Resources
Mobile security resources
Solution guides, technical how-tos, articles and definitions on mobile app security, device security and device management. Search or browse by topic.
Latest articles
All articles- Fraud and identityOWASP Mobile Top 10 and mobile fraud: where each risk bites
The OWASP Mobile Top 10 (2024) read through a fraud lens: which risks fraudsters exploit, what an app can see, and how Otukan maps each risk to a control.
- App protectionBetter mobile privacy: follow the data through every flow
Improve mobile app privacy by tracing each piece of data through a flow, using pickers and coarse values, cleaning diagnostics and testing changed choices.
- App protectionGDPR privacy by design for mobile apps, whoever codes them
What GDPR Article 25 means for a mobile app built in-house or by a supplier: who is responsible, which decisions it touches and what evidence to keep.
All resources
85 resources
- Technical guideAndroid biometric attributes implementation guide
Implement Android biometric checks with Class 3 keys, key attestation at registration, fresh server challenges, tested recovery and a minimal evidence record.
App security - ArticleBetter mobile privacy: follow the data through every flow
Improve mobile app privacy by tracing each piece of data through a flow, using pickers and coarse values, cleaning diagnostics and testing changed choices.
App security - ArticleGDPR privacy by design for mobile apps, whoever codes them
What GDPR Article 25 means for a mobile app built in-house or by a supplier: who is responsible, which decisions it touches and what evidence to keep.
App security - Technical guideHow to build a secure iOS and Android PWA with deep links
Make PWA deep links safe on Android and iOS: WebAPK and Trusted Web Activity link capture, Safari behaviour, manifest scope, launch_handler and route checks.
App security - Technical guideHow to configure Android kiosk mode
Configure Android kiosk mode with device-owner lock task, a persistent kiosk launcher, a tested allowlist and recovery tests for restarts and network outages.
Device management - Technical guideHow to control content in a PWA: secure uploads and secure downloads
Control PWA file transfers on the server: validate uploads, serve files from a separate origin with safe headers, keep them out of caches and test logout.
App security - Technical guideHow to detect modified Frida builds in iOS apps
Detect modified Frida builds in iOS apps with dyld image checks, inline-hook tests, thread, port and exception-port artefacts, and server-side App Attest.
App security - Technical guideHow to detect modified Frida builds on Android and iOS
Detect modified Frida builds on Android and iOS by checking what instrumentation does in the process, not its name: memory maps, threads, ports and hooks.
App security - Technical guideHow to detect repackaging in Android apps
Detect repackaged Android apps with signer, installer and Play Integrity checks, then test them against signed baselines and approved key rotations.
App security - Technical guideHow to detect unauthorised contacts access in mobile apps
Find out which code in your app reads contacts: Android data access auditing, iOS App Privacy Report, pickers instead of broad access, and lab tests.
App security - Technical guideHow to detect unauthorised microphone access in mobile apps
Detect unauthorised microphone use in your app with Android audit callbacks, recording configuration checks, privacy indicators and the App Privacy Report.
App security - Technical guideHow to handle runtime threat signals
Connect runtime threat signals to safe app behaviour: route them through one policy decision, respect the app lifecycle and enforce on the server.
App security - Technical guideHow to integrate device security signals
Integrate device security signals: verify origin with Android key attestation, check boot state and freshness, and test legitimate updates and adverse states.
Device security - Technical guideHow to prevent conflicts with iOS privacy manifests in iOS apps
Fix the Multiple commands produce PrivacyInfo.xcprivacy error, package SDK manifests in their own bundles and declare required-reason APIs before review.
App security - Technical guideHow to prevent mods and hacks that require re-signing iOS apps
Stop re-signed iOS app mods from reaching your service: App Attest on the server, Team ID and provisioning checks in the app, and tested signing changes.
App security - Technical guideHow to protect Android and iOS apps from keylogging malware
Protect typed secrets from keylogging: Android accessibility malware checks, sensitive views, keyboard flags, in-app PIN pads and iOS secure text entry.
App security - Technical guideHow to sign a protected Android app
Sign a protected Android release with the right key, tool and order: jarsigner for bundles, apksigner for APKs, page alignment, then verify what users install.
