All articles
Security EngineeringApplication Security
Browse Knowledge Base

Mobile Application Security - iOS & Android MASVS

7 min read

Master mobile security: iOS/Android MASVS, secure storage, transport security, anti-tamper controls, and mobile DevSecOps practices.

Mobile applications operate on user-controlled devices that must be treated as hostile environments, requiring security architectures that assume device compromise per threat modeling. Security engineers minimize secrets stored on devices, implement server-side enforcement of security controls, and design graceful degradation when client-side protections are bypassed.

Mobile devices operate in hostile environments—assume attackers have full control and can inspect, modify, and replay all client-side code and data. Server-side enforcement is essential.

Effective mobile security balances user experience with security controls, recognizing that determined attackers can bypass client-side protections through defense in depth. Mobile devices face unique threats including jailbreaking, rooting, malware, and physical theft per advanced threat detection.

Platform Security Fundamentals

Secure Credential Storage

iOS Keychain provides encrypted storage for credentials with hardware-backed encryption on devices with Secure Enclave per hardware security. Keychain items should be marked as accessible only when device is unlocked.

Android Keystore provides hardware-backed key storage on devices with Trusted Execution Environment or Secure Element. Keystore keys cannot be extracted from hardware.

Hardware-backed storage should be used when available, with software fallback for older devices per secrets management. Hardware backing provides strong protection against extraction.

Biometric authentication should protect Keychain and Keystore access for high-value operations. Biometrics provide user-friendly authentication.

Transport Security

App Transport Security (ATS) on iOS enforces TLS 1.2+ with forward secrecy by default per transport security. ATS exceptions should be minimised and justified.

Network Security Configuration on Android enforces TLS requirements and certificate pinning. Configuration should be declared in XML.

Certificate pinning validates that server certificates match expected certificates or public keys per transport security. Pinning prevents man-in-the-middle attacks from compromised CAs.

Pin rotation strategies should enable certificate updates without app updates through key management. Backup pins and pin expiration enable graceful rotation.

Jailbreak and Root Detection

Jailbreak and root detection provides weak signal of compromised device but should never be security boundary per defense in depth. Detection can be bypassed by determined attackers.

Detection results should inform risk-based decisions including additional authentication or reduced functionality through risk assessment. Detection should not prevent app from functioning.

Server-side risk scoring should incorporate device integrity signals with other risk factors through zero trust. Client-reported signals cannot be trusted.

Data at Rest Security

Minimize On-Device Secrets

High-value secrets including API keys and encryption keys should not be stored on devices per secrets management. Server-side secrets should be accessed through authenticated APIs.

Short-lived tokens with narrow scope should be used instead of long-lived credentials through session management. Token expiration limits impact of token theft.

Refresh tokens enable long-lived sessions without storing long-lived credentials. Refresh tokens should be rotated regularly per API security.

Application Data Encryption

Application data should be encrypted using platform APIs including iOS Data Protection and Android File-Based Encryption. Platform encryption is transparent to applications.

Sensitive data should be marked with appropriate protection class per data classification. iOS protection classes control when data is accessible.

Custom encryption should use platform cryptographic APIs rather than custom implementations per cryptographic hashes. Custom crypto implementations are error-prone.

Backup Protection

Sensitive data should be excluded from backups using no-backup flags through data classification. Backups may be stored in less secure locations.

Backup encryption should be verified per key management. Unencrypted backups expose sensitive data.

Data wipe on device compromise signals including multiple failed authentication attempts provides defense-in-depth. Wipe should be user-configurable.

Authentication and Session Management

OAuth and System Browsers

OAuth flows should use system browsers including ASWebAuthenticationSession on iOS and Custom Tabs on Android per API security best practices. System browsers provide better security than embedded webviews.

Embedded webviews enable phishing and credential theft through social engineering. Webviews should be avoided for authentication.

PKCE (Proof Key for Code Exchange) protects authorisation code flow for public clients. PKCE prevents authorisation code interception.

Token Management

Access tokens should have short lifetime (minutes to hours) per API security. Short lifetime limits impact of token theft.

Refresh tokens should be rotated on each use through secrets management. Rotation enables detection of token theft.

