Security Glossary

OAuth is an authorisation framework allowing apps to access user data without storing passwords, by using access tokens and scopes to limit permissions. OAuth uses access tokens issued after user consent. Secure implementation includes token validation, expiration, scope control, and secure redirect handling. Improper OAuth implementation can lead to token leakage, unauthorised access or account takeover. In mobile apps, OAuth is used for social logins and API access. Proper configuration ensures tokens are protected and cannot be misused by malicious applications. It helps users to securely log in to a third-party app without the app ever handling their passwords.

Obfuscation is a technique of making code difficult to read and understand by making it complex, transforming it into unreadable code without affecting its functionality. Mobile applications often use code obfuscation to protect their intellectual property, prevent reverse engineering, hide sensitive logics and reduce the risk of tampering. Techniques include renaming variables, encrypting strings, and altering control flows. It does not completely prevent vulnerability, but it increases the efforts required for attackers to analyse and exploit an application. There are two types of obfuscations:

• Malware obfuscation: It uses packing, encryption and encoding techniques and turns code into spaghetti code, making reverse engineering difficult.
• Data Obfuscation: It protects sensitive information via data encryption or masking.

An operating system is the core software that manages a device's hardware and software and provides a platform for apps to run. It handles system processes, memory usage, file storage, and communication between hardware and applications via system services. The OS manages operations through components like the kernel, system services, and permission frameworks. It also enforces security policies, ensures application isolation, and controls access between different programs. Mobile operating systems, including Android and iOS, provide application sandboxing, permission management, and secure APIs. Applications rely on and must correctly use these controls and maintain a trusted execution environment.

OS integrity ensures that the operating system has not been altered, tampered with, or compromised by unauthorised modifications. Maintaining OS integrity is critical because once the operating system is compromised, built-in security controls can be bypassed, malicious activity can go undetected, and attackers may gain control over device behaviour. Integrity checks validate system files, configurations, and the boot process to ensure the device is running a trusted and unmodified version. It is done by techniques like secure boot, system integrity verification, and device attestation. Mobile apps rely on these checks to detect whether a device is rooted, jailbroken, or altered. If any compromise is detected, security-sensitive apps may limit functionality or block access to reduce risk.

Over-The-Air (OTA) Update is a feature of modern devices that helps them to update their components remotely without requiring users to manually download a new version from the marketplace. In mobile app security, OTA update is helping mobile applications to update security configuration quickly when new threats emerge. This feature has improved the response time and reduced dependency on lengthy release cycles. OTA completes in a three-step cycle to ensure that the device doesn't break in case of any vulnerability. The process involves:

• Checking: The device checks the server to see if an updated version of the software is available.
• Downloading: If a match is found, then the device downloads the update package in the background.
• Installation: After verifying that the digital signature of the package has not been tampered with, it updates the OS or application.