Scribd
Upload
0 views2 pages

Mobile App Security Cheat Sheet

Uploaded by

Priyanshi Jain
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
0 views2 pages

Mobile App Security Cheat Sheet

Uploaded by

Priyanshi Jain
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 2

Mobile App Security & Threats - Cheat

Sheet
1. Decompiling & Debugging
• Decompiling = converting app back to human-readable form.

• Debugging = analyzing/modifying how an app behaves.

• Android is easier to decompile (Java-based). Tools: APKTool, Dex2Jar.

• iOS uses machine code—harder to reverse. Use Class-Dump, LLDB.

• Protection: ProGuard (Android), strip symbols (iOS), move logic to C++.

2. Jailbreak Detection
• Detects if device is compromised (Cydia, system mods).

• Can be bypassed by hiding Cydia or patching checks.

• Better detection: multi-layer checks, C++ logic, server-side validation.

3. Remote Wipe & Lock


• Used via MDM to erase or lock lost/stolen devices.

• Bypasses: Airplane mode, patched MDM apps.

• Better protection: let devices decide locally, secure the MDM app.

4. Mobile App Threats


• Web-Based: MiTB, code injection via Wi-Fi.

• Network-Based: Fake Wi-Fi or femtocells steal data.

• User Threat: Jailbreaking/rooting weakens protection.

• Physical Threat: Lost phones = data leaks.

• Other Stakeholders: App stores, firmware mods collect data.

5. Mobile App Assets


• Offline Data: Cached documents.

• Personal Data: Contacts, photos, messages.

• Sensor Data: Location, camera, mic.


• Identity Data: Logins, device IDs.

6. Threat Modeling Steps


• List assets.

• Identify threats.

• Rank risk (likelihood + impact).

• Apply protections.

• Use throughout development.

7. Secure App Development (Preparation)


• Start with threat modeling.

• Choose wisely: Native (secure), Web (flexible), Cross-platform (risky).

• Secure device/app: MDM, anti-debugging, obfuscation.

• Update often, change protection techniques.

8. Security Guidelines
• Use HTTPS (SSL/TLS), validate certificates.

• Avoid storing sensitive data.

• Use token-based authentication.

• Block copy-paste/screenshots for sensitive screens.

• Use WebView safely (limit JS).

• iOS: Use ASLR, protect stack memory.

You might also like