Token binding to device using device fingerprints or hardware-backed keys prevents token replay on different devices through zero trust. Binding should be transparent to users.

Replay Protection

Nonce values prevent replay of authentication requests per secure coding. Nonces should be single-use and time-limited.

One-time codes for high-value operations prevent replay. Codes should expire quickly.

Anti-CSRF tokens protect webview-based flows per OWASP Top 10. CSRF protection should be server-enforced.

Code and Runtime Hardening

Obfuscation Limitations

Code obfuscation increases reverse engineering cost but does not prevent it per threat modeling. Obfuscation should not be relied upon as security control.

Server-side validation should enforce all security policies through API security. Client-side checks can be bypassed.

Security through obscurity is not security per defense in depth. Assume that attackers can reverse engineer all client code.

Runtime Integrity

Runtime integrity checks detect tampering and debugging through advanced threat detection. Checks should degrade gracefully rather than crash.

Signed builds with code signing certificates prove app authenticity per supply chain security. Signature verification should be platform-enforced.

Secure supply chain practices including dependency scanning and build provenance prevent supply chain attacks through software composition analysis.

Dynamic Code Loading

Dynamic code loading including JavaScript bridges and plugin systems increases attack surface. Dynamic loading should be minimised.

Code signature verification should apply to all loaded code per supply chain security. Unsigned code should be rejected.

Deep link handlers should validate all inputs and implement authorisation checks through secure coding. Deep links are common attack vector.

OWASP MASVS and Security Testing

Mobile Application Security Verification Standard

OWASP MASVS provides comprehensive mobile security requirements across three levels per security frameworks. Level 1 provides baseline security for all apps.

MASVS categories include architecture, data storage, cryptography, authentication, network communication, platform interaction, code quality, and resilience per application security testing.

MASVS adoption should be risk-based with higher levels for apps handling sensitive data through risk assessment. Requirements should be incorporated into development standards.

Mobile Security Testing Guide

MASTG (Mobile Security Testing Guide) provides testing procedures for MASVS requirements. Testing should be automated where possible through security testing automation.

Static analysis tools including MobSF detect common vulnerabilities in source code and compiled binaries through application security testing. Static analysis should run in CI/CD pipelines.

Dynamic analysis using Frida scripts enables runtime testing and instrumentation. Dynamic analysis should test authentication, authorisation, and data protection per security testing.

API Security Testing

Mobile API endpoints should be tested for abuse including authentication bypass, authorisation flaws, and rate limiting. Mobile channels should not be trusted.

API testing should use same test corpus as web testing per application security testing. Mobile-specific attack vectors should be added.

Rate limiting and abuse detection should apply to mobile API endpoints through API security. Mobile apps can be automated for abuse.

CI/CD Integration

Security Scanning

Dependency scanning identifies vulnerable libraries through software composition analysis. Scanning should block builds with critical vulnerabilities.

SAST (Static Application Security Testing) detects code-level vulnerabilities per application security testing. SAST should be tuned to reduce false positives.

Binary analysis scans compiled applications for security issues through security testing automation. Binary scanning should occur before release.

Findings Management

Security findings should be tracked in issue tracking systems through vulnerability management. Findings should have SLAs for remediation.

Vulnerability severity should drive remediation priority per vulnerability management. Critical vulnerabilities should be fixed immediately.

Release Signing

Release builds should be signed with protected signing keys per key management. Signing keys should be stored in HSMs or cloud key management.

Signing should be automated in CI/CD pipelines through DevSecOps. Manual signing creates operational risk.

Conclusion

Mobile application security requires assuming device compromise and implementing server-side enforcement of security controls. Security engineers design mobile security architectures that minimize on-device secrets, use platform security features, and degrade gracefully when client protections are bypassed.

Success requires treating mobile devices as hostile environments and implementing defense-in-depth with server-side validation. Organizations that invest in mobile security fundamentals build applications that resist attacks even when running on compromised devices.

Related Articles

References

Previous

LLM Security Risks: OWASP Top 10 for LLM Applications 2025 Guide

Next

Multi-Agent AI Security Systems - Architecture Patterns