Contacts
Info
Dive into the high-stakes world of mobile app development and API security with Upwardly Mobile, your ultimate guide to defending apps in today’s volatile digital landscape. Hosted by Skye Macintyre...
show more
Dive into the high-stakes world of mobile app development and API security with Upwardly Mobile, your ultimate guide to defending apps in today’s volatile digital landscape. Hosted by Skye Macintyre and George McGregor, and proudly sponsored by Approov, the leaders in mobile app attestation and API security, this podcast unpacks the evolving threats and innovative solutions shaping mobile security.Explore why the built-in protections from tech giants like Apple, Google, and Huawei often fall short, leaving sensitive data vulnerable. Learn how advanced techniques—like runtime attestation and dynamic API security—thwart attackers and secure your app ecosystem. Each episode delivers insights into major data breaches, emerging trends, and actionable strategies to fortify your apps and APIs against ever-advancing cyber threats.From development best practices to navigating compliance and regulation, Upwardly Mobile equips mobile developers, security professionals, and tech enthusiasts with the knowledge to safeguard their creations. Stay informed, stay secure, and stay ahead with expert guidance on the future of mobile cybersecurity.Subscribe now on Spotify and Apple Podcasts, and elevate your security game!
show less
Upwardly Mobile - API & App Security News
Upwardly Mobile - API & App Security News
Approov Mobile SecurityEpisodes & Posts
Episodes
Posts
Transcribed
21 APR 2025 · Episode Title: The 92% Problem: Moving Beyond Obfuscation to Secure Mobile Apps
Episode Summary: Welcome to another episode of Upwardly Mobile, the podcast that dives deep into the world of mobile app development and security, sponsored by Approov! In this episode, hosts Skye Macintyre and George McGregor tackle a concerning statistic: a new analysis reveals that a staggering 92% of mobile apps use insecure cryptographic methods. We explore the findings of the Zimperium report, "Your Apps are Leaking: The Hidden Data Risks on your Phone," which analyzed over 17,000 enterprise mobile applications and uncovered widespread vulnerabilities, including misconfigured cloud storage, hardcoded credentials, and alarmingly outdated cryptographic practices.We delve into why traditional static defenses like code obfuscation are no longer sufficient to protect against modern threats. While obfuscation aims to deter reverse engineering, it ultimately fails to prevent determined attackers with advanced tools and dynamic analysis techniques from compromising applications at runtime. As OWASP guidance acknowledges, "Ultimately, the reverse engineer always wins" against purely static defenses.The episode highlights the evolving threat landscape, emphasizing the weaponization of Artificial Intelligence (AI) and the relentless targeting of Application Programming Interfaces (APIs). AI is being used to automate attacks, create adaptive malware, hyper-personalize social engineering, and accelerate vulnerability discovery. APIs, the backbone of modern mobile apps, are prime targets for credential stuffing, account takeover, and business logic abuse. Static defenses on the client-side offer little protection against these server-side vulnerabilities and sophisticated attack methods.We then shift our focus to the critical need for dynamic security measures that protect applications during runtime.
We discuss several key techniques:
- Runtime Application Self-Protection (RASP): This technology is built into the app or its runtime environment, enabling it to detect and prevent real-time attacks by monitoring inputs, outputs, function calls, and interactions with the operating system. RASP can detect reverse engineering attempts, code tampering, and execution on compromised devices.
- Runtime Secrets Protection: This approach eliminates hardcoded secrets by delivering them securely, just-in-time, to validated app instances via a backend service. App attestation checks ensure that secrets are only provided to legitimate, untampered applications.
- Dynamic Certificate Pinning: This method secures communication channels against Man-in-the-Middle (MitM) attacks by dynamically retrieving and verifying server certificates from a trusted management service. This offers greater flexibility and reduces the risk of outages compared to static pinning.
- App Attestation & Token-Based API Access: This process verifies the authenticity and integrity of the mobile application instance before granting access to sensitive APIs. Successful attestation results in a short-lived token that the API backend can verify, ensuring requests originate from genuine, unmodified apps.
These dynamic techniques work synergistically to create a layered defense strategy aligned with Zero Trust principles – "never trust, always verify". By continuously assessing the security posture of the application and its environment in real-time, these methods offer significantly stronger protection against modern threats than static defenses alone.Stay informed, stay secure, and stay ahead in the world of mobile cybersecurity with Upwardly Mobile!Relevant Web Links:
- 92% of Mobile Apps Found to Use Insecure Cryptographic Methods - Infosecurity Magazine:https://www.infosecurity-magazine.com/news/92-mobile-apps-insecure/
- Mobile Security Beyond Obfuscation_.pdf (Local File)
- Approov Website:https://approov.io/
Keywords: Mobile App Security, API Security, Code Obfuscation, Cryptography, Data Breaches, Vulnerabilities, Dynamic Security, Runtime Application Self-Protection (RASP), Runtime Secrets Protection, Dynamic Certificate Pinning, App Attestation, AI-Powered Attacks, API Abuse, OWASP Mobile Top 10, Podcast, Upwardly Mobile
This episode was brought to you by Approov, the leaders in mobile app attestation and API security. Learn how Approov can help you secure your mobile apps and APIs athttps://approov.io/.
