I think that because mobile application testing is somewhat of a niche, the security considerations for mobile devices are also less understood. Not to mention the lack of well-made learning materials and certifications - from what I am able to find out, most of these resources only really scratch the surface when there is a lot more to learn.
Mobile Apps are Different#
Typical apps like social media, banking, and messaging apps often interact using some kind of API and some online service. Some of the data is surely cached on the phone but most of it is likely sitting in a data center far away from your phone.
So, if you are auditing a mobile application you want to make sure that the API itself is in scope.
The operating systems that run on modern smartphones were designed with security in mind. (Or at least designed with security more front-of-mind than the operating systems for personal computers that came first). For example, Android and iOS were designed so apps have a permissions model that requires the user to grant specific access to various features of the OS - where applications that run on a desktop OS like Windows or your favorite Linux distro don’t have these protections implemented in the same way.
The Mobile Attack Surface#
The learning curve I had when learning about testing Android apps for the first time was about how the attacker would actually be interacting with the application. For example if you have root access to a device and you test the application from that perspective, most of your findings would be fairly low impact if having root access is a prerequisite.
Another example would be someone reporting a sensitive data theft vulnerability using a MITM attack once their own malicious CA is trusted and where the application doesn’t use SSL pinning. In this case this isn’t an issue with the application itself but the fact that a malicious CA was trusted on the device by the user, so a prerequisite for this attack would be tricking a user to add that malicious certificate to their device’s certificate store. A true MITM attack in this context would require the application to use some plaintext protocol over the network.
Now we get into the more practical examples, users can download malicious apps from the play store or from the internet where those evil apps can be used to communicate with other applications on the device in an unsafe way. Think of an app that spies on you by copying everything you type or copies your SMS messages to a file location and exfiltrates that data. Even though the user would have to download and trust the app, many users hit ‘OK’ for every prompt they get and introduce risks that way.
As you might expect, this lines up with some of the more popular bug bounty platforms for android applications like the Google Mobile Vulnerability Reward Program:
TLDR#
Mobile applications have a different attack surface than that of a desktop application or a typical API both because of how the underlying system works and the ways in which attackers are limited to interact with mobile applications. Ensure that when you are scoping an engagement for a mobile application pentest that both your testers and clients are aware of these considerations so that you can adequately achieve full coverage.