525,600 assessments later - top mobile app risks

Mobile apps are used everywhere, yet many organizations assume someone else has tested the ones they build or rely on. The speaker explains why mobile is harder to assess than web software: platform restrictions limit visibility into the operating system and file system, apps bundle full browser components and many third-party SDKs, and the underlying frameworks change every year. Together these make traditional web testing and static code review miss much of the risk.

Drawing on automated static and dynamic assessments of publicly available iOS and Android apps, the talk walks through recurring findings. Debug symbols appear in a large share of apps and can expose developer names, command infrastructure and original project names, a pattern seen in real malware. Outdated or weak cryptography, hardcoded keys and misconfigured networking are common, and some widely distributed advertising and analytics SDKs carry known vulnerabilities or collect data the app never discloses. Privacy gaps stand out too: many apps omit required purpose strings, and some ad-bidding protocols allow data to move without HTTPS. Newer findings cover AI service keys embedded in apps.

The main takeaway is to inventory the apps an organization builds and uses, classify them by sensitivity, and scan them with open-source tools such as MobSF and Frida-based analysis. The speaker recommends the OWASP MASVS as a baseline and treats mobile app vetting as a continuous process tied to development pipelines and device management, since apps and SDKs change often.