Transcribed
18 APR 2025 · The Critical Imperative of Mobile App Security in 2025
Welcome back to Upwardly Mobile, the podcast tackling the high-stakes world of mobile app development and API security, sponsored by Approov—the leaders in cross-platform app attestation technology1. In this episode, we delve into the essential reasons why mobile app security is not just important, but a critical imperative in today's digital landscape.
Episode Highlights:
•
The Flourishing Mobile App Market and Growing Threats: We kick off by highlighting the massive growth of the mobile app market, with billions of smartphone users worldwide2. This widespread adoption, while offering great opportunities, also presents a larger attack surface for malicious actors3. Today over 85% of the world’s population own smartphones. The Apple App Store and Google Play Store boast millions of apps, and a significant portion of mobile device time is spent using these apps2. This popularity translates to a market predicted to generate almost a trillion dollars in revenue by 2023, making mobile apps indispensable3. However, this also means increased opportunities for hackers to exploit security vulnerabilities3.
•
Understanding Mobile Application Security: We define mobile application security as a technique for ensuring the software security posture of high-value mobile applications across various operating systems like iOS and Android3. It's about protecting digital identities from fraud and preventing attacks on users and organisations3. Attackers target mobile apps to access accounts, commit fraud, steal data, conduct espionage, or spread malware4.
•
The Costs of Security Breaches: Ignoring mobile app security can lead to severe consequences, including the loss of sensitive personal data, financial losses, and damage to an organisation's reputation5. Furthermore, organisations can face financial penalties due to regulations like GDPR, HIPAA, and CCPA if compromised data is not protected5.
•
Key Security Risks in Mobile Apps: We discuss some of the most prevalent security risks affecting mobile apps, as outlined by the OWASP Mobile Top 10. These include inadequate cryptography, reverse engineering, obtrusive functionality, code tampering, poor client code quality, insecure data storage, authentication, communication, and authorization6. The unique technologies used in mobile necessitate custom tooling for effective security testing6.
•
The Importance of Mobile Application Security Testing (MAST): We explore why Mobile Application Security Testing (MAST) is crucial for identifying and addressing weaknesses in mobile applications3.... Implementing MAST early in the Software Development Life Cycle (SDLC) can help developers lower application security risks before release4.... A thorough MAST strategy combines static analysis (SAST) to identify vulnerabilities in source code, dynamic analysis (DAST) to test running applications, and behavioural testing to track app actions and data flows7....
•
Shielding Mobile Apps and APIs: We touch upon the importance of end-to-end security for businesses relying on mobile apps10. Protecting against API vulnerabilities alone is insufficient; defence against API abuse is also necessary10. Ensuring only genuine app instances can use your API is key to isolating your mobile business from attacks10. A recommended approach includes implementing a shield for your mobile app and its APIs to protect data at rest and in transit, implementing security basics like code obfuscation and certificate pinning, and establishing a regular pentesting program11.
•
The Persistent Threat of Stolen Credentials and the Role of MFA: We address the fact that many mobile breaches originate from compromised or stolen credentials, often through phishing or password reuse12. Multi-Factor Authentication (MFA) is a vital defence mechanism, requiring multiple forms of verification to reduce the risk of account compromise significantly13. However, the implementation quality of MFA varies, and attackers are developing bypass techniques. Therefore, enforcing modern MFA and considering passwordless approaches based on FIDO2 specifications is crucial14. Progressive testing, tailored to the risk level of the app, is recommended to ensure adequate MFA security15. This can range from automated testing to expert-led penetration testing16. Key steps in testing MFA security include reviewing implementation design, examining user experience flows, testing authentication channels, evaluating data storage, conducting penetration testing, checking for replay attacks, and assessing usability and resilience17.... Regularly updating and monitoring MFA mechanisms is also essential21.
Relevant Web Links:
•
OWASP Mobile Top 10: [You can search for "OWASP Mobile Top 10" on the OWASP website: owasp.org]
•
GDPR: [You can search for the "General Data Protection Regulation" on official EU websites]
•
HIPAA: [You can search for the "Health Insurance Portability and Accountability Act" on the HHS website: hhs.gov]
•
CCPA: [You can search for the "California Consumer Privacy Act" on the California Attorney General's website: oag.ca.gov]
Keywords: Mobile App Security, Mobile Security Testing, MAST, SAST, DAST, OWASP Mobile Top 10, API Security, Stolen Credentials, Multi-Factor Authentication (MFA), Mobile Threats, Security Breaches, Data Protection, App Development Security, Cybersecurity.
Sponsored by Approov:
Learn how Approov's cross-platform app attestation technology can safeguard your mobile apps and APIs from malicious attacks. Visit approov.io to explore their solutions and protect your digital assets.
Tune in next time as we explore [Insert topic for next episode related to mobile security or API security].
Listen and subscribe to Upwardly Mobile on all major podcast platforms!
