Anyone can run a modified copy of an app on their own device or upload a backdoored one to a third-party store. Anti-tampering checks raise the cost, but the server must not trust a client that says it is unmodified.
- Verify app integrity on the server with App Attest assertions or Play Integrity's app recognition verdict.
- Bind attestation to the request it protects, with a hash of the request or a server challenge.
- Treat client-side tamper checks as cost-raising only.
MASTG tests in the local projects
Neither local project runs a MASTG test for MASVS-RESILIENCE-2. The guides below explain the platform mechanisms, and the control’s page on mas.owasp.org links the MASTG tests and weaknesses OWASP maps to it.
Guides on this site
Harden an iOS app's storage, network and entry points
Store secrets in the Keychain with the narrowest accessibility class, set file protection explicitly, keep App Transport Security on, prefer universal links, constrain WKWebView bridges, keep step-up keys in the Secure Enclave, verify App Attest on the server and ship an accurate privacy manifest, mapped to OWASP MASVS 2.1.
Harden an Android app's storage, network and entry points
Encrypt local secrets with Android Keystore keys now that Jetpack Security is deprecated, set transport policy in Network Security Configuration, close exported components and mutable PendingIntents, confine WebViews, verify App Links and judge Play Integrity verdicts on the server, mapped to OWASP MASVS 2.1.
Practice
- Keep an iOS app's storage, links and web bridge in bounds · Local project
- Repair an Android app's links, components, network policy and storage · Local project
References
- MASVS-RESILIENCE-2 (OWASP MASVS v2.1.0)
- MASVS-RESILIENCE: Resilience Against Reverse Engineering and Tampering (OWASP MASVS v2.1.0)
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
Control statements are quoted from OWASP MASVS v2.1.0, licensed CC BY-SA 4.0; the rest is this site's summary. MASTG tests are those the iOS and Android projects here run, with their titles from mas.owasp.org. License.