Mobile Application Security Glossary

The file formats that hold a shipped Android or iOS app.

The platform-provided secure storage for keys and sensitive data on a device.

The access an app requests to device features and data, some more sensitive than others.

Platform features that let a server check an app and device are genuine and untampered.

Modifying a shipped app and re-signing it, often to clone or tamper with it.

Signing an app so the platform can confirm who built it and that it was not changed.

An iOS feature that requires apps to use secure network connections by default.

Signing in or confirming actions with a fingerprint or face instead of a password.

A public identifier for a specific known software vulnerability.

A standard 0 to 10 score for how severe a vulnerability is.

A catalogue of software weakness types, used to classify what kind of flaw a finding is.

Making an app trust only specific server certificates, to resist interception.

A public log system that helps detect wrongly issued TLS certificates.

Network traffic sent without encryption, where anyone on the path can read it.

Making compiled code harder to read, to slow down reverse engineering.

Links that open a specific screen inside an app, which need careful handling.

Testing an app while it runs, by watching its real behaviour on a device.

App components that other apps on the device are allowed to reach.

A toolkit for hooking into a running app to observe and change its behaviour.

API keys, passwords or tokens left inside the shipped app where anyone can read them.

Hooking into the running app to observe its logic and data as it executes.

A compact, signed token used to carry identity and claims between an app and a server.

Intercepting an app traffic to check what it sends and how it protects it.

The practice of finding and fixing security weaknesses in Android and iOS apps.

A hands-on security test of a mobile app by a human tester.

The standard way an app gets permission to act on a user account without their password.

Taking a shipped app apart to read its code, data and behaviour.

Checks that detect when an app runs on a rooted or jailbroken device.

Defences built into an app that detect and react to attacks while it runs.

A standard file format for sharing security findings with other tools.

A separate secure chip area that protects keys so they cannot be read out.

The compiled bytecode format of Android apps and its human-readable form.

A complete inventory of the third-party SDKs and libraries bundled inside an app.

Analysing an app without running it, by reading its code and configuration.

Tricking a user into tapping something different from what they see.

Bundled SDKs that collect analytics, advertising or attribution data inside an app.

Working out what could go wrong with an app before you build or test it.

Keeping the in-app browser component from leaking data or running untrusted content.

An open-source tool that unpacks an Android app resources, manifest and smali code.

An open-source tool that turns an Android app back into readable Java-like code.