Manipulating Mobile Application Behavior GMOB Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is reverse engineering a mobile app and discovers that it uses a custom class loader to load encrypted DEX files at runtime. The analyst wants to understand the app's behavior. Which technique would be most effective?

   • AUse a debugger to step through the decryption routine and extract the decrypted DEX from memory
   • BUse a static analysis tool to decrypt the DEX files without running the app
   • CUse Frida to hook the custom class loader and dump the decrypted DEX files after they are loaded
   • DRepackage the app to remove the encryption and decompile the DEX files
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A mobile app developer is testing a banking app on a rooted Android device. They use Frida to hook a function that checks whether the device is rooted, and the hook always returns 'false' to bypass the root detection. The app also uses certificate pinning to prevent man-in-the-middle attacks. Which statement best describes the effect of the Frida hook on the app's security controls?

   • AThe hook causes the app to crash because Frida cannot bypass security checks on rooted devices
   • BThe hook bypasses the root detection check, but certificate pinning remains active unless separately bypassed
   • CThe hook disables all security controls because Frida runs with root privileges
   • DThe hook modifies the APK's code so that root detection and certificate pinning are permanently removed
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common indicator that a mobile application may have been tampered with?

   • AThe app's icon is different from the original
   • BThe app is available on the official app store
   • CThe app's digital signature does not match the developer's original signature
   • DThe app requests fewer permissions than the original version
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is testing a mobile app that uses both root detection and certificate pinning. The analyst wants to bypass both controls to perform a man-in-the-middle attack. The analyst has a rooted device and Frida. Which approach is most efficient?

   • AUse a debugger to step through the root detection code and then manually disable certificate pinning
   • BUse Frida to hook the root detection function and also hook the certificate pinning validation function
   • CInstall a custom certificate on the device and rely on the user to accept it
   • DRepackage the app to remove both root detection and certificate pinning code
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is investigating a mobile banking app that behaves differently on a rooted device. The app normally requires two-factor authentication, but on the rooted device it skips the second factor. The analyst suspects runtime manipulation. Which technique would most directly allow an attacker to alter the app's authentication logic without modifying the APK on disk?

   • ADecompiling the app and recompiling it with a modified certificate
   • BUsing a debugger to set a breakpoint on the authentication method and change the return value
   • CRepackaging the APK with a modified smali code that bypasses the second factor
   • DUsing Frida to hook the authentication method and force it to return success
   Reveal Solution Discussion Select an answer first