Introduction to mobile app security
You learn why apps on a phone are a security topic of their own, look inside an APK and an IPA, and take a first look at secrets, storage, network and device management.
Level 101 · 30 lessons · 27 practice labs
Lessons
The mobile world and its threats
- Mobile threats: lost devices, fake apps, untrusted networks
- How the platform protects apps: sandbox, permissions, signing
- Android and iOS: two different approaches to security
- App stores and sideloading
- Short task: rank five threats for a payroll app
Inside the app package
- Anatomy of an APK: manifest, dex, resources, signature
- Inside an iPhone app (IPA): Payload, Info.plist, entitlements
- Reading the Android manifest for the first time: permissions and components
- App signatures and repackaged copies
- Short task: unpack an APK and find its package name, version and signer
What the app stores and leaks
- Secrets baked into the app: API keys and passwords
- The data an app keeps on the phone
- Network security: HTTPS, trusted certificates and pinning
- Leaks through logs, screenshots and the clipboard
- Short task: find a hard-coded key and a plaintext file in a training app
Mobile security in the organisation
- A suspicious app on a company phone: the first look
- Device management and fleet compliance
- Authorised testing: permission, scope and your own lab
- Short task: mark the phones that break policy in a device list
Familiar attack scenarios and the defence
- Fake and lookalike apps: telling the real one apart
- Phishing on the phone: SMS, instant messages and QR codes
- Screen overlays and abuse of the accessibility permission
- A lost or stolen phone: what to do in the first hour
- Short task: pick the fake one out of three store listings by signer and package name
First meeting with the tools
- The toolbox: what apktool, jadx, aapt2 and apksigner are for
- Pulling an APK's identity card with aapt2
- A first look at code with jadx: browsing classes and searching
- Reading Info.plist for the first time: bundle ID, permission texts, URL schemes
- Short task: produce the identity cards of an APK and an IPA side by side
Capstone
- Capstone: review a new app before release and report your findings
Practice labs
- Rank the threats for a payroll app: Rank the eight given threats for Mavikaya Lojistik's payroll app by likelihood and impact and justify the top three.
- Work out what a lost phone would expose: From the app list of a phone lost at Lavinya Klinikleri, tabulate which data is at risk and which safeguard is missing.
- Compare the risk profiles of three apps: Prepare a threat list for a news app, a banking app and a field service app and justify the two protections that matter most for each.
- Pull the identity card of an APK: Use aapt2 to find and note the package name, version, minimum and target SDK of Turnalı Perakende's loyalty app.
- Find the identity differences between two versions: Compare two APKs of the same app and report what changed in version code, target SDK and the permission list.
- Build an inventory table from five APKs: Write package name, version, SDK values and launcher activity for five APKs in a folder to a CSV file with one command sequence.
- Open an IPA and read its Info.plist: Open Mercanköşk Otelcilik's IPA and extract the bundle ID, version and minimum iOS version from Info.plist.
- List the permission descriptions in an IPA: List every usage description string in Info.plist and flag the permission that does not fit the app's function.
- Compare an APK and an IPA side by side: Extract identity, permission and URL scheme details from the Android and iOS packages of one app and report the inconsistencies between platforms.
- Read the manifest permissions and find the needless one: List the permissions in a torch app's manifest and flag, with a reason, the one unrelated to its function.
- Count the components in a manifest: Tabulate the number of activities, services, receivers and providers in Karaçam Mobilya's catalogue app and which are exported.
- Find three risky settings in a manifest: Check the debug, backup and cleartext traffic settings in a training APK's manifest and write the corrected line for each.
- Verify the signer of an APK: Use apksigner to get the signing certificate digest of the Yelkovan Bankası app and compare it with the official digest provided.
- Pick the repackaged copy out of three: Compare the signer and package name of three APKs with the same label and show the fake copy with evidence.
- Catch a release signed with a debug certificate: Write a short check script that finds packages in an APK folder signed with a debug certificate or using only the v1 scheme.
- Find the hard-coded key in strings.xml: Find the value that looks like an API key in a decoded APK's resource files and say in one sentence why it should not be there.
- Find the hard-coded password with jadx: Open Ayçiçeği Gıda's ordering app in jadx, find the hard-coded test password in the login class and suggest a fix.
- Hunt three kinds of secrets in one APK: Find one embedded secret each in resources, code and the assets folder and report its type, location and the right way to keep it.
- Find the plaintext file in app data: In the prepared data export, find the file that keeps the user's email address in plaintext and note its path.
- Find the session token in a preferences file: Examine the preference files of the Gelincik Okulları parent app and report where and how the session token is stored.
- Look for leaks in logs, clipboard and files: Find traces of the same password in the given log dump, clipboard history and data folder, document the three leak channels separately and suggest fixes.
- Find whether the app allows cleartext traffic: Looking at an APK's manifest and network security configuration, state with evidence whether HTTP traffic is allowed.
- List the HTTP addresses in the code: Extract every address in the code and resources of the Kuzeyyıldızı Kargo app and flag the unencrypted ones.
- Read and assess the pinning setting: Find the pins, backup pin and expiry in an app's network security configuration and turn what is missing into a finding note.
- Mark the outdated phones in a device list: In Sedirli Hukuk Bürosu's twenty-device list, find the phones below the version the policy requires.
- Group non-compliant devices by cause: Compare a CSV device export with the policy items and produce separate lists of screen lock, encryption and version violations.
- Write the first note on a suspicious app on a company phone: Find the suspicious sideloaded app in a device's app list, check its signer and permissions and write a one-page first-look note.
About this course
You learn why apps on a phone are a security topic of their own, look inside an APK and an IPA, and take a first look at secrets, storage, network and device management.
What you will learn
- The mobile world and its threats
- Inside the app package
- What the app stores and leaks
- Mobile security in the organisation
- Familiar attack scenarios and the defence
- First meeting with the tools
- Capstone
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.