Application Security

Mobile Application Security Testing

Android and iOS applications carry risk across code, local storage, runtime protections, API communications, and backend trust. BlockSecBrain tests insecure authentication, data leakage, API exposure, and mobile-specific weakness patterns using manual, automated, and hybrid techniques.

Request Assessment View Methodology

Overview

The Device Is Hostile Territory

A mobile application runs on hardware you do not control, in an environment the user can fully inspect. Any secret shipped in the binary is a published secret, and any control enforced only on the client is a control an attacker can remove.

We test the application as a rooted or jailbroken adversary would: unpacking the binary, hooking the runtime, intercepting pinned traffic, and then attacking the backend directly with the credentials and tokens the client hands over.

The result covers both halves of the risk. Client-side weaknesses that expose user data on a lost device, and server-side trust failures that let a modified client bypass the business rules the interface appears to enforce.

Key activities

In every engagement
  • Static analysis of APK, AAB, and IPA packages
  • Manifest, entitlement, and exported component review
  • Insecure local storage, cache, and log leakage testing
  • Hardcoded secret, API key, and certificate extraction
  • Runtime instrumentation with Frida and Objection
  • Root, jailbreak, and emulator detection bypass
  • Certificate pinning bypass and TLS validation testing
  • Backend API authorisation and IDOR testing
  • Deep link, intent, and URL scheme abuse
  • Biometric, keychain, and Keystore implementation review

Assessment Methodology

Mobile Security Testing Stages

A practical approach to client-side, backend, and device trust validation.

Package Review

Inspect application packages, manifests, entitlements, dependencies, and bundled resources for exposure or weakness.

Authentication Review

Test login flows, token handling, session persistence, and MFA pathways under real usage conditions.

API & Transport Testing

Validate mobile-to-backend trust, API authorisation, TLS handling, pinning logic, and error leakage.

Runtime Analysis

Evaluate local storage, runtime protections, tamper resistance, and platform trust assumptions.

Risk-Rated Reporting

Document technical findings with remediation guidance that spans app code, APIs, and deployment posture.

Verification Testing

Confirm fixes after remediation to ensure security controls perform as intended on real devices.

Deliverables

What You Receive

Every engagement closes with a documented, defensible evidence set that serves engineering, leadership, and audit at the same time.

Technical Findings Report

Every finding with reproduction steps, evidence, affected components, risk rating, and specific remediation guidance.

PDF report

Executive Summary

Risk posture, business impact, and thematic root causes written for leadership and board reporting.

PDF / slides

Remediation Tracker

A structured issue list with severity, owner, and status columns that maps directly into your ticketing system.

XLSX / CSV

Retest Certificate

Formal confirmation of which findings were verified as remediated, suitable for customers and auditors.

PDF attestation

Attack Path Narrative

Chained walkthroughs showing how individual weaknesses combine into a realistic compromise scenario.

Report section

Debrief Session

A live walkthrough with your engineering and security teams covering findings, priorities, and fix strategy.

Live session

Reporting Process

Risk Rating Model

Findings are rated on demonstrated exploitability and business impact, not scanner severity. Critical findings are escalated during testing rather than held for the report.

CriticalConfirmed exploitation with direct impact on data, safety, or availability. Reported within 24 hours of validation.
HighExploitable weakness with meaningful business impact or a reliable path to privilege escalation.
MediumRequires specific conditions or chaining, but materially weakens the security posture.
LowLimited impact in isolation. Tracked for hardening and defence-in-depth improvement.
InformationalObservations, hygiene items, and architectural recommendations with no direct exploitability.

Client Benefits

Outcomes You Can Measure

Mobile findings translate directly into store compliance, customer assurance, and reduced fraud exposure.

2

Platforms, One Engagement

Android and iOS are tested in parallel with a single scope, report, and remediation cycle.

MASVS

Aligned Coverage

Testing maps to OWASP MASVS control groups so results feed maturity targets, not just a bug list.

100%

Real-Device Testing

Findings are validated on physical hardware, not only emulators, including tamper and biometric flows.

Technology Coverage

Technologies We Test

Coverage spans native, cross-platform, and hybrid stacks along with the backends and SDKs they depend on.

