Glossary
Mobile app security glossary
Short, plain definitions of the terms that come up when securing mobile apps against fraud, from RASP and app shielding to Frida, device binding, hardware attestation and cloned apps.
Mobile security terms, explained
App Attest
Apple's mechanism for an app to prove, with a Secure Enclave key, that it is the genuine app on a genuine device.
App repackaging
Modifying an app and redistributing it, often signed with a different key, to steal data or defraud users.
App shielding
Hardening an app before release, mainly through obfuscation and anti-tamper, to make reverse engineering harder.
Certificate pinning
Making an app accept only specific server certificates or keys, to defeat man-in-the-middle interception.
Cloned app
A copy of an app run outside its normal installation, for example in a parallel-space app or as a repackaged build.
Code obfuscation
Renaming and restructuring code so that it is hard for a person to read or analyse, without changing what it does.
Device binding
Tying a customer's account or app to a specific device so credentials cannot quietly move to another handset.
Device fingerprinting
Combining many device and browser signals into a stable identity used to recognise a returning device and spot farms.
Dynamic instrumentation
Inspecting or changing a program while it runs, using tools such as Frida. Used by researchers and by fraudsters.
Emulator detection
Checking whether an app is running on a virtual device rather than a real phone, used to catch bots and automated attacks.
Evidence chain
Records linked by hashes and signed so that altering or deleting any entry is detectable.
Frida
A dynamic instrumentation toolkit that injects scripts into a running app to inspect or change its behaviour.
Hardware attestation
Proof, backed by a key in secure hardware, that a request comes from a genuine device and an unmodified app.
Hooking
Intercepting and replacing a function while an app runs, so its behaviour can be altered or its checks bypassed.
Jailbreak detection
The iOS equivalent of root detection: checking whether the device's system restrictions have been removed.
Magisk
A widely used Android rooting tool whose modules can hide root from selected apps.
Man-in-the-middle (MITM)
An attacker sitting between the app and the server to read or change traffic. Certificate pinning and proxy detection counter it.
MASVS
OWASP's Mobile Application Security Verification Standard: a set of security requirements for mobile apps.
Overlay attack
Drawing a fake screen or invisible layer over a real app to capture taps or credentials.
Play Integrity API
A Google service that returns verdicts about whether an app and device appear genuine. Useful as one signal, not a complete answer.
RASP
Runtime application self-protection: security built into an app that detects and responds to attacks while the app runs.
Replay attack
Capturing a valid request or token and sending it again to repeat an action. Binding a nonce to each request defeats it.
Root detection
Checking whether an Android device has been rooted, giving an attacker system-level control.
Secure Enclave
Apple's secure hardware coprocessor that generates and protects keys so they cannot be read or exported.
Signal injection
Feeding forged device or sensor data to a security SDK so a compromised device looks clean.
SIM binding
Tying an app or account to the SIM registered to the customer, so it only works on the handset holding that SIM.
StrongBox
Android's dedicated secure hardware for storing keys, offering stronger isolation than a standard TEE where available.
Tap-jacking
Tricking a user into tapping something other than what they see, usually by placing a transparent window over an app.
TEE (trusted execution environment)
An isolated area of a phone's processor where sensitive operations and keys are kept apart from the main operating system.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.