<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-mobile-app-transport-security
description: >-
  Audit mobile application transport layer security including ATS on iOS,
  network security config on Android, TLS version enforcement, certificate
  validation, and cleartext traffic detection using Frida, objection, and
  network interception tools.
domain: cybersecurity
subdomain: mobile-security
tags:
  - transport-security
  - ats
  - tls
  - network-security-config
  - cleartext
  - frida
  - objection
  - mitm
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557", "T1040"]
  owasp-mobile: ["M3"]
  tools: ["frida", "objection", "mitmproxy", "mobsf", "nmap"]
---

# Analyzing Mobile App Transport Security

## Overview

Transport security analysis examines how mobile apps protect data in transit.
On iOS, App Transport Security (ATS) enforces TLS 1.2+ by default. On Android,
network security configuration controls cleartext and certificate trust. Weak
transport exposes credentials, tokens, and PII to interception.

## Prerequisites

```bash
pip install frida-tools objection mitmproxy
# Frida server on device
adb push frida-server /data/local/tmp/ && adb shell chmod 755 /data/local/tmp/frida-server

# mitmproxy CA install
mitmproxy  # generates ~/.mitmproxy/mitmproxy-ca-cert.pem
adb push ~/.mitmproxy/mitmproxy-ca-cert.pem /sdcard/
```

## Workflow

### Step 1: Audit Android Network Security Config

```bash
# Extract and inspect network_security_config.xml
apktool d target.apk -o apktool_out/
cat apktool_out/res/xml/network_security_config.xml

# Check for cleartext traffic permission
grep -r 'cleartextTrafficPermitted="true"' apktool_out/
grep -r 'usesCleartextTraffic="true"' apktool_out/AndroidManifest.xml

# Check trust anchors — user certs trusted in production is a finding
grep -r '<certificates src="user"' apktool_out/
grep -r 'trust-anchors' apktool_out/res/xml/
```

### Step 2: Audit iOS ATS Configuration

```bash
# Extract Info.plist from IPA
unzip -o target.ipa -d ipa_out/
plutil -p ipa_out/Payload/*.app/Info.plist | grep -A 20 'NSAppTransportSecurity'

# Critical ATS findings
# NSAllowsArbitraryLoads = true → ATS disabled globally
# NSExceptionAllowsInsecureHTTPLoads = true → cleartext for domain
# NSExceptionMinimumTLSVersion < TLSv1.2 → downgrade risk

# Objection ATS inspection
objection -g com.target.app explore -c "ios plist cat Info.plist"
```

### Step 3: Runtime TLS Interception with Frida

```bash
# Hook SSL_write/SSL_read to inspect plaintext
frida -U -f com.target.app -l ssl_logger.js --no-pause

# Detect cleartext HTTP connections at runtime
frida -U -f com.target.app -l detect_cleartext.js --no-pause

# Objection — disable SSL pinning and inspect traffic
objection -g com.target.app explore
# Inside objection:
# android sslpinning disable
# ios sslpinning disable
```

### Step 4: Active Network Interception

```bash
# mitmproxy transparent proxy
mitmproxy --mode transparent --showhost -w capture.flow

# Filter for sensitive data in transit
mitmdump -r capture.flow -s "flow_filter.py" --set flow_detail=3

# nmap TLS audit on backend endpoints
nmap --script ssl-enum-ciphers -p 443 api.target.com
nmap --script ssl-cert -p 443 api.target.com

# testssl.sh for comprehensive TLS assessment
testssl.sh --severity HIGH api.target.com
```

### Step 5: Certificate Validation Testing

```bash
# Test with self-signed cert (should fail if properly validated)
mitmproxy --mode regular --listen-port 8080
# Configure device proxy → observe if app accepts MITM cert

# Frida — check X509TrustManager implementation
frida -U -f com.target.app -l check_trust_manager.js --no-pause

# Objection — enumerate registered TrustManagers
objection -g com.target.app explore -c "android hooking list classes" | grep -i trust
```

### Step 6: Protocol Downgrade Testing

```bash
# Force TLS 1.0/1.1 on proxy to test downgrade acceptance
mitmproxy --ssl-version-client TLSv1 --mode regular

# Check for SSLv3/TLS 1.0 support on server
openssl s_client -connect api.target.com:443 -tls1
openssl s_client -connect api.target.com:443 -ssl3

# Verify HSTS headers
curl -sI https://api.target.com | grep -i strict-transport
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| ATS disabled | Info.plist | NSAllowsArbitraryLoads = true |
| Cleartext permitted | Manifest / NSC | usesCleartextTraffic or cleartextTrafficPermitted |
| Weak TLS | Network scan | TLS 1.0/1.1 or weak cipher suites |
| User CA trusted | NSC | trust-anchors includes user certificates |
| Missing HSTS | HTTP headers | No Strict-Transport-Security header |

```yaml
title: Mobile App Transport Security Detection
id: 1d0a0333-d9ce-41ba-b1da-09c386c37f49
status: experimental
description: Detects suspicious activity related to analyzing mobile app transport security techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1040
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Network security config / ATS plist audited
- [ ] Cleartext traffic detection completed
- [ ] TLS version and cipher suites validated
- [ ] Certificate validation behavior confirmed
- [ ] Protocol downgrade resistance verified
- [ ] HSTS enforcement checked on API endpoints

## References

- [OWASP MASTG — Network Communication](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0010/)
- [Apple ATS Documentation](https://developer.apple.com/documentation/bundleresources/information_property_list/nsapptransportsecurity)
- [MITRE T1557 — Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/)
- [Android Network Security Config](https://developer.android.com/privacy-and-security/security-config)
