Case UC-09 · OWASP M7 Insufficient Binary Protections

Sensitive client logic shipped without binary protections

A client enforced sensitive logic with no binary hardening, making the app straightforward to repackage, resign and instrument at runtime.

This article documents a representative, anonymised mobile application security case. It describes the weakness, why it matters to a business, how Mobexa detects it, and how to remediate it. No specific application, company or individual is identified.

Contents

  1. Context
  2. What the research team found
  3. Why it matters
  4. How Mobexa surfaces it
  5. Remediation
  6. Standards mapped

1 Context

A client carried sensitive logic and value-bearing flows with no binary hardening - no integrity verification, no anti-instrumentation, and readily readable code paths - which made it straightforward to repackage or hook at runtime.

2 What the research team found

The team observed that the package could be modified and resigned, and that runtime instrumentation could attach to alter control flow, because no integrity or anti-tamper controls were present. Client-side checks could be neutralised by editing the artefact.

3 Why it matters

When important decisions are enforced only on the client and the client is unprotected, an attacker can repackage the app with altered behaviour, harvest its logic, or bypass gating. Binary protection is defence-in-depth rather than a substitute for server checks, but its absence lowers the cost of every other attack.

4 How Mobexa surfaces it

Mobexa assesses binary protection posture - integrity verification, anti-instrumentation, and debug and resign resistance - and reports the gaps under M7 alongside the sensitive logic they leave exposed.

5 Remediation

Enforce every security decision on the server, add integrity and anti-instrumentation controls proportional to the risk, and treat any client-side check as a deterrent rather than the control of record.

6 Standards mapped

Table 1. Frameworks and references for this case
FrameworkReference
OWASP Mobile Top 10 (2024) M7 Insufficient Binary Protections
CWE CWE-693 Protection Mechanism Failure
OWASP MASVS MASVS-RESILIENCE
hardeningtamperintegrity

See also

Documented by the Mobexa research team. This case is anonymised and provided for educational use; the mapping references the OWASP Mobile Top 10 (2024).