These are great. I used jadx to pull apart a conference attendee app I was supposed to install to see what it hoovered up. There is a level of reverse engineeri

These are great. I used jadx to pull apart a conference attendee app I was supposed to install to see what it hoovered up. There is a level of reverse engineering that people can just get comfortable with doing without ahcieving the virtuosity of the stuff people publish papers and get talks about. Simple things like, what SDKs does this thing use (adware), what external APIs does it call (trackers), what interfaces does it use (mic, gps, etc), what data does it hoover up (contacts, sms messages, etc), what parties does it send them to, how much effort do the authors go to obfuscate or hide what they are doing (packers, code obfuscators), does it use a static encryption key or derive one from predictable components, does it have hidden features from triggers and arguments - are all achievable for someone with a bit of interest and an afternoon. The more niche the app, the less sophisticated the protections on it, I find.