - be it smart home automation, retail, medical devices and more. This class will go through the internals of BLE from a security perspective, and then jump right into how you could interact with BLE devices all the way to taking control over a complete IoT devices using BLE exploitation techniques.

    At the end, we will also look at some of the automation tools and scripts you can use/write in order to make the process much faster - as it's required in a pentest.

  • Invited as Trainer at OWASP AppsecEU2017 - Belfast, on Hands-on Mobile Application Exploitation

    OWASP AppsecEU2017

    After a sold-out class in OWASP Appsec USA 2016, we are bringing an updated version of the course with the latest tools & techniques. Hands-on for all of the iOS and Android vulnerabilities and attacks - on the latest Mobile operating systems.

  • Invited as Trainer at BloomCON USA 2017, on Offensive Android Application Exploitation

    BloomCON

    An introductory course on how to start attacking Android applications. Includes Threat Modeling, Static Analysis, Dynamic Analysis and Reverse Engineering of real world Android applications.

  • Invited as Trainer at OWASP AppSecUSA 2016, on Mobile Application Exploitation - iOS and Android

    OWASP

    This will be an introductory course on exploiting iOS and Android applications. The training will be based on exploiting Damn Vulnerable iOS app, Android-InsecureBankv2 and other vulnerable applications that are written by the trainers in order to give an in-depth knowledge about the different kinds of vulnerabilities in an Mobile applications. This course will also discuss how an attacker can compromise a mobile application. After the workshop, the students will be able to successfully pentest…

    This will be an introductory course on exploiting iOS and Android applications. The training will be based on exploiting Damn Vulnerable iOS app, Android-InsecureBankv2 and other vulnerable applications that are written by the trainers in order to give an in-depth knowledge about the different kinds of vulnerabilities in an Mobile applications. This course will also discuss how an attacker can compromise a mobile application. After the workshop, the students will be able to successfully pentest and secure applications running on the various operating systems.

    The training will also include a CTF challenge in the end where the attendees will use their skills learnt in the training to solve the CTF challenges.

  • Invited as Speaker at Demo Labs - Defcon USA 2016, on Android Exploitation using InsecureBankv2

    Demo Labs - Defcon USA 2016

    Learn Exploiting Android applications using InsecureBankv2.

  • Invited as Trainer at Defcon USA 2016, on Practical Android Application Exploitation

    Defcon USA 2016

    This will be an detailed course with extensive hands-on on exploiting Android applications. The training will be based on exploiting Android-InsecureBankv2 and other vulnerable applications that are written by the trainer in order to give an in-depth knowledge about the different kinds of vulnerabilities in an Android applications. This course will also discuss how an attacker can compromise a mobile application. After the workshop, the students will be able to successfully pentest and secure…

    This will be an detailed course with extensive hands-on on exploiting Android applications. The training will be based on exploiting Android-InsecureBankv2 and other vulnerable applications that are written by the trainer in order to give an in-depth knowledge about the different kinds of vulnerabilities in an Android applications. This course will also discuss how an attacker can compromise a mobile application. After the workshop, the students will be able to successfully pentest and secure applications running on the various operating systems.

    The training will also include a CTF challenge in the end where the attendees will use their skills learnt in the training to solve the CTF challenges.

  • Invited as Speaker at Arsenal - Black Hat USA 2016, on Android Exploitation using InsecureBankv2

    Black Hat USA 2016 - Arsenal

    Learn Exploiting Android applications using InsecureBankv2.

  • Invited as Trainer at Black Hat USA 2016, on Offensive Hands-on Internet of Things (IoT) Exploitation

    Black Hat USA 2016

    The training will cover different varieties of IoT devices, assessing their attack surfaces and writing exploits for them. The 2-day class will be hands-on giving attendees the ability to try things themselves rather than just watching the slides. We will start from the very beginning discussing about the architecture of IoT devices, and then slowly moving to firmware analysis, identifying attack surface, finding vulnerabilities and then finally exploiting the vulnerabilities

  • Invited as Speaker at BruCON - Belgium on PenTest for Mobile Applications!

    Mobile Application Exploitation (iOS and Android)

    This will be an comprehensive course on exploiting iOS and Android applications. The training will be based on exploiting Damn Vulnerable iOS app, Android-InsecureBankv2 and other vulnerable applications that are written by the trainers in order to give an in-depth knowledge about the different kinds of vulnerabilities in an Mobile applications. This course will also discuss how an attacker can compromise a mobile application. After the workshop, the students will be able to successfully…

    This will be an comprehensive course on exploiting iOS and Android applications. The training will be based on exploiting Damn Vulnerable iOS app, Android-InsecureBankv2 and other vulnerable applications that are written by the trainers in order to give an in-depth knowledge about the different kinds of vulnerabilities in an Mobile applications. This course will also discuss how an attacker can compromise a mobile application. After the workshop, the students will be able to successfully pentest and secure applications running on the various operating systems.

