Sample Assessment Report
Redacted for confidentiality
Mobile Security
iOS & Android Penetration Testing
Confidential Client — FinTech Application
Android APK (v3.4.1) and iOS IPA (v3.4.0) — banking mobile application with biometric authentication and in-app payments
7 business days
OWASP Mobile Security Testing Guide (MSTG)
Executive Summary
UnlockSec conducted static and dynamic analysis of the client's mobile banking application across Android and iOS platforms. Analysis identified insecure local storage of authentication tokens, disabled certificate pinning bypass, and a sensitive data leakage issue in application background screenshots. The Android version also contained hardcoded API keys in the application binary.
Methodology
Sample Findings
Hardcoded AWS API Keys in Android Binary
Description
Static analysis of the Android APK revealed hardcoded AWS Access Key ID and Secret Access Key embedded in the application binary (strings.xml and BuildConfig.java). These keys have permissions to access S3 buckets containing customer transaction data.
Recommendation
Remove all hardcoded credentials from the application binary. Implement a secrets management solution (AWS Secrets Manager). Use short-lived, scoped credentials issued at runtime via your backend API.
Authentication Token Stored in Cleartext SharedPreferences
Description
The OAuth 2.0 bearer token is stored in Android SharedPreferences in cleartext at /data/data/com.client.app/shared_prefs/auth.xml. On a rooted device or via an ADB backup, an attacker can extract this token and authenticate to the backend API as the victim user.
Recommendation
Use Android Keystore system to encrypt sensitive credentials at rest. Use the EncryptedSharedPreferences API (Jetpack Security). Implement token binding to device identifiers.
Certificate Pinning Bypass — Intercepted API Traffic
Description
Certificate pinning is implemented but can be bypassed using Frida instrumentation hooking the SSL_CTX_set_verify function. This allows a man-in-the-middle proxy to intercept all API communications including authentication tokens and account balances.
Recommendation
Implement multi-layer certificate pinning (leaf + intermediate + root). Use TrustKit or Network Security Config. Add Frida and root detection to the application startup checks.
Sensitive Data Exposure in Application Backgrounding Screenshots
Description
When the application is backgrounded, iOS and Android capture a screenshot of the last visible screen for the app switcher. Account balances, card numbers, and transaction histories are visible in this cached screenshot, accessible to any app with screen capture permissions.
Recommendation
Implement an application overlay (splash screen or blur) on the applicationWillResignActive (iOS) and onPause (Android) lifecycle events to prevent sensitive data capture.
* Showing 4 of 20 total findings. Full report provided upon engagement.
Risk Summary
Deliverables Included
- MASVS compliance report for iOS and Android
- Static analysis report with binary extraction evidence
- Dynamic analysis report with network interception logs
- Platform-specific remediation guidance
- Retest verification for all Critical and High findings
Ready for a real assessment?
Get a tailored Mobile Security engagement led by certified operators with unlimited retests.
Request AssessmentView All Services