Platforms

  • Android 10-15
  • iOS 15-18
  • Wear OS
  • iPadOS
  • Android TV
  • Automotive OS

Frameworks

  • Kotlin
  • Java
  • Swift
  • Objective-C
  • React Native
  • Flutter
  • Xamarin
  • Ionic/Cordova

Testing Toolchain

  • Frida
  • Objection
  • MobSF
  • Burp Suite
  • jadx
  • Ghidra
  • Hopper
  • adb

Platform Security

  • Android Keystore
  • iOS Keychain
  • Secure Enclave
  • Biometric APIs
  • SafetyNet/Play Integrity
  • App Attest

Backends & SDKs

  • Firebase
  • AWS Amplify
  • Supabase
  • GraphQL
  • Push services
  • Analytics SDKs
  • Payment SDKs

Hardening

  • Certificate pinning
  • Root/JB detection
  • Obfuscation review
  • Anti-hooking
  • Secure storage

Standards Alignment

Compliance Mapping

Mobile findings are mapped to the standards that app store reviewers, enterprise customers, and regulators expect to see.

OWASP

OWASP MASVS & MASTG

Testing follows the Mobile Application Security Testing Guide and reports against MASVS-STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, and RESILIENCE.

OWASP API

OWASP API Security Top 10

The backend behind the app is tested as a first-class target, including object-level authorisation and mass assignment.

ISO 27001

ISO/IEC 27001:2022

Evidence supports secure development lifecycle, cryptographic control, and technical vulnerability management requirements.

NIST CSF

NIST Cybersecurity Framework 2.0

Findings map to Protect and Detect outcomes for mobile endpoints and the services they consume.

IEC 81001

IEC 81001-5-1

For companion apps to medical devices, testing evidences secure development and product security requirements.

CRA

EU Cyber Resilience Act

Where the app forms part of a product with digital elements, findings feed the technical documentation and vulnerability handling evidence set.

How a mobile assessment supports each framework.
StandardWhere it appliesHow this engagement supports it
OWASP MASVSMobile security baselineControl-group scoring with per-requirement pass, fail, and not-applicable status.
OWASP MASTGTest procedure evidenceTest case references recorded against each finding for auditor traceability.
ISO/IEC 27001ISMS certificationAnnex A evidence for cryptography, secure development, and access control.
NIST CSF 2.0Enterprise risk reportingPosture summary aligned to CSF functions for executive reporting.
IEC 81001-5-1Health software lifecycleSecure development and verification evidence for companion applications.
EU CRAProducts with digital elementsVulnerability handling and technical documentation input for the conformity file.

Industry Expertise

Industries Served

We work with regulated and safety-critical manufacturers where a security failure carries operational, contractual, and certification consequences.

Automotive OEMs & Tier-1ECUs, telematics, and connected vehicle platforms
Industrial AutomationPLCs, SCADA, and plant-floor networks
IoT ManufacturersConnected products, gateways, and companion apps
Medical DevicesConnected diagnostics, monitoring, and hospital systems
Cloud & SaaSMulti-tenant platforms and customer-facing services
Enterprise Security TeamsInternal validation, assurance, and audit support

Engagement Workflow

How We Work With You

A predictable delivery model with defined checkpoints, so your teams know exactly what happens and when.

Scoping & Rules of Engagement

We agree targets, depth, timing windows, safety constraints, and escalation contacts before any testing begins.

Threat Modelling

Trust boundaries, attacker goals, and abuse cases are mapped so testing effort follows real business risk.

Execution & Validation

Manual, tool-assisted, and AI-accelerated testing with every finding reproduced and evidenced.

Reporting & Risk Rating

Technical detail for engineers, prioritised risk narrative for leadership, delivered in one report set.

Remediation Support

Direct access to the testing engineers while your teams design and implement fixes.

Verification Retest

A free retest of remediated findings confirms the fix holds and closes the engagement.

Questions

Frequently Asked Questions

Practical answers to what procurement, engineering, and security teams ask before an engagement starts.

Do you need the source code?

No. We test in black-box or grey-box mode by default. Source access shortens analysis and improves coverage of cryptographic and business logic paths, so we recommend it where your policy permits.

Can you test an app that is already published?

Yes. We can test the store build directly, though we usually ask for a debug or pre-release build so testing does not depend on production data.

Do you test production systems?

Yes, where the environment and rules of engagement allow it. We agree timing windows, rate limits, and safety constraints up front, and we maintain a live escalation channel for the duration of the engagement. Where production testing is unacceptable, we test staging and validate configuration parity separately.

How long does a typical engagement take?

Most assessments run between one and three weeks of active testing, depending on scope size and depth. Scoping takes two to three working days, and the report is delivered within five working days of testing completion.

Is the retest really included?

Yes. One verification retest of remediated findings is included in the engagement fee, provided it is requested within 90 days of report delivery.

Who performs the testing?

Senior security engineers only. We do not staff engagements with junior analysts running scanner output, and the engineer who tested your environment is the engineer you speak to during remediation.

Ready to secure your mobile application?

Let us validate your Android and iOS security posture across app code, runtime behaviour, and API trust boundaries.

Request Assessment Engagement Models