Resources
Blog
Articles from Otukan's engineers explaining mobile security decisions across app protection, device security and device management, each dated.
OWASP Mobile Top 10 and mobile fraud: where each risk bites
The OWASP Mobile Top 10 (2024) read through a fraud lens: which risks fraudsters exploit, what an app can see, and how Otukan maps each risk to a control.
- App protectionBetter mobile privacy: follow the data through every flow
Improve mobile app privacy by tracing each piece of data through a flow, using pickers and coarse values, cleaning diagnostics and testing changed choices.
- App protectionGDPR privacy by design for mobile apps, whoever codes them
What GDPR Article 25 means for a mobile app built in-house or by a supplier: who is responsible, which decisions it touches and what evidence to keep.
- App protectionMobile ad fraud prevention
How mobile ad fraud works, from click injection and SDK spoofing to device farms and reward farming, and where app signals help your backend decide.
- Fraud and identityAndroid accessibility malware
How malware abuses Android accessibility services to read screens and inject input, and how to protect sensitive flows without harming assistive users.
- Device securityAndroid bootloader integrity explained
How to evaluate Android bootloader integrity: verified boot states, what an unlocked bootloader proves, where to read it and how to respond in proportion.
- App protectionApp attestation vs device attestation
What app attestation and device attestation each prove, what neither tells you about the user, and how a backend should verify freshness and decide.
- App protectionApp shielding vs RASP
How app shielding and mobile RASP overlap and differ: definitions, a side-by-side comparison, when you need each and how Otukan combines the two.
- Developer workflowsAutomate mobile app security in CI/CD
How to automate mobile app security in CI/CD for Android and iOS: least-privilege identities, the order of protect, sign and test, and failure handling.
- Fraud and identityCamera injection vs deepfake detection
Why camera injection, liveness and deepfake detection solve different problems in mobile onboarding, who owns each layer and how to test them apart.
- App protectionData at rest encryption for mobile apps
How to evaluate data at rest encryption for mobile apps on Android and iOS: inventory the data, own the key lifecycle and know where plaintext still appears.
- Device securityFirmware integrity vs firmware security testing
Why firmware that verifies correctly can still be vulnerable, and how device makers combine pre-release testing with persistent integrity protection.
- Fraud and identityHow attackers use overlay attacks to commit mobile fraud
How overlay attacks steal credentials and approvals on Android, which screens they target, and how to tell abuse apart from assistive technology.
- Fleet managementMDM vs mobile device security
Why managing a device and detecting threats on it are different capabilities, how the two connect, and what to confirm before buying either one.
- Security researchMobile app penetration testing checklist
A penetration testing checklist for protected Android and iOS apps: choosing test environments, scoping exceptions safely and setting release criteria.
- Device securityOEM signing and update responsibilities
Who owns each signing key, in what order protection, signing and verification happen, and how device makers plan rotation, expiry and rollback.
- Fleet managementPlanning a managed device migration
How to plan a move between device management systems: which devices need a reset, who owns app, OS and backend tasks, and how to test in waves.
- App protectionProGuard vs mobile app shielding
What ProGuard and R8 do for an Android build, what name shortening leaves exposed, and when an app needs hardening and runtime checks on top.
- Fraud and identityProtect mobile apps against credential stuffing attacks
Where to stop credential stuffing against a mobile app: telling bots from real clients, splitting decisions across app, gateway and backend.
- Security researchRoot detection limitations
Why a root signal is uncertain alone, how to weigh it with server-side context in a per-flow decision, and how to test root detection without aiding evasion.
- Developer workflowsWhat is mobile DevSecOps
Mobile DevSecOps builds security into every stage of how an Android or iOS app is built, signed, released and monitored. Here is what changes for mobile.
Talk it through with our engineers
Tell us your platform, your app or device programme and the question the article raised for you. We do not ask for binaries, signing keys or production credentials.