    The training will also include a CTF challenge in the end where the attendees will use their skills learnt in the training to solve the CTF challenges.

  • Acknowledged by United Airlines Security Bug Bounty Program

    United Airlines

    Received 1 Million Miles for submitting critical security bug in one of the United Airlines services.

  • Invited as Speaker at Black Hat EU 2015 - Amsterdam, on Android - InsecureBankv2

    Black Hat

    Watch as Dinesh walks you through his new and shiny updated custom application - "Android-InsecureBank" and some other source code review tools, to help you understand some known and some not so known Android Security bugs and ways to exploit them.

    This presentation will cover Mobile Application Security attacks that will get n00bs as well as 31337 attendees started on the path of Mobile Application Penetration testing.

  • Invited as Speaker at SECoT 2015 - Boston, on Hacking IoT devices

    The Security of Things Forum

    This was a full day hands-on workshop on Hacking Internet Connected Devices (IoT) and CMD+CTRL which is a capture the flag contest to teach offensive security. In addition to presenting a variety of vulnerable web applications, a specialized hardware hacking module was debuted. It is a series of embedded hardware devices where players can score points by dumping firmware from common microcontrollers and routers, using a logic analyzer to decode unknown protocols, and a variety of other hardware…

    This was a full day hands-on workshop on Hacking Internet Connected Devices (IoT) and CMD+CTRL which is a capture the flag contest to teach offensive security. In addition to presenting a variety of vulnerable web applications, a specialized hardware hacking module was debuted. It is a series of embedded hardware devices where players can score points by dumping firmware from common microcontrollers and routers, using a logic analyzer to decode unknown protocols, and a variety of other hardware level attacks.

  • Invited as Speaker at ISSA - Northeastern University, on Practical Android Application Security

    ISSA - Northeastern University

    Even wondered how different pentesting a Mobile application would be, from a traditional web application? Gone are the days when knowledge of just SQL Injection or XSS could help you land a lucrative high-paying infoSec job. Watch as Dinesh walks you through custom created demo applications and source code review tools, to help you understand some known and some not so known Android Security bugs. This presentation will cover Mobile Application Security ninja tricks that will get n00bs as well…

    Even wondered how different pentesting a Mobile application would be, from a traditional web application? Gone are the days when knowledge of just SQL Injection or XSS could help you land a lucrative high-paying infoSec job. Watch as Dinesh walks you through custom created demo applications and source code review tools, to help you understand some known and some not so known Android Security bugs. This presentation will cover Mobile Application Security ninja tricks that will get n00bs as well as 31337 attendees to get started on the path of Mobile Application Penetration testing. Expect to see a lot of demos, tools and of-course fun.

  • Invited as Speaker at BSMCon - Boston on PenTest for Mobile Applications!

    BSMCon #3

    Expect to see a lot of demos, tools, hacking and a lot of fun.

    The presentation focuses on problems of following bad Mobile development practice. During this session, you will learn how to perform a Code Assisted Pentest on Mobile applications and uncover some well-known and some other not so well known security issues. It is far easy to gain a practical knowledge of security vulnerabilities than it is to read about them.
    We will use a custom created demo application in addition to…

    Expect to see a lot of demos, tools, hacking and a lot of fun.

    The presentation focuses on problems of following bad Mobile development practice. During this session, you will learn how to perform a Code Assisted Pentest on Mobile applications and uncover some well-known and some other not so well known security issues. It is far easy to gain a practical knowledge of security vulnerabilities than it is to read about them.
    We will use a custom created demo application in addition to some other open source mobile applications, to catch security flaws noted in the various hand-held devices.

  • Invited as Speaker at OWASP - Boston AppSec Conference on Code Assisted PenTest for Mobile Applications

    OWASP BASC 2014 - Boston

    The presentation focuses on problems of following bad Mobile development practice. During this session, you will learn how to perform a Code Assisted PenTest on Mobile applications and uncover some well-known and some other not so well known security issues. It is far easy to gain a practical knowledge of security vulnerabilities than it is to read about them.

    Watch as Dinesh walks you through custom created demo applications and source code review tools, to catch security flaws noted in…

    The presentation focuses on problems of following bad Mobile development practice. During this session, you will learn how to perform a Code Assisted PenTest on Mobile applications and uncover some well-known and some other not so well known security issues. It is far easy to gain a practical knowledge of security vulnerabilities than it is to read about them.

