Mobile Security

Mobile Security

What I Do

I provide guidance on securing mobile applications across iOS and Android platforms. This includes secure local storage, certificate pinning, runtime integrity checks, secure inter-process communication, biometric authentication integration, and protection against reverse engineering and tampering.

When to Use Me

• Implementing secure storage for tokens, keys, or sensitive user data on mobile devices
• Adding certificate pinning to prevent man-in-the-middle attacks
• Protecting against reverse engineering, repackaging, or runtime hooking
• Implementing biometric authentication flows
• Securing inter-app communication via deep links or intents
• Preparing for OWASP Mobile Top 10 compliance review

Core Concepts

1. OWASP Mobile Top 10: Critical risks including improper credential usage, inadequate supply chain security, insecure authentication, insufficient input/output validation, insecure communication, inadequate privacy controls, insufficient binary protections, security misconfiguration, insecure data storage, and insufficient cryptography.
2. Secure Local Storage: Use platform keychains (iOS Keychain, Android Keystore) for secrets; never store sensitive data in SharedPreferences, UserDefaults, or SQLite without encryption.
3. Certificate Pinning: Pin server certificates or public keys to prevent MITM attacks from compromised CAs.
4. Runtime Integrity: Detect jailbreak/root, debugger attachment, and code tampering at runtime.
5. Binary Protection: Apply obfuscation, strip debug symbols, and enable platform hardening flags.
6. Biometric Authentication: Use platform APIs (LocalAuthentication, BiometricPrompt) with proper fallback and invalidation on biometric changes.
7. Secure IPC: Validate all data received through deep links, intents, and URL schemes.

Code Examples

1. Secure Token Storage (iOS Swift - Keychain)

import Security
import Foundation

struct KeychainHelper {
    static func save(key: String, data: Data) -> OSStatus {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]
        SecItemDelete(query as CFDictionary)
        return SecItemAdd(query as CFDictionary, nil)
    }

    static func load(key: String) -> Data? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        return status == errSecSuccess ? result as? Data : nil
    }
}

2. Certificate Pinning (Android Kotlin)

import okhttp3.CertificatePinner
import okhttp3.OkHttpClient

fun createPinnedClient(): OkHttpClient {
    val pinner = CertificatePinner.Builder()
        .add(
            "api.example.com",
            "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
            "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB="
        )
        .build()

    return OkHttpClient.Builder()
        .certificatePinner(pinner)
        .build()
}

3. Root/Jailbreak Detection (Android Kotlin)

object IntegrityChecker {
    private val rootIndicators = listOf(
        "/system/app/Superuser.apk",
        "/system/xbin/su",
        "/system/bin/su",
        "/sbin/su",
        "/data/local/xbin/su"
    )

    fun isDeviceCompromised(): Boolean {
        return rootIndicators.any { java.io.File(it).exists() } ||
            isDebuggerAttached() ||
            isRunningOnEmulator()
    }

    private fun isDebuggerAttached(): Boolean = android.os.Debug.isDebuggerConnected()

    private fun isRunningOnEmulator(): Boolean {
        return android.os.Build.FINGERPRINT.contains("generic") ||
            android.os.Build.MODEL.contains("Emulator")
    }
}

Best Practices

1. Store secrets in platform keychains (iOS Keychain, Android Keystore) with appropriate access control flags.
2. Pin certificates for all API communication and include backup pins for key rotation.
3. Validate all deep link and intent parameters as untrusted input before processing.
4. Disable backup of sensitive data by excluding it from iCloud/Google backups.
5. Enable platform hardening flags (PIE, ARC, stack canaries, ASLR) in build configurations.
6. Implement session timeout and require re-authentication for sensitive operations.
7. Use platform biometric APIs with proper fallback and invalidation on enrollment changes.
8. Strip debug symbols and logs from release builds.
9. Enforce minimum OS versions to ensure availability of modern security features.
10. Perform runtime integrity checks to detect jailbreak, root, hooking frameworks, and debugger attachment.