Mobile Application Security Assessment

What the engagement covers

iOS and Android assessment using static analysis, runtime instrumentation, and reverse engineering.

• Client-side storage

  Everything the application writes to the device, including databases, preferences, caches, and logs, assessed for credentials, tokens, and personal data recoverable from the filesystem or a backup.

• Transport security

  How the application protects data in transit, including certificate validation and pinning, and whether traffic can be intercepted or replayed once the client is under an attacker's control.

• Platform interoperability

  The surfaces the application exposes to the rest of the device — deep links, exported components, inter-process interfaces, and clipboard and screen handling — tested for access from an unprivileged application.

• Authentication and session handling

  Login, biometric gating, token storage, and session lifetime on the device, assessed for bypass and for reuse of a session outside the application.

• Code protection and tamper resistance

  Obfuscation, integrity checks, and root or jailbreak detection, assessed for what they actually prevent once the binary is analysed and instrumented.

• Supporting backend services

  The APIs the application depends on, tested directly, since a control enforced in the client is not a control once the client is modified.

What you receive

Written so findings can be assigned directly to the teams that will act on them.

• Findings report

  Every finding with its severity rating, the device state and steps required to reproduce it, and remediation guidance for the mobile and backend teams.

• Platform exposure summary

  The interfaces the application exposes on each platform, and what an unprivileged application on the same device can reach through them.

• Remediation priority list

  Findings ordered by what they expose and how readily an attacker reaches them, separating issues that need a client release from those that can be fixed server-side.

Frequently asked questions

Do you assess both iOS and Android?

Yes. Both platforms are assessed, and each is tested against its own build rather than one result being assumed to apply to the other. Where only one platform is in scope, that is agreed and recorded at scoping.

Do you need our source code to assess a mobile application?

No. The assessment can run against the compiled application alone, using decompilation and runtime instrumentation. Source access, where you can provide it, shortens analysis and allows the root cause of each finding to be stated precisely, so it is worth including when available.

Does certificate pinning mean our traffic cannot be intercepted?

Not on a device the attacker controls. Pinning raises the effort required, but it is implemented in the client, and a client running on a rooted or jailbroken device can be instrumented to remove the check. The assessment establishes what pinning prevents in practice, and tests the backend on the assumption that it can be bypassed.