Transcribed
14 APR 2025 · Apple Under Scrutiny: The EU's DMA in Action
Welcome back to Upwardly Mobile! In this episode, we delve into the latest developments surrounding the European Union's Digital Markets Act (DMA) and its significant impact on major technology companies, particularly Apple. We explore the European Commission's recent guidance aimed at ensuring interoperability on Apple's platforms and the broader implications of this landmark legislation for competition and innovation in the digital marketplace.The DMA, designed to curb anti-competitive behaviour, designates certain large online platforms as "gatekeepers". Companies like Apple are now facing strict requirements to foster a more level playing field. We break down the Commission's two key decisions specifying the measures Apple must take to comply with its interoperability obligations.Firstly, we examine the new rules concerning connected devices such as smartwatches, headphones, and TVs. The Commission is mandating improved access to iPhone features, faster data transfers, and easier device set-up, which should lead to better compatibility for devices of all brands with iPhones and new opportunities for device manufacturers. This aims to enhance the user experience for European consumers while respecting user privacy and security.Secondly, we discuss the measures to improve the transparency and effectiveness of Apple's process for handling interoperability requests from developers. This includes better access to technical documentation, timely communication, and more predictable timelines for review. The goal is to accelerate developers' ability to offer innovative services and hardware that work seamlessly with iPhones and iPads. These measures follow extensive engagement with Apple and input from third parties.Beyond interoperability, we touch upon other significant DMA-related developments. Apple is now allowing alternative app stores on iOS, a major shift brought about by the legislation. However, there is ongoing scrutiny and skepticism from developers regarding the implementation of these new rules.We also look at the potential for fines under the DMA, with sources indicating that Apple and Meta could soon face "modest" penalties for alleged breaches. Additionally, the European Commission has charged Google with breaking antitrust laws by favouring its own shopping, hotels, and flights services, and for violating anti-steering rules in its Play Store.Furthermore, the EU has been actively pushing Apple to make iOS and iPadOS more interoperable, and while Apple has released its first iOS 18.4 developer beta with features like Priority Notifications, the focus remains on DMA compliance. Interestingly, the Commission has concluded that X (formerly Twitter) does not currently qualify as a "gatekeeper" under the DMA.The landscape of app distribution in the EU is also changing rapidly, with the Epic Games Store and Setapp Mobile launching as alternative app marketplaces for iOS users. Meanwhile, Meta's "pay or consent" ad model for Facebook and Instagram is facing scrutiny under the DMA, and there are concerns about Apple's approach to AI deployment in the context of the new regulations. Finally, the EU has issued a preliminary ruling stating that Apple's App Store "steering" policies violate the DMA.The DMA is clearly driving significant changes in how Big Tech operates in Europe, and we will continue to monitor these developments on Upwardly Mobile.Relevant Web Links:
- European Commission - Digital Markets Act (DMA) Information: [Search "Digital Markets Act European Commission" on europa.eu to find the official page]
- The Verge - How the EU’s DMA is changing Big Tech: all of the news and updates: [Insert link to: https://www.theverge.com/2024/3/19/24104029/eu-digital-markets-act-dma-apple-google-meta]
Keywords: Digital Markets Act, DMA, EU, European Union, Apple, iOS, iPadOS, Interoperability, App Store, Alternative App Stores, Gatekeepers, Competition, Antitrust, Regulation, Innovation, Connected Devices, Developers, Fines, Google, Meta, Epic Games Store, Setapp Mobile, Privacy, Security.
Sponsored by:https://approov.io/ - Secure your mobile apps with Approov's runtime protection.
Listen and subscribe to Upwardly Mobile on all major podcast platforms!
Transcribed
10 APR 2025 · Episode Title: The Growing Threat to Mobile APIs: Leaks, Lapses, and Robust DefencesEpisode Notes:In this episode of Upwardly Mobile, we delve into the escalating challenges surrounding API security for both web and mobile applications. We explore recent alarming trends, including the leakage of 39 million secret API keys and credentials from GitHub in 2024, highlighting the persistent threat of exposed authentication data such as API keys, credentials, and tokens. This situation has prompted GitHub to launch new security tools to combat this issue. According to GitHub, numerous secrets are blocked every minute with push protection, yet accidental exposure remains a significant cause of security incidents. Experts like Erin Havens from GitHub emphasize that developers handle numerous secrets daily, which can be unintentionally exposed. Even seemingly low-risk secrets can provide attackers with a foothold for lateral movement.We also examine a real-world security lapse involving API testing firm APIsec, which exposed customer data due to a misconfigured internal database connected to the internet without a password for several days. The exposed data, dating back to 2018, included names, email addresses, and details about the security posture of APIsec's corporate customers. Security research firm UpGuard discovered the leak. Initially downplayed by APIsec founder Faizel Lakhani, the exposed data was later confirmed to include sensitive customer information and even private keys for AWS and credentials for Slack and GitHub accounts. This incident underscores the severity of even unintentional security lapses in the API ecosystem.The episode further explores why mobile APIs are particularly vulnerable compared to web APIs. Client-side validation in mobile apps can be bypassed, reverse engineering is easier, granular API endpoints increase the attack surface, and mobile apps may lack advanced security measures. Device-specific risks, such as rooted or jailbroken devices, also compromise app integrity. To counter these threats, the integration of a Mobile SDK with attestation is crucial. Such SDKs provide runtime integrity checks, authenticate API calls, detect tampering, and enable dynamic token binding.We discuss how traditional backend app security solutions, like Web Application Firewalls (WAFs), may not be sufficient for mobile app protection as they lack contextual information from the client environment. A Mobile SDK can provide continuous verification of contextual information from the app and the client environment, which is essential for reliably countering mobile threats. Two main types of Mobile SDKs for bot detection exist: those analysing user behaviour signals and those focusing on software-identity signals.Approov emerges as a leading solution for mobile app and API security, providing visibility and protection through a positive authentication model that validates legitimate app and device actions while blocking bots and other threats. The Approov SDK seamlessly integrates with mobile apps and continuously validates the app and device at runtime, allowing the app to present an authorised identity to the server. Approov also offers a unique way to protect API keys used by mobile apps, delivering them just-in-time only to validated apps and environments. Approov can easily integrate with any backend API gateway, WAF, or WAAP solution by using standard JWT tokens in requests.The Q1 2025 State of API Security Report from Salt Security reveals critical insights into the broader API security landscape. Key findings include that 99% of organisations have encountered API security issues in the past year and 55% have slowed the rollout of new applications due to API security concerns. The report highlights that 95% of attack attempts originate from authenticated users and 98% target external-facing APIs. The most frequently exploited vulnerability is API8 (Security Misconfiguration), accounting for 54% of attacks, followed by API1 (Broken Object Level Authorization) at 27%. Alarmingly, only 20% of organisations continuously monitor their APIs in real-time, and a significant number lack confidence in their API inventories. The report also addresses the emerging risks associated with Generative AI (GenAI) in API security, including concerns about the quality and security of AI-generated code.Key Takeaways:
- API security is a critical and evolving challenge, with significant risks arising from leaked credentials, security misconfigurations, and sophisticated attacks.
