Analyzing Mobile Applications GMOB Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   You are reverse-engineering an Android app that uses native code (JNI) for license validation. The app checks a license key and displays a premium feature if valid. You have identified the native library `liblicense.so`. You need to bypass the license check to test the premium features. Which approach is most efficient and least likely to be detected by the app's integrity checks?

   • APatch the `liblicense.so` binary to change the return value of the validation function and repackage the APK.
   • BUse `gdb` to attach to the process and set a breakpoint on the validation function, then manually change the return value.
   • CUse `apktool` to decompile the APK, modify the smali code of the Java wrapper to skip the license check, and rebuild.
   • DUse Frida to hook the native function that returns the license validation result and force it to return true.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which activity is part of binary analysis of a mobile application?

   • ARunning the app in an emulator and interacting with its UI
   • BExamining the app's native libraries for insecure function calls
   • CReviewing the app's source code repository for hardcoded credentials
   • DUsing a network proxy to intercept HTTPS requests
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   During a static analysis of an Android app, you find that the app's manifest declares `android:allowBackup="true"` and the app stores a database containing chat messages in the app's private directory. The app targets Android 12 (API 31). Which risk is most relevant?

   • AThe chat messages should be stored in the app's external storage to avoid backup exposure.
   • BThe database is stored in plaintext, which is a critical vulnerability because any app with root can read it.
   • CTargeting Android 12 automatically disables backup for apps that use `allowBackup=true`.
   • DThe app's private database can be extracted via `adb backup` on devices that support it, potentially exposing chat messages.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   An iOS app stores sensitive user data using Core Data with SQLite. The app sets the Data Protection class to `NSFileProtectionComplete` for the SQLite file, but the app also creates temporary files in the app's `tmp` directory that contain the same data. You are assessing the app's data-at-rest security. Which finding is most critical?

   • AThe temporary files should be stored in the Keychain to ensure they are encrypted.
   • BCore Data with SQLite is inherently insecure because SQLite does not support encryption.
   • CThe temporary files in the `tmp` directory are not protected by the same Data Protection class and may be accessible if the device is unlocked or via backups.
   • DThe use of `NSFileProtectionComplete` is insufficient because it only protects the file when the device is locked, but an attacker can read it while the app is running.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security assessor is reviewing an Android application package. The app's manifest declares a custom permission with `protectionLevel="signature"` and an exported activity that handles deep links. During code review, the assessor finds that the activity launches a WebView with `setAllowFileAccess(true)` and loads content from an intent extra. Which combination of findings represents the most critical risk to address?

   • AThe WebView file access is a concern only if the app is debuggable, so the assessor should focus on the manifest's `debuggable` flag.
   • BThe custom permission with `protectionLevel="signature"` is too weak and should be `signatureOrSystem` to prevent other apps from accessing the activity.
   • CThe deep-link handling is safe because Android's intent filter system restricts access to only apps with the same signature.
   • DThe exported deep-link activity can be invoked by any app, and the WebView file access could allow an attacker to read local files by crafting a malicious intent.
   Reveal Solution Discussion Select an answer first