Chapter 70 — Mobile application security
In one sentence
Mobile security is client security under hostile physical possession: assume the attacker can inspect the app, intercept traffic, tamper with local storage, and instrument runtime behavior.
The mobile threat model
Different from web:
- the app binary is in the attacker's hands;
- local storage is inspectable on rooted/jailbroken or backed-up devices;
- TLS can be intercepted if the user/device trusts an attacker CA;
- API endpoints can be discovered by reversing the app;
- mobile apps often carry long-lived refresh tokens;
- platform permissions, deep links, intents, URL schemes, and app extensions add platform-specific attack surface.
What to review
| Area | Look for |
|---|---|
| Local storage | tokens/secrets in plaintext preferences, SQLite, logs, backups |
| Transport | TLS validation, pinning trade-offs, cleartext exceptions |
| Auth/session | refresh token rotation, device binding, logout/revocation |
| Platform IPC | Android intents/deeplinks, iOS URL schemes, exported components |
| WebViews | JavaScript bridges, mixed content, token exposure |
| Crypto | homegrown crypto, static keys in app, misuse of keystore/keychain |
| API design | missing object-level authorization because "the app hides the button" |
Real-world scenario: "the mobile app enforces it"
A banking app hides "increase transfer limit" unless the user has completed KYC. The backend endpoint still accepts:
POST /api/limits
{"dailyLimit": 50000}
The mobile app was the UI, not the control. An attacker proxies the app, repeats the request, and bypasses the client-side check. The fix is the same as web/API: authorization and business rules live server-side.
Practical tooling
- static inspection: JADX, apktool, MobSF, class-dump, Hopper/Ghidra;
- dynamic instrumentation: Frida, objection;
- traffic: mitmproxy/Burp with a test build or controlled device;
- platform references: OWASP MASVS/MASTG.
Common mistakes
- Shipping production API keys in the app and treating them as secret.
- Logging tokens or PII to mobile logs/crash reports.
- Trusting jailbreak/root detection as a hard control.
- Pinning certificates without an operational rotation/break-glass plan.
- Forgetting that every mobile security finding usually needs a backend impact question: "what can the attacker do against the API?"