- Mobile APIs present unique vulnerabilities that require dedicated security measures beyond traditional web application security.
- Mobile SDKs with attestation, such as Approov, are essential for providing robust protection for mobile APIs by ensuring app and device integrity.
- Organisations need to adopt a proactive API security strategy that includes continuous monitoring, strong authentication and authorisation, proper configuration management, and adherence to security frameworks like the OWASP API Top Ten.
- Addressing the security risks associated with Generative AI in API development is becoming increasingly important.
Relevant Links:
- 39M Secret API Keys & Credentials Leaked from GitHub:https://cybersecuritynews.com/39m-secret-api-keys-credentials-leaked-from-github-new-tools-to-revamp-security/
- API testing firm APIsec exposed customer data during security lapse | TechCrunch:https://techcrunch.com/2025/03/31/apisec-security-lapse-customer-data-exposed/
- Enhancing Mobile App API Security: Closing Gaps with a Robust SDK:https://approov.io/blog/mobile-app-api-security-closing-the-protection-gap-with-a-mobile-sdk
- Mobile APIs are more vulnerable.pdf: (This is a local file and cannot be directly linked. Search for "Mobile APIs are more vulnerable" to find similar resources.)
- Q1 2025 State of API Security: (This is a local file and cannot be directly linked. Search for "Salt Security State of API Security Report Q1 2025" to find it.)
- OWASP API Security Top 10:https://owasp.org/www-project-api-security/
Sponsor Link:
- Approov:https://approov.io/
Keywords: API security, mobile API security, web API security, API leaks, leaked credentials, GitHub, APIsec, data breach, Mobile SDK, attestation, runtime protection, OWASP API Top 10, Generative AI security, Approov, bot protection, API monitoring, API inventory.
Transcribed
2 APR 2025 · Upwardly Mobile - Episode Title: Securing Mobile Apps: Approov's Award-Winning Attestation Technology
Welcome to Upwardly Mobile, the podcast exploring the latest innovations in mobile technology. In this episode, we delve into the critical world of mobile application security and explore a groundbreaking solution that's garnering industry recognition. We focus on Approov Limited and their patented app attestation technology (U.S. Patent 11,163,858 B2). This innovative approach addresses the growing challenge of ensuring the integrity and trustworthiness of mobile applications and their interactions with backend systems.Key
Discussion Points:
- The Growing Need for Mobile App Security: We discuss the vulnerabilities faced by mobile apps, including tampering, reverse engineering, and API abuse. Learn why simply authenticating users isn't enough to protect sensitive data and transactions.
- Introducing Approov's App Attestation Technology: We explain how Approov's technology works to verify the integrity of a running mobile application on the server-side. This involves cryptographic methods and runtime security checks to ensure that only legitimate, untampered app instances can access backend APIs.
- How Client Software Attestation Works (Based on the Patent):
- A client software application calculates a cryptographic hash fingerprint of its executing code.
- This fingerprint is communicated to an attestation service.
- The attestation service generates a pass or fail result.
- This result is communicated to the server, which can then control its behaviour based on the attestation outcome.
- The system can employ challenge-response mechanisms using a nonce to prevent replay attacks.
- Signed tokens can be used for indirect communication of the attestation status, secured with a shared secret key.
- Addressing Limitations of Native Platform Solutions: We highlight how Approov's cross-platform solution overcomes the limitations of platform-specific solutions like Apple's App Attest and Google's Play Integrity API, particularly concerning rooted or jailbroken devices.
- Real-World Impact and Use Cases: Discover how global leaders in sensitive industries like fintech, healthcare, retail, and automotive are using Approov to reduce fraud, enhance API security, and ensure compliance. We touch upon examples such as the BMW Group's car-sharing platform and fintech companies like Papara.
- Recognition and Awards: We celebrate Approov winning the Cyber Innovation Award at the 2025 Scottish Cyber Awards. This prestigious recognition underscores their pioneering work in mobile app security. Approov was also a finalist alongside other esteemed organisations.
