Third-Party SDK Security Analysis for Mobile Applications
Do you really know the risks associated with the SDKs integrated into your application?
Modern mobile applications increasingly rely on third-party components to implement critical functionalities such as biometric authentication, anti-fraud, payments, KYC, analytics, push notifications, App Shielding, RASP and more!
However, these SDKs also expand the application's attack surface and can introduce vulnerabilities, insecure configurations, hardcoded keys, privacy issues, or weaknesses that directly impact business security.
At Just Mobile Security we help organizations assess the security of SDKs integrated into Android and iOS applications, analyzing both their implementation and the risks associated with each component.
What do we analyze?
We perform static and dynamic analysis to identify risks associated with third-party SDKs and their implementation.
RASP & App Shielding SDKs
- Insecure configurations.
- Hard-coded secrets.
- Implemented protection.
- Client-side only validations.
- Possible bypasses.
- Exposure of internal APIs.
Anti-Fraud SDKs
- Client-server integration.
- Risk score manipulation.
- Identifier exposure.
- Device ID persistence.
- Anti-automation controls.
- Backend-performed validations.
KYC & Identity Verification SDKs
- Onboarding flows.
- Liveness Detection.
- Face Matching.
- Response integrity.
- Protection against replay attacks.
- State and session manipulation.
Payment SDKs
- Token handling.
- Transaction integrity.
- Payment validations.
- Request manipulation.
- Credential protection.
- Sensitive information exposure.
Biometric SDKs
- Biometric authentication implementation.
- Key protection.
- Keystore / Secure Enclave usage.
- Authentication bypass.
- Insecure fallbacks.
Analytics & Tracking SDKs
- Sensitive information exposure.
- Insecure configurations.
- Exposed APIs.
- Privacy risks.
- Excessive data collection.
Push Notification SDKs
- Token protection.
- Notification spoofing.
- Insecure configurations.
- Abuse risks.
How do we do it?
Thanks to our development for vulnerability detection in mobile applications, TUNGSTENIC, we can automatically identify the SDKs integrated within an application and determine how they were implemented.
Subsequently, our specialists perform a manual analysis to identify vulnerabilities, insecure configurations, and possible abuse scenarios associated with each component.
Additionally, we implement validations based on:
- OWASP MASVS / MASTG.
- OWASP Top 10.
- Testing from the attacker's perspective (black-box and grey-box).
Analysis stages
- Discovery and identification.
- Static analysis.
- Dynamic analysis.
- Attack simulation.
What do we deliver?
- Complete SDK inventory.
- Technical Report.
- Executive Report.
- Risks associated with each SDK.
- Findings prioritized by criticality.
- Mitigation recommendations.
- Potential business impact.
Key Differentiator
While most organizations assume that a third-party SDK is secure by default, at Just Mobile Security we assess how robust its implementation is and what the real risks associated with each component are. Our goal is to determine whether an attacker can abuse, manipulate, or evade the functionalities provided by these SDKs, helping to reduce the attack surface and strengthen the overall security of the application.