Mobile application security

Cerberon analyses Android (.apk) and iOS (.ipa) packages statically. The mobile analyser runs its rules, and the Cerberon Agent then works through an OWASP MASVS 2.x checklist against the package. The report includes a MASVS coverage grid.

Upload a package from New Scan > Mobile. An administrator configures the analyser on the instance.

Engines

Engine	What runs
Scanner	Static analysis by the mobile analyser.
Scanner + Agent (recommended)	The analyser, then the agent. The analyser phase can be skipped.

What the scanner checks

The mobile analyser reads the package statically. Each finding keeps the analyser’s CWE, OWASP Mobile Top 10 and MASVS references where it states them.

Area	Android (APK)	iOS (IPA)
Configuration	Exported activities, services, receivers and providers. android:debuggable, android:allowBackup and cleartext traffic.	App Transport Security settings in Info.plist that allow arbitrary loads or broad TLS exceptions.
Permissions and privacy	Dangerous permissions such as SMS, microphone, contacts and fine location.	Privacy trackers found in the package.
Code	The analyser’s rules over decompiled code.	Insecure and banned APIs, weak cryptography and weak random number use in the executable.
Binary hardening	Signing certificate and native library hardening.	PIE, ARC, stack canary, NX, RPATH, symbol stripping and encryption for the executable and every embedded framework and library.

What the agent checks

In Scanner + Agent mode the Cerberon Agent works through a static OWASP MASVS 2.x checklist covering all 24 controls. It inspects the package itself and records the file, Info.plist key, manifest attribute or command output behind each finding.

MASVS area	Examples of what is checked
Storage	Credentials and keys in bundled files and Info.plist, backup and file-sharing settings, sensitive data in logs.
Cryptography	Broken digests and ciphers, fixed IVs and salts, keychain and Secure Enclave key handling on iOS.
Authentication	Embedded API keys and OAuth secrets, OAuth and OIDC configuration, token and JWT handling, local authentication and step-up checks.
Network	App Transport Security exceptions, permissive trust managers, legacy TLS, certificate pinning.
Platform	URL schemes, universal links, associated domains, app groups, exported components and WebView configuration.
Code	Minimum OS version, the get-task-allow entitlement, embedded frameworks and their versions, unsafe deserialisation and dynamic code loading.
Resilience	Code signature, provisioning profile and entitlements, jailbreak and root detection, anti-debugging, symbol and metadata exposure.
Privacy	Usage descriptions, App Tracking Transparency, advertising identifiers, the privacy manifest and required-reason APIs.

Platform	Static checks run	Named as not tested
Android	58	21 that need a running device
iOS	55	21 that need a running device

Cerberon does not run the app on a device or emulator. Checks that need one appear in the report as not tested with that reason, never as passed.

Scan through the API

UPLOAD_ID=$(curl -sSf -X POST "$CERBERON_URL/api/uploads" \
  -H "Authorization: Bearer $CERBERON_TOKEN" \
  -F "file=@app-release.apk" | jq -r .artifact.id)

curl -sSf -X POST "$CERBERON_URL/api/jobs" \
  -H "Authorization: Bearer $CERBERON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "mobile",
    "title": "Android release 2.4",
    "target": { "kind": "artifact", "artifactId": "'"$UPLOAD_ID"'" },
    "consent": { "acknowledged": true, "mode": "manual" },
    "config": { "mobile": { "engine": "ai" } }
  }'

"engine": "ai" is Scanner + Agent. Leave engine out for Scanner only. Add "skipScanner": true to the mobile object to run the agent only.

To leave the mobile analyser out of an installation, install with --no-mobile.