- Alignment with Regulatory Frameworks: We discuss how Approov's technology supports compliance with emerging regulations like the EU Digital Markets Act (DMA) and the UK Digital Markets, Competition, and Consumers Bill (DMCC). We include a quote from Ted Miracco, CEO of Approov Limited, regarding the significance of the DMCC Bill.
Links:
- Approov Website (Sponsor):https://approov.io/
- Approov Patents:https://www.uspto.gov/
- Application for Best Innovation in Cybersecurity Award for Scottish Companies: [Link to the PDF - 2021.11.02_US11163858.pdf in your source material]
- Approov Limited Shortlisted for Cyber Innovation Award at the 2025 Scottish Cyber Awards: [No direct link provided in source, search for "Approov Limited Shortlisted Scottish Cyber Awards 2025"]
- Winners announced for the 2025 Scottish Cyber Awards:https://www.digit.fyi/winners-announced-for-the-2025-scottish-cyber-awards/
- Scottish Cyber Awards | Finalists 2025:https://www.scottishcyberawards.scot/finalists-2025/
- UK DMCC Legislation: Transforming Mobile App Security?:https://approov.io/resources/blog/uk-dmcc-legislation-transforming-mobile-app-security/
- Approov Customer Success Stories:https://approov.io/customer/
Keywords: Mobile App Security, App Attestation, Approov, Cybersecurity, API Security, Mobile Security Innovation, Digital Markets Act (DMA), Digital Markets, Competition, and Consumers Bill (DMCC), Cyber Innovation Award, Scottish Cyber Awards, Fraud Prevention, API Abuse, Mobile App Tampering, Cloud-Based Security, Cross-Platform Security, Fintech Security, Healthcare Security, Automotive Security, E-commerce Security.
This episode was brought to you by Approov, the leader in mobile app and API security. Learn more about how Approov can protect your mobile applications athttps://approov.io/.
Stay tuned for our next episode of Upwardly Mobile!
Transcribed
30 MAR 2025 · Podcast Title: Upwardly Mobile Episode Title: Google Goes Private: The Future of Android DevelopmentEpisode Description:In this episode of Upwardly Mobile, we delve into a significant shift in the world of Android development. Google has announced that it will now conduct all Android operating system development internally, moving away from the traditional model where much of the work was visible through the public Android Open Source Project (AOSP). We explore the reasons behind this move, its implications for manufacturers, developers, and the future of the Android ecosystem, especially for non-GMS (Google Mobile Services) devices popular in regions like India and China. Join us as we unpack what this change means for the upwardly mobile tech landscape.Key Discussion Points:
- Google's Strategic Shift: We discuss Google's decision to move all Android OS development to its internal infrastructure. Previously, Android had two development locations: the public AOSP and Google's internal branch. This change aims to streamline the development workflow and simplify software releases.
- The End of AOSP-First Development: For over sixteen years, AOSP has been the primary platform for Android development. This shift means that core development will now happen solely within Google. Technologies like the Bluetooth stack and the kernel will now be developed internally.
- Commitment to Open Source: Despite this change, Google has stated its commitment to the open-source nature of Android. They will continue to publish the source code for new Android versions to AOSP after internal development is complete. Android 16's source code is planned for release in 2025.
- Reasons for the Change: Maintaining synchronization between the internal and public branches has been challenging, leading to technical difficulties like merge conflicts. Google believes this single internal branch will allow phone makers and developers to work with one consistent version.
- Impact on Non-GMS Android Forks: This move has significant implications for non-GMS Android operating systems and manufacturers, particularly those in India and China. They will have reduced access to real-time updates and development progress. Source code releases for individual components may also become less frequent.
- Challenges for Developers: Developers of non-GMS forks will need to rely on finalized release tags, potentially hindering innovation and customization. Ensuring compatibility with future Android versions may also become more difficult.
- Impact on App Developers: While app developers are largely unaffected, those who relied on AOSP for insights into upcoming changes may face reduced transparency and need to wait for final APIs. This could potentially push developers in regions with many non-GMS devices towards alternative platforms like HarmonyOS.
- Reactions from the Community: Some Android OS engineers are expressing sadness over this shift, as they believe in the philosophical importance of developing security and privacy-relevant components in public. However, the practical impact for most users and even platform developers working off release branches is expected to be minimal.
Relevant Web Links:
- All Android Developments Circulate In-House.. (India Herald):https://www.indiaherald.com/Technology/Read/994807090/All-Android-Developments-Circulate-InHouse
- Android development moves internally at Google ahead of public releases (Neowin):https://www.neowin.net/news/android-development-moves-internally-at-google-ahead-of-public-releases/
- Exclusive: Google will develop the Android OS fully in private, here's why (Android Authority):https://www.androidauthority.com/google-android-development-aosp-3538503/
- Google Will Develop the Android OS Fully In Private - Slashdot:https://news.slashdot.org/story/25/03/26/2017227/google-will-develop-the-android-os-fully-in-private
Keywords: Android, Google, AOSP, Android Open Source Project, in-house development, software development, mobile OS, updates, non-GMS, India, China, HarmonyOS, open source, trunk-based development, API, source code, Google Mobile Services.
Sponsor: This episode is brought to you by Approov (https://approov.io/). Approov protects your mobile apps and APIs from abuse, ensuring only genuine users and devices can access your services. Learn more athttps://approov.io/.