    Watch as Dinesh walks you through custom created demo applications and source code review tools, to catch security flaws noted in the various hand-held devices. Expect to see a lot of demos, tools, hacking and a lot of fun.

  • Part of Adobe Hall of Fame

    Adobe Software and Products

    Added to Adobe Hall of Fame for finding multiple critical security vulnerabilities in their product.

  • Invited as Trainer at ClubHack 2012 - India, on Securing Mobile applications – Exploits Demystified and Solutions Simplified

    ClubHack

    Title: Securing Mobile applications – Exploits Demystified and Solutions Simplified

    A detailed workshop covering but not restricted to below concepts:
     Threat Modeling
     Understanding Security Vulnerabilities in Mobile Applications
     Detecting Security Vulnerabilities - Introduction to Mobile Security Code Reviews
     Scope for Automation in Mobile Security Code Reviews
     Designing Secure Mobile Applications

    Attendee Takeaways and Key Learning Objectives
     An…

    Title: Securing Mobile applications – Exploits Demystified and Solutions Simplified

    A detailed workshop covering but not restricted to below concepts:
     Threat Modeling
     Understanding Security Vulnerabilities in Mobile Applications
     Detecting Security Vulnerabilities - Introduction to Mobile Security Code Reviews
     Scope for Automation in Mobile Security Code Reviews
     Designing Secure Mobile Applications

    Attendee Takeaways and Key Learning Objectives
     An overview of Android and iOS Technology
     Threat Profile of Android and iOS
     Vulnerability Checklist for Android and iOS
     Code review approach
     Custom Script to Automate Android and iOS source code reviews
     Custom Vulnerable Bank Application
     Solutions repository
     Reference Materials

  • Part of Barracuda Networks Hall of Fame

    Barracuda Networks

    Added to Barracuda Networks Hall of Fame for finding multiple critical security vulnerabilities in their websites and web services as a part of Barracuda Networks Security Bug Bounty Program.

  • Part of Apple Hall of Fame

    Apple Inc.

    Acknowledged by Apple for finding critical security vulnerabilities in their products.

  • Invited as Speaker at OWASP AppSecAsiaPac2012 - Sydney on Advanced Mobile Application Code Review Techniques

    OWASP AppSecAsiaPac2012 - Sydney

    Learn how Mobile experts blend their techniques in order to accelerate code reviews. While reviewing Android or iOS applications, you will love these handy tricks that help in detecting famous and a few not-so-famous flaws.

    Using demonstrations and code snippets, we will highlight the benefits of blended techniques in comparison with those of simple scanning or manual testing. You will also learn how to reduce the time taken for review and obtain a ready-to-use checklist.

  • Invited as Trainer at OWASP AppSecAsiaPac2012 - Sydney, on Mobile Applications & Security

    OWASP AppSecAsiaPac2012 - Sydney

    This course covers security tests that are conducted on mobile applications with a focus on iOS and Android platforms.

    Students will first learn the basics of mobile applications followed by a brief background of iOS and Android platforms, their security models and an overview of their development basics.

    They will then learn how to model a threat profile for mobile applications and then test and debug the mobile applications for security vulnerabilities.

    Reading locally…

    This course covers security tests that are conducted on mobile applications with a focus on iOS and Android platforms.

    Students will first learn the basics of mobile applications followed by a brief background of iOS and Android platforms, their security models and an overview of their development basics.

    They will then learn how to model a threat profile for mobile applications and then test and debug the mobile applications for security vulnerabilities.

    Reading locally stored data in mobiles, setting up a proxy to intercept and test network traffic and reversing Android applications will be a few of the topics discussed. We will also discuss the challenges involved in reversing an iOS application. The course includes examples for both the platforms and sample code snippets will also be provided.

    We will also discuss the best practices that have to be followed for secure development of mobile applications. The course would end with a discussion of the OWASP Mobile Top 10 risks.

  • Invited as Speaker at National Institute of Bank Management on Operating System Security

    National Institute of Bank Management

    The purpose of this presentation was to give an overview of:
    a) the need for a secure operating system and
    b) the high-level design of a secure operating system that can be built and evaluated to the highest assurance levels.
    c) discuss the various testcases and audit tests that should be performed so as to validate the security of the deployed architecture.

Recommendations received

3 people have recommended Dinesh

Join now to view

View Dinesh’s full profile

  • See who you know in common
  • Get introduced
  • Contact Dinesh directly
Join to view full profile

Other similar profiles

Explore more posts

Explore top content on LinkedIn

Find curated posts and insights for relevant topics all in one place.

View top content

Add new skills with these courses

See all courses