Threats and abuse
Code tampering, account abuse, data exposure and client manipulation.
What mobile reverse engineering can reveal
A distributed mobile package is an artifact an attacker can inspect. Code structure, endpoints and local business rules may be exposed.
Read the guideMobile application repackaging
Modifying an application and distributing it under another identity affects both user trust and technical integrity.
Read the guideMobile memory tampering and critical data
Data encrypted at rest may become accessible in memory during use. Assess secret lifetimes, copies and critical decisions that depend solely on a memory value.
Read the guideDynamic instrumentation and RASP testing
Observing a running application is a legitimate security-research technique.
Read the guideImpersonating a mobile API client
A request that resembles traffic from a mobile application is not inherently trustworthy. Verify application evidence, account authority and business data separately.
Read the guideReplay attacks against mobile transactions
A previously valid request can be submitted again for another operation. Protection must define where and how often evidence can be used, alongside its integrity.
Read the guideMobile session-token theft
A stolen access token can threaten an account regardless of whether the application is signed or protected.
Read the guideAccount takeover and application protection
Account risk does not arise only from modified devices. Phishing, weak recovery and server authorization defects require controls different from in-app protection.
Read the guideReal-device farms and mobile automation
Automation is not limited to emulators. Traffic generated through physical devices can abuse business rules while platform integrity looks healthy.
Read the guideOverlay-based fraud risk
An overlay can separate the target a user sees from the transaction they approve.
Read the guideRemote-access tools and mobile transaction security
Remote-assistance tools can support legitimate help or participate in fraud. Assess risk from the transaction and user context rather than tool presence alone.
Read the guideLocal code patching and business logic
Changing a client-side decision can affect any authority that depends on it.
Read the guideSecrets embedded in mobile applications
A publicly distributed application is not a secure vault for a shared secret.
Read the guideMan-in-the-middle risk in mobile applications
Correct TLS verification is the primary defense against network interception.
Read the guideWhy timing-based checks are fragile
Execution-time deviations can indicate interference, but limited hardware, load and system behavior can produce similar effects.
Read the guideRASP approaches to environment concealment
Indicators of a risky environment can be changed to hide from local checks.
Read the guideThird-party SDK supply-chain risk
A third-party SDK may process data and make connections with the application's privileges.
Read the guideSensitive-data disclosure in mobile logs
A token or personal detail written into an error record creates another copy of protected data. Logging policy must cover failure paths and third-party components.
Read the guideMobile data disclosure through the clipboard
Clipboard convenience moves data onto a sharing surface outside the application.
Read the guideScreen mirroring and sensitive information
Displaying sensitive information exposes a surface different from file access. Design and describe mirroring and recording controls within the platform's actual limits.
Read the guideThe risk of trusting the client clock
A mobile device's clock is not trusted server time. Expiring authority, evidence freshness and offline entitlements must not rely unconditionally on an adjustable…
Read the guideLocation spoofing and mobile risk decisions
Location is a contextual signal, not independent proof that a person is physically present. High-impact decisions require separate transaction and account controls.
Read the guideDevice identity and fingerprinting limitations
Mobile identifiers can reset, change or match incorrectly. Design enrollment, change and recovery lifecycles instead of assuming permanent, error-free device recognition.
Read the guideAbuse of RASP configuration
A channel that changes protection rules is a high-impact administration surface.
Read the guideInterpreting a RASP bypass finding
A bypass finding needs assessment in terms of business impact.
Read the guide