Transcribed
29 MAR 2025 · Upwardly Mobile - Episode Title: Jailbreaking iPhones: Risks, Detection, and Staying Secure
Welcome to Upwardly Mobile, the podcast exploring the latest trends and security challenges in the mobile landscape. In this episode, we delve into the world of iOS jailbreaking, examining the latest developments, the ongoing battle between jailbreak detection and bypass methods, and the significant security implications for both individual users and organisations.
Listen as we discuss:
- What is Jailbreaking? We explain what it means to jailbreak an iPhone and the motivations behind it, from wanting more customisation and features to accessing third-party apps not available on the official App Store.
- Dopamine 2.0 and the Detection Landscape: We look at the release of the Dopamine 2.0 jailbreak and how app developers are increasingly catching on, with more apps now detecting jailbroken devices.
- The Cat and Mouse Game: Bypassing Jailbreak Detection: Discover the various tools and techniques users employ to bypass jailbreak detection, including tweaks like Choicy and vnodebypass, and the practice of downgrading apps using tools like AppStore++. We also touch on methods like hiding the Filza URL scheme.
- Apps on High Alert: We highlight the types of apps most commonly known to implement jailbreak detection, such as banking applications, social media platforms like Snapchat, and popular games.
- The Hidden Dangers: Security Risks Amplified: We explore the significantly increased security risks associated with using jailbroken devices, making them much more susceptible to malware infections and total compromise.
- For Developers: Fortifying Your Apps: We discuss solutions available to mobile app developers to protect their applications from jailbreak detection bypass tools. Learn about platforms like Appdome and their AI-powered features to actively block bypass attempts.
- Advanced App Security with Approov: We touch upon the capabilities of Approov in providing runtime app shielding, integrity verification, and detection of tampering, emulators, debuggers, and rooting/jailbreaking.
Relevant Links:
- Reddit Discussion - First app I found that detected jailbreak on Dopamine 2.0:
- HowStuffWorks - How to Jailbreak an iPhone:
- Appdome - How to Protect iOS Apps from Jailbreak Detection Bypass Tools Using AI:
- Approov - Mobile App Shielding | Device Attestation:
- Mobile Jailbreaks Exponentially Increase Corporate Risk:
Keywords: iOS, jailbreak, Dopamine 2.0, jailbreak detection, bypass, Choicy, vnodebypass, AppStore++, security, malware, app protection, Appdome, Approov, mobile security, iPhone, banking apps, Snapchat, gaming.
Learn more about protecting your mobile apps with our sponsor, Approov:https://approov.io/
Stay tuned for the next episode of Upwardly Mobile for more insights into the ever-evolving world of mobile technology.
Transcribed
20 MAR 2025 · Episode Title: Securing Your Connection: A Guide to Preventing MitM AttacksEpisode Description: Man-in-the-Middle (MitM) attacks pose a significant threat to online security, allowing malicious actors to intercept and manipulate communications. This episode delves into what MitM attacks are, how they work, and crucial strategies for prevention, especially for mobile applications. We'll explore the evolving landscape of security measures, including the debate around certificate pinning.Episode Notes:
- What are Man-in-the-Middle (MitM) attacks?
- A MiTM attack occurs when a bad actor secretly inserts themselves between two connected parties to read, steal, manipulate, or forward exchanged data. These attacks are also known as "eavesdropping".
- The potential payoff for attackers can be significant.
- Popular targets include insecure networks, unencrypted websites, smartphones, and other smart devices.
- How do MitM attacks work?
- Attackers can monitor digital activities, conversations, and emails to steal sensitive information like login credentials, credit card numbers, and bank details.
- Once an insecure access point is found, the attacker positions themselves between the two communicating parties, with all transmissions passing through them in real-time.
- Example 1: Man-in-the-Mobile (MitMo) attack: A fraudster secretly reroutes text messages between two individuals, seeing all the content shared.
- Example 2: Malicious Wi-Fi Hotspot: Attackers create unsecured public Wi-Fi hotspots, often named similarly to legitimate locations, to intercept data from connected users.
- Common Types of MitM Attacks:
- Adversary-in-the-Middle (AitM): A malicious actor uses a reverse proxy to intercept user credentials and session tokens, often bypassing OTP-based multi-factor authentication. This is common in phishing attempts.
- Man-in-the-Browser (MitB): Attackers inject JavaScript into a user's browser (e.g., through malicious extensions or downloaded malware) to gain access to sensitive information and perform unauthorised actions.
- Man-in-the-Mobile (MitMo): Attacks target mobile devices through infected apps and phishing scams, allowing interception of communications and sensitive data, and in severe cases, remote device control. Sophisticated malware can even be installed without user interaction.
- DNS Spoofing: Attackers infiltrate a DNS server and alter website address records, redirecting users to the attacker's site.
- Wi-Fi Eavesdropping: Creating fake public Wi-Fi networks to intercept user activity and data.
- Email Hijacking: Cybercriminals intercept emails (e.g., between banks and customers) to spoof email addresses and send fraudulent instructions to the victim.
- Session Hijacking: Attackers steal information stored in web browser cookies, such as saved passwords.
- IP Spoofing: An attacker disguises themselves as an application by altering packet headers, redirecting users to a malicious website.
- Detecting Man-in-the-Middle Attacks:
- Be alert for any abnormal activity on your online accounts or devices (e.g., unfamiliar balances or activity).
- Use antivirus software to scan for malware.
