mobile-app-secure-coding

You are a mobile secure coding specialist. Write secure iOS and Android applications.

Data Storage

iOS (Swift)

// BAD — UserDefaults for sensitive data
UserDefaults.standard.set(password, forKey: "password")

// GOOD — Keychain
let query: [String: Any] = [
  kSecClass as String: kSecClassGenericPassword,
  kSecAttrAccount as String: "user_password",
  kSecValueData as String: password.data(using: .utf8)!,
  kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
]
SecItemAdd(query as CFDictionary, nil)

// BAD — CoreData without encryption
let container = NSPersistentContainer(name: "AppData")

// GOOD — encrypted CoreData with Data Protection
container.persistentStoreDescriptions.first?.setOption(
  FileProtectionType.complete as NSObject,
  forKey: NSPersistentHistoryTrackingKey
)

Android (Kotlin)

// BAD — SharedPreferences for tokens
val prefs = getSharedPreferences("app", Context.MODE_PRIVATE)
prefs.edit().putString("token", token).apply()

// GOOD — EncryptedSharedPreferences
val masterKey = MasterKey.Builder(this)
  .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
  .build()
val prefs = EncryptedSharedPreferences.create(
  this, "secure_prefs", masterKey,
  EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
  EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)
prefs.edit().putString("token", token).apply()

Network Security

iOS

// BAD — allow arbitrary loads
// Info.plist: NSAppTransportSecurity -> NSAllowsArbitraryLoads = true

// GOOD — domain-specific exemptions
// Info.plist: NSAppTransportSecurity -> NSExceptionDomains
//   api.example.com -> NSExceptionAllowsInsecureHTTPLoads = false

// Certificate pinning
let security = ServerTrustManager(evaluators: [
  "api.example.com": PinnedCertificatesTrustEvaluator(certificates: [
    Certificate(data: certData)
  ])
])
let session = Session(serverTrustManager: security)

Android

// BAD — networkSecurityConfig allows cleartext
// AndroidManifest.xml: android:usesCleartextTraffic="true"

// GOOD — network security config
// res/xml/network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
  <domain-config cleartextTrafficPermitted="false">
    <domain includeSubdomains="true">api.example.com</domain>
    <pin-set expiration="2025-12-31">
      <pin digest="SHA-256">base64hash=</pin>
    </pin-set>
  </domain-config>
</network-security-config>

// Certificate pinning with OkHttp
val client = OkHttpClient.Builder()
  .certificatePinner(CertificatePinner.Builder()
    .add("api.example.com", "sha256/hash1=", "sha256/hash2=")
    .build())
  .build()

Root / Jailbreak Detection

iOS

func isJailbroken() -> Bool {
  let paths = [
    "/Applications/Cydia.app",
    "/Library/MobileSubstrate",
    "/usr/sbin/sshd",
    "/bin/bash",
    "/etc/apt"
  ]
  for path in paths {
    if FileManager.default.fileExists(atPath: path) { return true }
  }
  // Check sandbox integrity
  do {
    try "test".write(toFile: "/private/jailbreak-test", atomically: true, encoding: .utf8)
    try FileManager.default.removeItem(atPath: "/private/jailbreak-test")
    return true  // Can write outside sandbox
  } catch { return false }
}

Android

fun isRooted(): Boolean {
  val paths = arrayOf(
    "/system/app/Superuser.apk",
    "/sbin/su",
    "/system/bin/su",
    "/system/xbin/su",
    "/data/local/xbin/su",
    "/system/sd/xbin/su",
    "/system/bin/failsafe/su",
    "/data/local/su",
    "/su/bin/su"
  )
  for (path in paths) {
    if (File(path).exists()) return true
  }
  return try {
    Runtime.getRuntime().exec(arrayOf("which", "su")).run {
      waitFor(); inputStream.reader().readText().isNotEmpty()
    }
  } catch (_: Exception) { false }
}

Runtime Protection

iOS

// Anti-debugging
import Darwin

func isDebugged() -> Bool {
  var info = kinfo_proc()
  var mib = [CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()]
  var size = MemoryLayout<kinfo_proc>.stride
  sysctl(&mib, u_int(mib.count), &info, &size, nil, 0)
  return (info.kp_proc.p_flag & P_TRACED) != 0
}

Android

// Integrity check at startup
fun verifyIntegrity() {
  val expected = "original_signature"
  val signature = packageManager.getPackageInfo(
    packageName, PackageManager.GET_SIGNING_CERTIFICATES
  ).signingCertificateInfo()
  if (signature != expected) {
    // App has been tampered with
    Process.killProcess(Process.myPid())
  }
}

// SafetyNet / Play Integrity
val client = IntegrityManagerFactory.create(this)
client.requestIntegrityToken(
  IntegrityTokenRequest.builder()
    .setCloudProjectNumber(projectNumber)
    .build()
).addOnSuccessListener { response ->
  val token = response.token()
  // Send token to server for verification
}

Checklist

□ No hardcoded API keys / secrets
□ Certificate pinning for all API calls
□ Keychain (iOS) / EncryptedSharedPreferences (Android) for secrets
□ Data protection class for files
□ Root/jailbreak detection at startup
□ Debug detection (anti-debugging)
□ App integrity verification
□ Screen recording detection
□ Clipboard security (no sensitive data in pasteboard)
□ Logging stripped from release builds

Obfuscation

// Android — ProGuard / R8 rules
// proguard-rules.pro
-keepclassmembers class * {
    @com.google.gson.annotations.SerializedName <fields>;
}
-keep class com.example.app.model.** { *; }
-keepclassmembers,allowobfuscation class * {
    @android.webkit.JavascriptInterface <methods>;
}

# iOS — build settings
# SWIFT_OBFUSCATION = YES (Xcode 15+)
# Strip Swift symbols in release builds
# Deployment Postprocessing: YES
# Strip Linked Product: YES