Manipulating Mobile Application Behavior GMOB Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is investigating a malicious app that was distributed via a third-party app store. The app appears to be a legitimate game, but it also sends the user's contacts to a remote server. Which attack vector is most likely?

   • AThe app is using a dynamic code loader to fetch malicious code from a server
   • BThe app is a legitimate game that has a hidden feature to send contacts
   • CThe app uses a legitimate SDK that has a vulnerability
   • DThe app was repackaged from the legitimate game with added malicious code
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is investigating a mobile app that has been reported to behave differently on rooted devices. On a rooted device, the app displays an error message and exits, but on a non-rooted device it functions normally. The analyst suspects the app is using root detection. Which manipulation technique could an attacker use to bypass this root detection?

   • AUsing a debugger to step through the root detection code and modify the device's build properties
   • BChanging the app's signing certificate to match a rooted device
   • CRepackaging the app to remove the root detection code from the DEX file
   • DUsing a hooking framework to intercept the root detection function and force it to return 'not rooted'
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst discovers that a popular app has been repackaged and distributed on third-party app stores. The repackaged version contains a malicious library that steals credentials. Which indicator would most reliably identify the repackaged version?

   • AThe app requests fewer permissions than the official version
   • BThe app's icon looks slightly different
   • CThe app's signing certificate differs from the official version
   • DThe app's version number is lower than the official version
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A mobile app team is deciding between two anti-tampering strategies: (1) implementing runtime integrity checks that detect hooking frameworks, or (2) using code obfuscation to make reverse engineering harder. The team has limited development resources and wants to maximize protection against both runtime manipulation and static repackaging. Which strategy should they choose?

   • AUse code obfuscation, because it is easier to implement and provides sufficient protection
   • BImplement both, but prioritize obfuscation because it is more effective against runtime hooking
   • CUse neither, because anti-tampering mechanisms are not effective against determined attackers
   • DImplement runtime integrity checks, because they directly detect and respond to both runtime hooking and repackaging
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A mobile app development team wants to detect if their Android app has been repackaged and distributed outside the official store. They plan to implement a runtime integrity check. Which approach would be most effective at detecting repackaging?

   • AVerify the app's signing certificate at runtime and compare it to the expected certificate hash
   • BUse ProGuard to obfuscate the code and make reverse engineering harder
   • CCheck the app's version number against the latest version on the official store
   • DCheck if the device is rooted and block execution if root is detected
   Reveal Solution Discussion Select an answer first