Software Testing Unleashed - QA, DevEx & Quality Engineering

From Nokia to iPhone: What Pen Testers Learned - Bartosz Czernic-Goławski

Listen Later
Why your smartphone knows more about you than you think it does

📌 EuroSTAR 2026 in Oslo (June 15–18) — the podcast will be there. Community perk: 15% off all tickets with the code EUROSTAR15 Details and tickets

"Attackers know what apps we are working with, we are using, and they take advantage of it." - Bartosz Czernic-Goławski

In this episode, I talk with Bartosz Czernic-Goławski, a penetration testing and cybersecurity expert, about how mobile security has evolved from Nokia's indestructible brick phones to today's pocket-sized computers. We trace the journey from analog networks that anyone could eavesdrop on to modern smartphones that demand excessive permissions and collect sensor data every second. Bartosz reveals how attackers use overlay attacks to steal banking credentials, why iOS users aren't as secure as they think, and what phone freaks in the 1980s can teach us about today's vulnerabilities.

Bartosz Czernic-Goławski is a non-functional tester with six years of professional experience, currently working at Pentacomp as a security auditor and penetration tester. He holds an Engineering degree in Telecommunications and a Master’s degree in Applied Computer Science with a specialization in Cybersecurity—both earned at the Warsaw University of Technology.

In his work, he focuses on the security testing of systems developed by Pentacomp, as well as conducting penetration tests and audits for external organizations. Commercially, he has tested mobile, web, and desktop applications, as well as IT and OT environments. He has had the opportunity to assess systems used daily by millions of people in Poland, as well as components of critical infrastructure.
He is also involved in delivering cybersecurity training, particularly related to secure working practices and compliance with requirements such as NIS2.

Highlights:

  • Modern smartphones are computers collecting sensor data constantly, blurring usability and surveillance boundaries.
  • Android's openness enables easier malware distribution; iOS restrictions provide better security by design.
  • Overlay attacks place fake login screens over real apps, stealing credentials from banking apps.
  • Old GSM networks still work but lack encryption, making conversations vulnerable to eavesdropping.
  • App permissions exploit user laziness—people accept everything without reading what they're granting.

    • More Links with Insights:

    • Tracking NSO Group's Pegasus Spyware
    • The EU's DMA Directive and "European iOS"
    • The Dark Side of Accessibility and Overlays on Android
    • Guardsquare Resource Library
    • Detecting Location Spoofing
      • ...more
      View all episodesView all episodes
      Download on the App Store
      Software Testing Unleashed - QA, DevEx & Quality EngineeringBy Richard Seidl | Software Development & Testing Expert