Android and iOS

Mobile memory tampering and critical data

Code tampering, account abuse, data exposure and client manipulation.

Threats and abuse1 min readEditorial methods

Data encrypted at rest may become accessible in memory during use. Assess secret lifetimes, copies and critical decisions that depend solely on a memory value.

Evaluation approach

Runtime protection can produce interference signals. Retain business authority on the server and reduce the time sensitive data remains in memory.

Application example

Changing a displayed balance must not permit spending independently of server records. Also match the amount shown with the amount processed.

Limits and considerations

A claim of memory encryption does not prove that processed data is inaccessible at every moment.

Storage security and data in use

Encryption on disk does not explain how data is handled in memory. Keep sensitive values short-lived and narrowly scoped where possible. Do not promise absolute secrecy when the threat model places the client process under attacker control.

Revalidate business decisions such as authority and amount on the server. RASP may detect interference, but final transaction acceptance must depend on independent server rules. Test which outcome a particular data change can influence.

Checks and decisions

  • Keep authority on the server
  • Minimize temporary data
  • Verify transaction fields

Protect local data while maintaining business rules independently of that protection.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.