Security Glossary

Malware is malicious software designed to exploit, harm or gain unauthorised access to computers, servers, networks or applications. Malware is used to capture sensitive information, manipulate transactions, or interfere with app functionality. Common malware types:

• Ransomware: Malware that encrypts data and demands payment to unlock it.
• Spyware: Malware that secretly collects user information.
• Trojans: Software disguises itself as a legitimate program.
• Worms: Self-spreading malware that spreads across systems or networks.
• Adware: Advertisement pop-ups on the screen to make it click.

An application can be infected by malware if it runs slowly, crashes frequently, makes unauthorised browser changes, shows constant pop-up ads, or is missing files. To protect your application from malware, it must have strong runtime protection, device integrity checks, secure APIs, and regular security testing. Layered defence has proven to be the best to prevent threats and detect malicious activity early.

A Man-in-the-Middle (MITM) attack occurs when an attacker secretly intercepts communication between two parties. By placing themselves between the user and the server, they can monitor, capture, or alter the data being exchanged. These attacks usually take advantage of insecure networks, weak encryption, or improper certificate validation. Acting as a relay, the attacker can read or modify sensitive information in transit. In mobile applications, MITM attacks commonly target API communication, especially over unsecured or poorly protected networks. To protect from MITM, strong encryption and certificate validation are critical to protect sensitive data exchanged between mobile apps and backend servers.

Mobile app security plays an important part in mobile applications lifecycle from development to deployment and runtime operation. It ensures data protection in both Android and iOS apps. It includes secure coding practices, vulnerability testing, encryption, authentication controls, runtime protection, and monitoring. Mobile apps face unique risks, including reverse engineering, app tampering, insecure APIs, and data leakage. Best practices to secure mobile apps include addressing both application-level and backend threats. Always use third-party codes carefully, update regularly and use a genuine marketplace to download apps. A strong security framework ensures data protection, regulatory compliance, fraud prevention, and user confidence.

Mobile app shielding is a security solution embedded directly into the app code to defend against reverse engineering, tampering, malware, data theft, and other runtime threats. It uses techniques like obfuscation, encryption, anti-debugging, integrity checks, and runtime application self-protection (RASP) to defend mobile apps. It helps safeguard applications' logic, sensitive data, and intellectual property from attackers who attempt to analyse or modify the app. Mobile app shielding solutions integrate with mobile apps to detect and respond against execution in untrusted environments, protecting against threats like app repackaging, hooking, and unauthorised modifications. Additionally, it helps in meeting compliance with standards such as RBI, NPCI, SEBI CSCRF, and OWASP MASVS. It is a must have solution for critical apps like payment apps, healthcare apps, etc.

Mobile fraud refers to unauthorised or deceptive activities carried out through mobile applications to gain financial or personal benefits. It can lead to financial losses, data theft, and loss of user trust, making it a major concern for businesses and users. Common types of mobile fraud include:

• SIM swap/account takeover: scammers trick carriers into transferring your number to their SIM, hijacking your calls and SMS for authentication to gain complete access to your account.
• Smishing (SMS phishing): Text message containing malicious links, often disguised as a bank text or package delivery.
• Vishing: Scammers call victims pretending to be bank officials, government employees or courier services to extract personal information.
• Malicious APK files: Tricking users into downloading malicious apps that allow malware injection and remote access to their phones.
• Caller ID spoofing: Fake telephone numbers to make a call appear trustworthy or local.