App security - Technical guideHow to test app shielding performance
Measure app protection overhead with matched builds, physical devices and repeatable workloads. Record startup, size, memory, stability and the spread of runs.
App security - Technical guideHow to verify mobile app attestation
Verify mobile app attestation on your backend: Play Integrity and App Attest checks, request binding, replay protection and outage handling.
App security - Technical guideiOS biometric attributes implementation guide
Implement Face ID and Touch ID on iOS with the right LAPolicy, a Secure Enclave key bound to the current biometric set and a server-signed challenge.
App security - Technical guideMake custom mobile SSO workflows work in mobile apps
Build custom mobile SSO on ASWebAuthenticationSession and Custom Tabs with verified App Links, PKCE and audience-checked tokens, then test renewal and logout.
App security - ArticleMobile ad fraud prevention
How mobile ad fraud works, from click injection and SDK spoofing to device farms and reward farming, and where app signals help your backend decide.
App security - Technical guideMobile certificate pinning rotation guide
Plan certificate pin rotation with overlapping keys, per-stack Android and iOS pin sets, stale-client tests and a recovery path that keeps TLS validation.
App security - Technical guideRuntime threat signals best practices: implementation guide
Design the runtime signal contract, bind client signals to Play Integrity or App Attest on the server, and keep telemetry lean and reviewable.
App security - ArticleOWASP Mobile Top 10 and mobile fraud: where each risk bites
The OWASP Mobile Top 10 (2024) read through a fraud lens: which risks fraudsters exploit, what an app can see, and how Otukan maps each risk to a control.
App security - ArticleAndroid accessibility malware
How malware abuses Android accessibility services to read screens and inject input, and how to protect sensitive flows without harming assistive users.
App security - ArticleAndroid bootloader integrity explained
How to evaluate Android bootloader integrity: verified boot states, what an unlocked bootloader proves, where to read it and how to respond in proportion.
App security - Solution guideAndroid root detection solution guide
How to evaluate Android root detection: separate root traces, boot state and device trust, test real manufacturers, then tie signal confidence to app behaviour.
App security - Solution guideAnti Frida solution guide
How to evaluate anti Frida protection on Android and iOS: separate injection from interception, tie detection to a sensitive flow and test with legitimate SDKs.
App security - Solution guideAnti reverse engineering solution guide
How to evaluate anti reverse engineering for mobile apps: name what an analyst gains, split app, OS and backend duties, then test your protected build yourself.
App security - Solution guideAnti spyware solution guide
How fraud and security teams evaluate in-app anti spyware: map the victim journey, separate app-visible signals from device scanning, then test fair responses.
App security - Solution guideAnti tampering solution guide
How to evaluate mobile anti tampering: define the integrity boundary, list every authorised build change, then map integrity events to app and backend actions.
App security - ArticleApp attestation vs device attestation
What app attestation and device attestation each prove, what neither tells you about the user, and how a backend should verify freshness and decide.
App security - ArticleApp shielding vs RASP
How app shielding and mobile RASP overlap and differ: definitions, a side-by-side comparison, when you need each and how Otukan combines the two.
App security - ArticleAutomate mobile app security in CI/CD
How to automate mobile app security in CI/CD for Android and iOS: least-privilege identities, the order of protect, sign and test, and failure handling.
App security - Solution guideBiometric flow protection solution guide
How to evaluate biometric flow protection in a mobile app: trace one approval to the server, split app, OS and backend duties, and test Android and iOS apart.
App security - ArticleCamera injection vs deepfake detection
Why camera injection, liveness and deepfake detection solve different problems in mobile onboarding, who owns each layer and how to test them apart.
App security - ArticleData at rest encryption for mobile apps
How to evaluate data at rest encryption for mobile apps on Android and iOS: inventory the data, own the key lifecycle and know where plaintext still appears.
App security - ArticleFirmware integrity vs firmware security testing
Why firmware that verifies correctly can still be vulnerable, and how device makers combine pre-release testing with persistent integrity protection.
