Mobile Security Explained — A Beginner's Guide to Securing Mobile Apps

# android_intent_security.py — Secure intent handling on Android
class SecureIntentHandler:
    """Demonstrates secure intent handling on Android."""

    @staticmethod
    def verify_intent_source(intent_action: str, calling_package: str,
                             trusted_packages: list[str]) -> bool:
        """Verify that an intent comes from a trusted source."""
        if calling_package not in trusted_packages:
            print(f"WARNING: Intent from untrusted package: {calling_package}")
            return False

        allowed_actions = {
            "trusted_app": ["ACTION_SEND", "ACTION_VIEW"],
            "system": ["ACTION_BOOT_COMPLETED", "ACTION_PACKAGE_INSTALL"]
        }

        # Check action is allowed for this package
        for package_group, actions in allowed_actions.items():
            if calling_package in trusted_packages:
                if intent_action not in actions:
                    print(f"WARNING: Action {intent_action} not allowed for {calling_package}")
                    return False

        return True

    @staticmethod
    def export_receiver_check(exported: bool, permissions: list[str]) -> str:
        """Check if a broadcast receiver is securely configured."""
        if exported and not permissions:
            return ("HIGH: Receiver is exported with no permissions — "
                    "any app can send intents to it")
        elif exported and permissions:
            return "OK: Exported with required permissions"
        else:
            return "OK: Not exported (internal use only)"

# secure_storage.py — Secure data storage on mobile
import hashlib
import os
import json

class MobileSecureStorage:
    """Demonstrates secure data storage patterns for mobile apps."""

    @staticmethod
    def ios_keychain_equivalent(service_name: str) -> dict:
        """
        Simulates iOS Keychain (real implementation uses Security framework).
        On iOS: use Keychain Services API
        On Android: use EncryptedSharedPreferences
        """
        return {
            "platform": "iOS",
            "api": "Keychain Services",
            "encryption": "AES-256-GCM",
            "access_control": "kSecAttrAccessibleWhenUnlockedThisDeviceOnly",
            "note": "Data encrypted at rest, accessible only when device is unlocked"
        }

    @staticmethod
    def android_encrypted_prefs(store_name: str) -> dict:
        """
        Simulates Android EncryptedSharedPreferences.
        """
        return {
            "platform": "Android",
            "api": "EncryptedSharedPreferences",
            "encryption": "AES-256-GCM (keys in Android Keystore)",
            "note": "Data encrypted with master key stored in hardware-backed Keystore"
        }

    @staticmethod
    def insecure_patterns() -> list[dict]:
        """Common insecure storage patterns to avoid."""
        return [
            {"storage": "SharedPreferences (plain)", "risk": "HIGH",
             "fix": "Use EncryptedSharedPreferences"},
            {"storage": "NSUserDefaults (iOS)", "risk": "HIGH",
             "fix": "Use Keychain for sensitive data"},
            {"storage": "SQLite database (unencrypted)", "risk": "HIGH",
             "fix": "Use SQLCipher or Room with encryption"},
            {"storage": "Local files in app data dir", "risk": "MEDIUM",
             "fix": "Encrypt files with device key"},
            {"storage": "NSURLCache (iOS)", "risk": "MEDIUM",
             "fix": "Clear cache after sensitive transactions"},
        ]

    @staticmethod
    def check_sensitive_data(data_type: str) -> str:
        """Check if a data type should be stored on device."""
        never_store = [
            "password", "credit_card_number", "cvv", "pin_code",
            "private_key", "seed_phrase", "auth_token_plaintext"
        ]
        secure_storage_ok = [
            "auth_token", "refresh_token", "session_id",
            "user_preferences", "app_settings"
        ]
        if data_type in never_store:
            return f"CRITICAL: Never store {data_type} on device"
        elif data_type in secure_storage_ok:
            return f"OK: Can store {data_type} with encrypted storage"
        return f"REVIEW: Check if {data_type} needs to be stored"

# Example
storage = MobileSecureStorage()
for pattern in storage.insecure_patterns():
    print(f"[{pattern['risk']}] {pattern['storage']}")
    print(f"  Fix: {pattern['fix']}")

# network_security_mobile.py — Mobile network security best practices

class MobileNetworkSecurity:
    """Network security best practices for mobile apps."""

