Security Glossary

RASP is a security mechanism integrated into an application to defend it during execution. RASP embeds sensors or libraries within the application. Unlike external security tools, it operates inside the application environment, monitoring behaviour, detecting tampering, preventing code injection, and identifying compromised devices. In mobile applications, RASP protects against runtime threats, detects them in real-time and blocks them. It enables immediate enforcement of security policies when threats are detected. It enhances application-level resilience and gives the app self-awareness of attacks, allowing immediate protection even against novel exploits. Bugsmirror Defender is an advanced RASP solution with seamless binary integration, protecting from over 50 runtime threats including serious threats like app repackaging, MitM, app tampering, reverse engineering, etc. It does not impact the application performance as it is written in low-level language such as Rust/C++.

Red teaming is a security exercise where experts simulate real attacker behaviour to evaluate the overall security posture of the application ecosystem. Instead of looking at individual issues, it focuses on how multiple weaknesses can be chained together to bypass protections and gain unauthorised access. It involves threat modeling and multi-stage attack scenarios that test not just the app’s defences, but also threat detection and response capabilities. In mobile apps, this can include bypassing security controls, using techniques such as runtime instrumentation (e.g., Frida), reverse engineering, and attack chaining to uncover real-world risks and improve overall security. Bugsmirror ThreatLock is a manual red teaming security assessment providing a comprehensive threat modeling exercise according to the business/app logics. It carefully assesses App runtime behaviour, authentication flow, to check its strength against runtime attacks.

Bugsmirror RunLock is a dynamic application security testing (DAST) tool to identify 25+ runtime vulnerabilities in Android and iOS applications by testing them on real physical devices. Unlike traditional web-based DAST tools, RunLock is designed to detect mobile runtime vulnerabilities like tampering attempts, malicious device environments, insecure communications, and Man-in-the-Middle (MitM) attacks. It delivers detailed reports with proof-of-concept and reproduction steps, and supports compliance with standards like OWASP MASVS. RunLock helps organisations evaluate and strengthen their mobile runtime security posture.