Mobile Application Security
What this domain tests
Mobile Application Security tests Android and iOS client weaknesses and the server-side assumptions behind them. Expect MASVS-style areas: storage, cryptography, transport, authentication, platform interaction, and resilience.
Core rules
- Do not store secrets in SharedPreferences, NSUserDefaults, plists, or world-readable files. Use Android Keystore or iOS Keychain for key material, and assume the device is untrusted.
- Transport security means TLS with proper validation; certificate pinning raises the bar but is bypassable on a compromised device. Cleartext traffic and weak App Transport Security exceptions are findings.
- Exported activities, services, broadcast receivers, URL schemes, and deep links are entry points. Validate caller identity and sanitize every parameter.
- WebViews need JavaScript disabled unless required, no unsafe JavaScript bridges, and allowlisted URLs.
- Root or jailbreak detection is a detection signal, not an authorization control. The server must enforce entitlements.
Worked example
Decompile an APK with jadx and find a static API key in BuildConfig. Use it against the staging API and confirm it returns data beyond the app's normal user scope. The reasoning: the key is extractable because it ships in the client, and obfuscation only slows analysis. The real fix is to remove the secret, issue short-lived user-bound tokens, and enforce scope server-side. Rotate the exposed key and search build logs and repositories for copies.
Traps
- Treating a pinning bypass as only a client bug when the API also trusts the client.
- Ignoring exported components because the app has no launcher icon.
- Assuming biometrics authenticate the server.
- Missing secrets in logs, backups, and crash reports.