    @staticmethod
    def certificate_pinning_config() -> dict:
        """SSL/TLS certificate pinning configuration."""
        return {
            "android": {
                "config_file": "res/xml/network_security_config.xml",
                "pinning": 'pin-set with SHA-256 hashes of expected certs',
                "example": """
                <domain-config>
                    <domain includeSubdomains="true">api.dodatech.com</domain>
                    <pin-set>
                        <pin digest="SHA-256">base64hash1=</pin>
                        <pin digest="SHA-256">base64hash2=</pin>
                    </pin-set>
                </domain-config>
                """
            },
            "ios": {
                "api": "TrustKit or URLSession delegate",
                "pinning": "Public key pinning or certificate pinning",
                "note": "Pin at least 2 keys (primary + backup for key rotation)"
            }
        }

    @staticmethod
    def check_tls_version(version: str) -> str:
        """Check TLS version for security."""
        secure_versions = ["TLS 1.3", "TLS 1.2"]
        if version in secure_versions:
            return f"OK: {version} is secure"
        return f"FAIL: {version} is deprecated — use TLS 1.2+"

    @staticmethod
    def common_mistakes() -> list[str]:
        """Common mobile network security mistakes."""
        return [
            "Allowing all SSL certificates (trusting all CAs)",
            "Not implementing certificate pinning",
            "Using HTTP instead of HTTPS",
            "Ignoring TLS version (allowing SSLv3, TLS 1.0)",
            "Sending sensitive data in URL query parameters",
            "Not validating hostname against certificate",
            "Cleartext traffic in WebView"
        ]

# mobile_auth.py — Mobile authentication best practices

class MobileAuthSecurity:
    """Authentication security patterns for mobile apps."""

    @staticmethod
    def biometric_auth_config() -> dict:
        """
        Biometric authentication configuration.
        iOS: LocalAuthentication framework (FaceID/TouchID)
        Android: BiometricPrompt API
        """
        return {
            "android": {
                "api": "BiometricPrompt",
                "security_class": "BIOMETRIC_STRONG",
                "fallback": "Device credentials (PIN/pattern/password)",
                "note": "Never use BIOMETRIC_WEAK for sensitive operations"
            },
            "ios": {
                "api": "LocalAuthentication",
                "policy": "deviceOwnerAuthenticationWithBiometrics",
                "fallback": "deviceOwnerAuthentication (with passcode)",
                "note": "EvaluatePolicy with custom fallback title"
            },
            "best_practices": [
                "Biometric for convenience, not sole authentication",
                "Require primary auth (password) periodically",
                "Biometric check MUST happen server-side for transactions",
                "Clear biometric data on app uninstall",
                "Fallback to PIN/pattern can't be skipped"
            ]
        }

    @staticmethod
    def token_storage() -> dict:
        """Secure token storage patterns."""
        return {
            "access_token": {
                "storage": "Memory (variable)",
                "duration": "Short-lived (15-60 minutes)",
                "refresh": "Use refresh token for renewal"
            },
            "refresh_token": {
                "storage_ios": "Keychain with kSecAttrAccessibleAfterFirstUnlock",
                "storage_android": "EncryptedSharedPreferences",
                "duration": "Longer-lived (days-weeks)",
                "rotation": "Rotate on each use (token rotation)"
            },
            "never_store": [
                "Plaintext passwords",
                "Credit card numbers",
                "SSN or government IDs"
            ]
        }

# mobile_crypto.py — Mobile cryptography best practices

class MobileCryptoBestPractices:
    """Cryptography best practices for mobile apps."""