Device security - Solution guideHooking and instrumentation detection solution guide
Evaluate hooking and instrumentation detection by mechanism, app flow and policy: test injection and interception on signed builds, validate before enforcing.
App security - ArticleHow attackers use overlay attacks to commit mobile fraud
How overlay attacks steal credentials and approvals on Android, which screens they target, and how to tell abuse apart from assistive technology.
App security - Solution guideiOS jailbreak detection solution guide
How to evaluate iOS jailbreak detection: bound what the signal proves, test named evasion scenarios on signed builds and real iPhones, and keep recovery fair.
App security - Solution guideLocation integrity and geofencing solution guide
How to evaluate location integrity and geofencing for Android and iOS apps: separate signal sources, set decisions per flow and protect user privacy.
App security - Solution guideMalware detection solution guide
How to evaluate mobile malware detection: map attacker behaviour to app-visible signals, know where app-level detection ends and test fair responses.
App security - Solution guideMan-in-the-middle prevention solution guide
How to evaluate man-in-the-middle prevention for mobile apps: define the trust boundary, plan certificate rotation and test failure handling first.
App security - Solution guideManaged app integration solution guide
How to evaluate managed app integration on Android and iOS: draw the protection and management boundary, list dependencies and test offboarding.
App security - Solution guideMDM requirements checklist
The fleet requirements to agree before comparing MDM options: platforms and ownership, mandatory and optional workflows, and supplier and migration duties.
Device management - ArticleMDM vs mobile device security
Why managing a device and detecting threats on it are different capabilities, how the two connect, and what to confirm before buying either one.
Device management - Solution guideMemory protection solution guide
How to evaluate mobile app memory protection: find exposed values, map their plaintext lifetime and validate protection apart from storage encryption.
App security - Solution guideMigration and adoption
How to evaluate a move to Otukan app protection: map every protected flow, split app, OS and backend duties, and prove the switch on a staged release.
App security - Solution guideMobile account takeover prevention guide
A workshop guide for app, identity and fraud teams: map login, recovery and transactions, assign each takeover control, then test attacks and real customers.
App security - Solution guideMobile anti-cheat solution guide
How to evaluate mobile anti-cheat for Android and iOS games: map client exposure, keep authority on your servers and protect honest players' experience.
App security - ArticleMobile app penetration testing checklist
A penetration testing checklist for protected Android and iOS apps: choosing test environments, scoping exceptions safely and setting release criteria.
App security - Solution guideMobile app security evaluation
How to compare mobile app protection options on threats, integration, performance and lifecycle, which evidence settles each one, and how to discuss fit.
App security - Solution guideMobile app security evaluation checklist
What to check before selecting mobile app protection: define your app and threats, request per-platform evidence, see how Otukan answers, record the decision.
App security - Solution guideMobile bot detection solution guide
How to evaluate mobile bot detection: separate scripted clients from real users and approved automation, place each decision, and test rate and retry policy.
App security - Solution guideMobile code obfuscation guide
Evaluate code obfuscation on your own app: list what needs hiding, compare a baseline and a protected build side by side, then judge the cost to engineers.
App security - Solution guideMobile DevSecOps implementation guide
Plan an app protection rollout with your release team: pilot on representative builds, map who owns keys, policy, tests and signing, roll out with a way back.
App security - Solution guideMobile SSO integration solution guide
How to evaluate mobile SSO integration: separate federation, tokens and transport access, assign identity, app and MDM duties, and test the session lifecycle.
App security - Solution guideOEM device security evaluation guide
A repeatable way for an OEM to evaluate device security: define the programme per model, require evidence on keys and trust boundaries, and scope upkeep.
Device security - ArticleOEM signing and update responsibilities
Who owns each signing key, in what order protection, signing and verification happen, and how device makers plan rotation, expiry and rollback.
App security - Solution guideOn-device fraud solution guide
How to evaluate on-device fraud protection: map the victim journey to app-visible signals, know where app signals end, and test proportionate responses first.
App security - Solution guideOWASP MASVS mobile app security
Which Otukan controls support an OWASP MASVS review, mainly resilience, how to map them to the MASVS version you use, and why a mapping is not certification.
