From Nokia to iPhone: What Pen Testers Learned - Bartosz Czernic-Goławski

🚨 Are we actually testing too much sometimes? Just because we run a lot of tests doesn’t mean we’ll find a lot of bugs. Here’s how we can solve this: Free Online Workshop

"Attackers know what apps we are working with, we are using, and they take advantage of it." - Bartosz Czernic-Goławski

In this episode, I talk with Bartosz Czernic-Goławski, a penetration testing and cybersecurity expert, about how mobile security has evolved from Nokia's indestructible brick phones to today's pocket-sized computers. We trace the journey from analog networks that anyone could eavesdrop on to modern smartphones that demand excessive permissions and collect sensor data every second. Bartosz reveals how attackers use overlay attacks to steal banking credentials, why iOS users aren't as secure as they think, and what phone freaks in the 1980s can teach us about today's vulnerabilities.

Bartosz Czernic-Goławski is a non-functional tester with six years of professional experience, currently working at Pentacomp as a security auditor and penetration tester. He holds an Engineering degree in Telecommunications and a Master’s degree in Applied Computer Science with a specialization in Cybersecurity—both earned at the Warsaw University of Technology. In his work, he focuses on the security testing of systems developed by Pentacomp, as well as conducting penetration tests and audits for external organizations. Commercially, he has tested mobile, web, and desktop applications, as well as IT and OT environments. He has had the opportunity to assess systems used daily by millions of people in Poland, as well as components of critical infrastructure. He is also involved in delivering cybersecurity training, particularly related to secure working practices and compliance with requirements such as NIS2.

Highlights:

• Modern smartphones are computers collecting sensor data constantly, blurring usability and surveillance boundaries.
• Android's openness enables easier malware distribution; iOS restrictions provide better security by design.
• Overlay attacks place fake login screens over real apps, stealing credentials from banking apps.
• Old GSM networks still work but lack encryption, making conversations vulnerable to eavesdropping.
• App permissions exploit user laziness—people accept everything without reading what they're granting.

More Links with Insights:

• Tracking NSO Group's Pegasus Spyware
• The EU's DMA Directive and "European iOS"
• The Dark Side of Accessibility and Overlays on Android
• Guardsquare Resource Library
• Detecting Location Spoofing