    @staticmethod
    def android_keystore() -> dict:
        """Android Keystore system usage."""
        return {
            "api": "Android Keystore (hardware-backed on supported devices)",
            "algorithms": {
                "encryption": "AES/GCM/NoPadding (256-bit)",
                "signing": "ECDSA (P-256) or RSA (2048+)",
                "key_agreement": "ECDH"
            },
            "key_protection": [
                "Key material never enters app process",
                "Requires user authentication for key use",
                "Keys can be bound to biometric authentication",
                "Keys invalidated on device root/unlock"
            ]
        }

    @staticmethod
    def ios_crypto() -> dict:
        """iOS CommonCrypto / CryptoKit usage."""
        return {
            "api": "CryptoKit (Swift) or CommonCrypto (Objective-C)",
            "algorithms": {
                "encryption": "AES-GCM (preferred) or ChaChaPoly",
                "hashing": "SHA-256 (minimum), SHA-384/512 for high security",
                "key_derivation": "HKDF (preferred) or PBKDF2"
            },
            "secure_enclave": {
                "available": "iPhone 5s+",
                "features": "Hardware key storage, TouchID/FaceID binding"
            }
        }

    @staticmethod
    def forbidden_patterns() -> list[str]:
        """Cryptography patterns that are NEVER acceptable."""
        return [
            "MD5 or SHA-1 for hashing",
            "ECB mode for encryption",
            "Hardcoded encryption keys in source code",
            "Custom encryption algorithms",
            "Base64 as encryption (it's encoding, not encryption)",
            "Using the same key for encryption and authentication",
            "Static IV/nonce values",
            "Weak PBKDF2 iterations (< 10000)"
        ]

# mobile_security_checklist.py
# Audit mobile app security readiness

class MobileSecurityAudit:
    """Comprehensive mobile security checklist."""

    CHECKS = {
        "storage": [
            "No sensitive data in SharedPreferences/NSUserDefaults",
            "Encrypted storage used for tokens",
            "No credit card/PII stored on device",
            "Cache cleared after logout",
        ],
        "network": [
            "HTTPS only (ATS enabled on iOS)",
            "Certificate pinning implemented",
            "No cleartext traffic in WebView",
            "TLS 1.2+ enforced",
        ],
        "authentication": [
            "Biometric with crypto-backed keys",
            "Short-lived access tokens",
            "Token rotation on refresh",
            "Server-side authorization checks",
        ],
        "code_quality": [
            "ProGuard/R8 enabled (Android)",
            "Debug logs stripped from release",
            "No hardcoded secrets in code",
            "Input validation on all entry points",
        ],
        "platform": [
            "Jailbreak/root detection",
            "Runtime integrity checks (SafetyNet/DeviceCheck)",
            "App transport security enforced",
            "Screen capture blocked for sensitive screens",
        ]
    }

    def run(self, answers: dict[str, bool]) -> dict:
        """Run the audit checklist."""
        results = {}
        total = 0
        passed = 0
        for category, checks in self.CHECKS.items():
            cat_results = []
            for check in checks:
                total += 1
                key = check.lower().replace(" ", "_").replace("/", "_")
                status = answers.get(key, False)
                cat_results.append({"check": check, "status": "PASS" if status else "FAIL"})
                if status:
                    passed += 1
            results[category] = cat_results

        results["overall"] = {
            "passed": passed,
            "total": total,
            "percentage": round(passed / total * 100, 1)
        }
        return results

# Example
audit = MobileSecurityAudit()
# Simulate some answers
answers_local = {
    "no_sensitive_data_in_sharedpreferences_nsuserdefaults": True,
    "encrypted_storage_used_for_tokens": True,
    "no_credit_card_pii_stored_on_device": True,
    "cache_cleared_after_logout": False,
    "https_only_(ats_enabled_on_ios)": True,
    "certificate_pinning_implemented": False,
}
results = audit.run(answers_local)
print(f"Mobile Security Score: {results['overall']['percentage']}%")
print(f"  Passed: {results['overall']['passed']}/{results['overall']['total']}")