In this digital age, we live in a world of applications that enable us to conduct digital transactions ranging from everyday tasks to storage of sensitive data. But how secure are these applications?As the cybersecurity lead in the Singapore Government, GovTech seeks to secure government applications by proactively conducting security assessments. As the application landscape is wide and varied, we employ various techniques such as fuzzing, source code reviews and reverse engineering to discover new vulnerabilities.In this talk, we will take you through the Tactics, Techniques and Procedures (TTPs) used to find application backdoors that were put in place by developers, unbeknown to users, in two applications - a Windows-based thick client and an iOS application.