--- title: "Mobile Platform Security — Android, iOS, macOS · VORNAC Research" description: "Per-platform attack surface and skills reference: Android permission model and APK static/dynamic attacks, iOS entitlement reasoning, macOS TCC and codesign." url: https://www.vornac.com/en/research/application-identity/mobile-platform-security lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/application-identity/mobile-platform-security --- [Research Index](https://www.vornac.com/en/research) / [2 · Application & Identity Security](https://www.vornac.com/en/research/application-identity) / Mobile Platform Security — Android, iOS, macOS Background · [2 Application & Identity Security](https://www.vornac.com/en/research/application-identity) # Mobile Platform Security — Android, iOS, macOS. Per-platform attack surface and skills reference: Android permission model and APK static/dynamic attacks, iOS entitlement reasoning, macOS TCC and codesign. ## Android — attack surface review - **APK unpacking.** `apktool d app.apk` for resources + smali; `jadx-gui app.apk` for decompiled Java. Read `AndroidManifest.xml` first — exported activities, services, providers, receivers are entry points. - **Permission model.** Dangerous permissions (CAMERA, LOCATION, READ\_SMS) need runtime grant on API 23+. Look for `checkSelfPermission` + early-return logic; missing checks = bypass. - **Exported components.** `android:exported="true"` without intent-filter permission = callable from any installed app. `drozer console connect`, `run app.activity.start --component pkg cls`. - **Insecure deep links.** Custom scheme + WebView `loadUrl` on intent extras = local file read or arbitrary URL load. Check for `file://` handling. - **Network security config.** `res/xml/network_security_config.xml` — `cleartextTrafficPermitted`, custom trust anchors, certificate pinning. Defender's first hardening. - **SSL pinning bypass.** Frida script `frida -U -l ssl-pinning-bypass.js -f pkg` or `objection -g pkg explore` → `android sslpinning disable`. - **Root detection bypass.** Same Frida toolchain — hook `RootBeer`, `SafetyNet`, or per-app heuristics. ## Android — defense in apps - **R8/ProGuard with custom rules.** Default rules don't shrink — symbolic info still leaks. Custom `-keep` + `-renamesourcefileattribute`. - **Integrity checks.** Multi-source verification: signature check + native-code anchor + remote attestation (Play Integrity API). - **Secrets in code.** Don't. `EncryptedSharedPreferences` + KeyStore-backed key for anything that must persist on device. - **WebView hardening.** `setJavaScriptEnabled(false)` unless required; `setAllowFileAccess(false)`; `setAllowUniversalAccessFromFileURLs(false)`. ## Android — forensic acquisition modes - **Logical pull (ADB backup).** `adb backup -all -shared -system`. Limited to what backups expose; many apps mark themselves unbackup. - **File-system pull (rooted).** `adb shell su -c 'tar -czf /sdcard/full.tgz /data/data /data/system'`. Comprehensive but invasive — root may not survive next boot. - **Physical (EDL/JTAG).** Chipset-specific. Qualcomm Emergency Download Mode → firehose loader → full eMMC dump. - **Chip-off.** Desolder eMMC, read in standalone reader. Destructive; device cannot be reassembled into evidence chain easily. ## iOS - **Entitlement model.** `codesign -d --entitlements - /path/to/app` dumps entitlements. Anything beyond the standard set is a question to ask. - **Sandbox.** Apps confined to container; access to other-app data requires entitlement, App Groups, or shared keychain group. - **Runtime instrumentation.** `frida -U -n AppName` on a jailbroken device. Without JB: re-sign IPA with Frida gadget embedded, install via TrollStore/AltStore. - **Static analysis.** `otool -L` for linked frameworks; `class-dump` for Obj-C runtime classes; Hopper for Swift/Obj-C disassembly. - **App-clip / URL scheme abuse.** Universal Links with weak Apple-App-Site-Association can be hijacked. ## macOS - **TCC.** Transparency, Consent, Control. Access to Camera, Microphone, Documents, Desktop requires user-prompted grant. TCC.db at `~/Library/Application Support/com.apple.TCC/TCC.db`. Bypass via `tccd` hijack on un-SIP'd systems. - **Codesign mechanics.** `codesign --verify --verbose /path`; `spctl -a -v /path` for Gatekeeper assessment. Notarization required for distribution outside MAS since 10.15. - **Persistence locations.** LaunchAgents (`~/Library/LaunchAgents`, `/Library/LaunchAgents`), LaunchDaemons (`/Library/LaunchDaemons`), Login Items, cron, periodic. - **EndpointSecurity framework.** Modern macOS EDR hooks here for process exec, file open, fork events. Successor to deprecated kauth/kext. **Rule of thumb**On mobile, the attacker's biggest lever is usually a single missing check on an exported component or a single hardcoded secret. The 80/20 of mobile review is reading the manifest carefully and grep-ing the decompiled source for keys, tokens, and URLs. Domain [2 · Application & Identity Security](https://www.vornac.com/en/research/application-identity) Tier Background Engagement phases No specific phase Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Common Web Vulnerabilities](https://www.vornac.com/en/research/application-identity/common-web-vulnerabilities) - [Featured Web Attack & Defense — Canonical Reference](https://www.vornac.com/en/research/application-identity/web-attack-defense-canon) - [Featured XSS — Comprehensive Reference](https://www.vornac.com/en/research/application-identity/xss-comprehensive) - [Featured Injection, SSRF & XXE](https://www.vornac.com/en/research/application-identity/injection-and-traversal) - [Featured Authentication, Logic & Architecture Flaws](https://www.vornac.com/en/research/application-identity/authentication-and-logic) - [Reference Server-Side Language Audits — Java, PHP, SQLmap](https://www.vornac.com/en/research/application-identity/server-side-language-audits) [Previous note Server-Side Language Audits — Java, PHP, SQLmap](https://www.vornac.com/en/research/application-identity/server-side-language-audits) [Back to domain](https://www.vornac.com/en/research/application-identity) From reference to evidence ## Run this against your own environment.