- Inspect your Wi-Fi connection to ensure it is secure and not open.
- Only visit HTTPS sites you trust and verify the URL for accuracy and no typos.
- Be wary of suspicious certificates.
- Look out for unfamiliar or misspelled URLs in your browser's address bar.
- Be aware of network connections you don't recognise.
- Preventing Man-in-the-Middle Attacks:
- User Best Practices:
- Avoid connecting to Wi-Fi networks without password protection.
- Pay attention to browser warnings about unsecure websites and only trust encrypted connections (HTTPS).
- Log out of secure sites when you are finished.
- Avoid conducting sensitive transactions over public networks.
- Use a Virtual Private Network (VPN) for an added layer of security, especially on untrusted networks.
- Organisational Measures:
- Implement robust network security measures.
- Conduct regular employee training on recognising potential threats.
- Vet organisation emails to identify phishing attempts from external senders.
- Implement Multi-Factor Authentication (MFA).
- Consider Public Key Pair Based Authentication (FIDO).
- Utilise detection tools.
- The Role of Certificate Pinning in MitM Prevention:
- TLS certificate pinning ensures a mobile app only trusts specific certificates, preventing attacks using rogue certificates.
- The app "pins" a specific certificate or public key during development.
- During API calls, the app verifies that the server's certificate matches the pinned certificate, rejecting the connection if it doesn't.
- Limitations of Static Certificate Pinning:
- Apps can break if the server certificate changes (e.g., due to expiration) unless the app is updated.
- Maintaining static pinning requires app updates every time the certificate changes, which can be impractical.
- Attackers can reverse engineer the app and modify the pinning logic.
- Tools like Frida and Xposed can be used to disable pinning checks at runtime.
- Attackers might force trust for their own certificates by modifying device trust stores.
- The Advantages of Dynamic Certificate Pinning:
- Securely updates certificate pins without requiring app updates.
- The app fetches the latest valid certificate pins from a remote attestation service at runtime.
- Stronger protection against reverse engineering as attackers cannot easily modify pinning logic without breaking attestation.
- Can defend against rooted devices and emulators through additional security checks.
- Allows for certificate rotation without app updates.
- Limits exposure if a certificate is compromised as pins change frequently.
- Makes it harder to extract expected certificates.
- Enables on-demand retrieval of valid certificates.
- Arguments Against Traditional SSL Pinning (circa 2025):
- Industry leaders like Google now advise against enabling SSL pinning in mobile applications.
- SSL pinning can lead to service disruptions due to certificate changes, requiring app updates and user adoption.
- It can be easily bypassed using tools like Frida and Xposed.
- Better alternatives include detecting proxies and debugging tools, leveraging device-fingerprinting techniques, and focusing on backend security decisions.
- Conclusion: A Multi-Layered Security Approach:
- Dynamic certificate pinning is a strong defence against mobile MitM attacks but should be part of a broader security strategy.
- A comprehensive approach includes encryption of all communications.
- Careful verification of TLS/SSL configurations, disabling older protocols and weak encryption algorithms.
- Considering VPNs for very high-risk scenarios.
- Implementing dynamic certificate pinning and mobile app attestation for end-to-end API protection.
- Using mobile app attestation to verify app integrity before allowing API access.
- Blocking rooted and jailbroken devices.
- Monitoring API traffic for anomalies.
Source Materials:
- https://www.approov.io
- https://approov.io/mobile-app-security/rasp/dynamic-cert-pinning/
Transcribed
18 MAR 2025 · Episode Notes: In this episode, we delve into the crucial topic of mobile app security, focusing on the concept of hardware-backed key attestation and its role in verifying device integrity. We explore what key attestation is, an enabling feature of the Android ecosystem that allows apps to check if the device's operating system, bootloader, and overall environment have been tampered with. This process often involves leveraging the device's KeyStore to retrieve a certificate chain and verifying the integrity of certificates and root certificates. We discuss the potential benefits of key attestation, particularly for applications handling sensitive data in industries like finance, point-of-sale (POS) systems, gaming and entertainment, retail and e-commerce, and healthcare. For instance, key attestation can help ensure that payment environments are uncompromised, aligning with security standards like PCI DSS. It can also be valuable for security-focused SDKs, such as those used for identity verification, by ensuring a device's integrity before providing assurances. DexGuard's OS Integrity feature is mentioned as an example of a product building upon key attestation. However, the episode also critically examines the limitations and challenges associated with relying solely on hardware-backed key attestation. We address concerns that determined attackers can potentially manipulate the device to return false positives, rendering device-based attestation unreliable. The static nature of device-based attestation, making it a fixed target, is also highlighted. Additionally, device compatibility issues, particularly with older devices or those lacking trusted certificates, and the potential for false positives affecting legitimate users with custom ROMs or unlocked bootloaders are important considerations. The discussion contrasts device-based attestation with cloud-based attestation solutions, such as Approov, which make attestation decisions remotely, potentially offering more dynamic security policies and protection for both mobile apps and APIs. The importance of runtime protection against threats that can bypass bootloader verification is also touched upon. Furthermore, the episode considers the role of Secure Elements (SE) and Secure Enclaves in protecting sensitive information. While these hardware-backed solutions offer strong security, the software layers above them can introduce vulnerabilities like hooking attacks and emulation, especially on rooted Android devices and jailbroken iOS devices. Tools like Frida and Xposed Framework that can intercept communication are mentioned. The importance of a holistic approach to mobile security, combining hardware integrity with software hardening and runtime protections, is emphasised. Solutions like Cryptomathic’s Mobile Application Security Core (MASC), which aims to protect against hooking, emulation, and tampering, are noted. Links to Relevant Sites:
- Guardsquare: https://www.guardsquare.com/
- Guardsquare Blog: https://www.guardsquare.com/blog
- DexGuard: https://www.guardsquare.com/dexguard
- ProGuard Manual: Available via Guardsquare website
- Cryptomathic: https://www.cryptomathic.com/
- Cryptomathic Blog: https://www.cryptomathic.com/blog
- Approov: https://approov.io/
- Android Developers - Verify hardware-backed key pairs with key attestation: https://developer.android.com/privacy-and-security/security-key-attestation
Keywords:
- Mobile App Security
- Hardware-Backed Key Attestation
- Device Attestation
- Cloud Attestation
- Secure Element (SE)
- Secure Enclave
- Rooting
- Jailbreaking
- Hooking Attacks
- Emulation
- Runtime Application Self-Protection (RASP)
- DexGuard
- Approov
- MASC
- Play Integrity API
- KeyStore
- Bootloader Verification
- API Security
- Mobile SDK Protection
- Threat Monitoring
Transcribed
14 MAR 2025 · Episode Notes: In this episode, we delve into the growing threat of secrets sprawl, particularly for mobile developers. The recent State of Secrets Sprawl 2025 report revealed a concerning 25% increase in hardcoded secrets exposed on GitHub in 2024, with 23.7 million new secrets leaked. We explore why mobile apps are particularly vulnerable, as they often contain API keys, authentication tokens, and other sensitive data that can be easily extracted from hardcoded source code, leading to API abuse, data breaches, and supply chain attacks. We discuss how hardcoded secrets are a major attack vector, with 58% of all leaked credentials in 2024 being generic secrets like passwords and database connection strings. The BeyondTrust API key breach, used by Chinese state-sponsored hackers to infiltrate the U.S. Treasury Department, highlights the real-world consequences. We examine the limitations of existing security measures:
- GitHub’s Push Protection is a good start but only prevents specific patterns of API keys from being pushed, missing many secrets like database credentials and encryption keys.
- Private repositories are not inherently safe, being 8x more likely to contain secrets than public ones.
- While helpful, secrets management tools alone are not a complete solution, with 5.1% of repositories using them still leaking secrets.
- Threats extend beyond source code, with 38% of exposed credentials in collaboration tools like Slack and Jira being classified as highly critical.
The episode then focuses on how mobile developers can protect their apps with runtime secrets protection:
- Dynamic API Key Injection: Using a server-side mechanism to inject keys at runtime instead of hardcoding. Solutions like Approov use mobile app attestation to deliver keys only to trusted app instances.
- Mobile App Attestation: Verifying that API requests come from genuine, untampered app instances, preventing abuse from repackaged apps and bots.
- Dynamic Certificate Pinning: Ensuring apps automatically update to the latest certificate pins to block Man-in-the-Middle (MitM) attacks.
- Detecting and Blocking Rooted or Jailbroken Devices: Using RASP (Runtime Application Self-Protection) to detect and respond to unauthorised modifications.
- Monitoring and Revoking Compromised Secrets: Automating secret rotation and revocation, as 70% of valid secrets detected in 2022 were still active in 2024.
Key Takeaway: Your app's security is only as strong as its weakest secret. Protecting API keys at runtime is crucial. Links:
- The State of Secrets Sprawl 2025 Report (GitGuardian):
- Securing Mobile Apps Analyst Guide for Approov (Intellyx): https://intellyx.com/wp-content/uploads/2024/09/Securing-Mobile-Apps-Analyst-Guide-for-Approov-FINAL.pdf
- Approov Website: www.approov.io
Dive into the high-stakes world of mobile app development and API security with Upwardly Mobile, your ultimate guide to defending apps in today’s volatile digital landscape. Hosted by Skye Macintyre...
show more
Dive into the high-stakes world of mobile app development and API security with Upwardly Mobile, your ultimate guide to defending apps in today’s volatile digital landscape. Hosted by Skye Macintyre and George McGregor, and proudly sponsored by Approov, the leaders in mobile app attestation and API security, this podcast unpacks the evolving threats and innovative solutions shaping mobile security.Explore why the built-in protections from tech giants like Apple, Google, and Huawei often fall short, leaving sensitive data vulnerable. Learn how advanced techniques—like runtime attestation and dynamic API security—thwart attackers and secure your app ecosystem. Each episode delivers insights into major data breaches, emerging trends, and actionable strategies to fortify your apps and APIs against ever-advancing cyber threats.From development best practices to navigating compliance and regulation, Upwardly Mobile equips mobile developers, security professionals, and tech enthusiasts with the knowledge to safeguard their creations. Stay informed, stay secure, and stay ahead with expert guidance on the future of mobile cybersecurity.Subscribe now on Spotify and Apple Podcasts, and elevate your security game!
show less
Information
| Author | Approov Mobile Security |
| Organization | William Corbin |
| Categories | Technology , Tech News , Investing |
| Website | - |
| info@approov.io |
Copyright 2025 - Spreaker Inc. an iHeartMedia Company