App security - ArticlePlanning a managed device migration
How to plan a move between device management systems: which devices need a reset, who owns app, OS and backend tasks, and how to test in waves.
App security - Solution guideProgressive web app protection solution guide
Evaluate progressive web app protection: map browser, web content and native wrapper, find the layer each control reaches, and test release and origin rules.
App security - ArticleProGuard vs mobile app shielding
What ProGuard and R8 do for an Android build, what name shortening leaves exposed, and when an app needs hardening and runtime checks on top.
App security - ArticleProtect mobile apps against credential stuffing attacks
Where to stop credential stuffing against a mobile app: telling bots from real clients, splitting decisions across app, gateway and backend.
App security - Solution guideProxy and VPN risk detection solution guide
Evaluate proxy and VPN risk detection: tell hostile interception from approved networks, plan certificate changes and set failure handling before enforcing.
App security - ArticleRoot detection limitations
Why a root signal is uncertain alone, how to weigh it with server-side context in a per-flow decision, and how to test root detection without aiding evasion.
App security - Solution guideRuntime threat signals solution guide
Evaluate runtime threat signals as a data contract and a process: fields, timestamps, severity, the triage path, and how detections stay apart from incidents.
App security - Solution guideSDK protection solution guide
How to evaluate SDK protection: split native, managed, embedded SDK and asset layers, check toolchain and update fit, test symbols, start-up and dependencies.
App security - Solution guideSecrets and key protection solution guide
How to evaluate secrets and key protection for Android and iOS apps: inventory what ships, assign the key lifecycle and test what runtime protection adds.
App security - Solution guideSecurity validation
How to evaluate security validation for a protected mobile app: choose test devices, scope exceptions safely and set release criteria from expected signals.
App security - Solution guideSocial engineering protection solution guide
How fraud and security teams evaluate social engineering protection in mobile apps: the scam signal contract, the friction workflow and how cases are recorded.
App security - Solution guideThreat analytics solution guide
How security teams evaluate mobile threat analytics: the runtime signal schema, triage and release workflows, and keeping detections and incidents apart.
App security - DefinitionWhat is app attestation
App attestation lets your server confirm a request comes from your genuine app. What the evidence proves, how to verify it and how it behaves on reinstall.
App security - DefinitionWhat is app shielding
App shielding builds resistance to analysis, tampering and runtime attack into a mobile app. Where it sits, who does what and how to evaluate it.
App security - DefinitionWhat is code obfuscation
Code obfuscation makes an app's compiled code hard to read without changing behaviour. What it reaches per language, what it can break and how to validate it.
App security - DefinitionWhat is device binding
Device binding ties an account or session to one app installation via a key that stays on the device: what it proves, how it is verified and its lifecycle.
App security - DefinitionWhat is firmware integrity
Firmware integrity means a device boots only the approved, unaltered build. How it works on Android and iOS, who is responsible and how to evaluate it.
App security - DefinitionWhat is mobile application management
Mobile application management controls business apps and their data without managing the device: how it differs from app protection and MDM, and how to run it.
App security - DefinitionWhat is mobile device management
Mobile device management enrols, configures and controls work phones and tablets. What it covers, how to evaluate it and how Otukan applies it to your fleet.
Device management - ArticleWhat is mobile DevSecOps
Mobile DevSecOps builds security into every stage of how an Android or iOS app is built, signed, released and monitored. Here is what changes for mobile.
App security - DefinitionWhat is mobile threat defense
Mobile threat defense detects attacks on phones, apps and connections. How it works on Android and iOS, what to evaluate and how Otukan builds it into apps.
App security - DefinitionWhat is runtime application self-protection
RASP is security logic inside an app that reacts when its execution is watched or altered. How it works on Android and iOS, and how to evaluate it.
App security
Nothing matches yet. Ask our engineers directly
For enterprise teams
Need more depth than a guide?
Guides cover the general case. Our engineers can go through yours: your platforms, your threat model and how Otukan fits your release or device programme.
- A technical conversation with the engineers who build the product
- Answers for your platforms and architecture, not generic material
- A technical demo on request
We do not ask for binaries, signing keys or production credentials.