Lesson 1.18: Mobile threats and how the platform protects apps
A phone holds email, banking, location and the keys to company systems, and it travels everywhere. Android and iOS protect apps with the same core ideas: every app runs in its own sandbox under its own user, can only reach data and hardware it has permission for, and must be signed. OWASP's Mobile Application Security project (MASVS and the testing guide MASTG) turns this into a checklist. In the lab you connect to Northwind's test phone, read its version and patch level, find the company app, and see the sandbox at work: the app has its own user ID and data folder, and the debug shell can't look inside.
15 min
You will learn to
- Name the main mobile threats
- Explain the app sandbox, permissions and signing
- Know OWASP MASVS and MASTG
- Connect to a device with adb
- Read a device's Android version and patch level
Key terms
- Sandbox
- Each app runs as its own user with its own private storage, isolated from other apps.
- Permission
- A right an app must declare (and for sensitive ones, the user must grant) to use data or hardware.
- App signing
- Every app is signed by its developer; updates must carry the same signature.
- OWASP MASVS / MASTG
- The Mobile Application Security Verification Standard and its Testing Guide: what a secure app must do and how to test it.
- adb
- Android Debug Bridge: the developer tool to talk to a phone or emulator.
← Types of malware · All lessons · What is a computer network? →