PlatformFederalResourcesCompanyStart Free →
OWASP Mobile Top 10

Full Coverage.
Automatic Mapping.

Every Strata Security scan automatically maps findings to the OWASP Mobile Top 10 — the industry-standard framework for mobile application security risks.

Run Your First Scan →See All Features
Framework

What Is the OWASP Mobile Top 10?

The OWASP Mobile Top 10 is a community-curated list of the ten most critical security risks in mobile applications, published by the Open Web Application Security Project (OWASP). It provides a standardised vocabulary for mobile vulnerabilities and serves as the foundational reference for secure mobile application development.

The 2024 version of the OWASP Mobile Top 10 (M1–M10) covers the risks that appear most frequently in real-world mobile application penetration tests and security assessments, representing consensus from hundreds of security practitioners worldwide.

Strata Security automatically maps every detected finding to the relevant OWASP Mobile Top 10 category, giving your reports immediate context that is recognisable by clients, auditors, and compliance reviewers — without requiring manual tagging.

Coverage Matrix

10 of 10 Categories Covered

Strata Security provides automated detection across every OWASP Mobile Top 10 category for both Android and iOS.

IDCategoryAndroidiOSReposTypical Severity
M1Improper Credential Usage✓✓✓Critical
M2Inadequate Supply Chain Security✓✓✓High
M3Insecure Authentication and Authorization✓✓✓Critical
M4Insufficient Input/Output Validation✓✓✓High
M5Insecure Communication✓✓✓High
M6Inadequate Privacy Controls✓✓✓Medium
M7Insufficient Binary Protections✓✓✓Medium
M8Security Misconfiguration✓✓✓High
M9Insecure Data Storage✓✓✓Critical
M10Insufficient Cryptography✓✓✓High
Detection Details

How Strata Detects Each Category

Static analysis techniques applied to every scan, across Android APKs, iOS IPAs, and source code repositories.

M1

Improper Credential Usage

Critical

Detection of hardcoded secrets, API keys, tokens, and passwords embedded in application binaries or source code.

Detection Techniques
  • Regex-based scanning for API key patterns, JWT tokens, and secret formats
  • Entropy analysis to identify high-randomness credential strings
  • Keyword matching against credential field names (password, secret, token, key)
  • Git history scanning for accidentally committed credentials
Example Finding
STRIPE_SECRET_KEY = "sk_live_..." found in strings.xml at line 42

Hardcoded credentials represent one of the most common and impactful vulnerabilities in mobile applications. Strata detects over 40 credential patterns across Android and iOS.

M2

Inadequate Supply Chain Security

High

Analysis of third-party dependencies and SDKs for known vulnerabilities, malicious packages, and outdated components.

Detection Techniques
  • Dependency extraction from build manifests (build.gradle, Podfile, Package.swift)
  • CVE lookup via OSV (Open Source Vulnerabilities) database
  • SDK version comparison against known-vulnerable version ranges
  • Detection of suspicious or typo-squatted dependency names
Example Finding
com.squareup.okhttp3:okhttp:3.12.1 — CVE-2021-0341 (CVSS 7.5)

Supply chain attacks have surged. Strata cross-references every dependency against the OSV database on each scan, not just at project setup.

M3

Insecure Authentication and Authorization

Critical

Identification of broken authentication flows, missing session controls, and improper access token handling.

Detection Techniques
  • Detection of disabled SSL/TLS certificate validation
  • Identification of insecure token storage (localStorage, SharedPreferences)
  • Analysis of OAuth 2.0 flow implementation for PKCE absence
  • Detection of hardcoded admin credentials or bypass conditions
Example Finding
TrustManager.checkServerTrusted() override with empty body — bypasses cert validation

Authentication flaws often appear subtle — an empty trust manager or a missing scope check. Strata inspects bytecode decompilation to catch implementation-level issues.

M4

Insufficient Input/Output Validation

High

Detection of injection vulnerabilities, unvalidated deep links, and unsafe WebView configurations that expose applications to input-based attacks.

Detection Techniques
  • SQL injection risk patterns in raw query construction
  • JavaScript injection via WebView.addJavascriptInterface without safeguards
  • Deep-link parameter handling without sanitisation
  • Path traversal risks in file operations
Example Finding
WebView.addJavascriptInterface(bridge, "Android") — exposes all public methods to JS

WebView misconfigurations are particularly prevalent in hybrid apps. Strata maps specific class hierarchies to identify exposed interfaces.

M5

Insecure Communication

High

Detection of cleartext traffic, weak TLS configurations, and disabled certificate pinning that expose data in transit.

Detection Techniques
  • Detection of http:// URLs in source and configuration files
  • Android manifest analysis for android:usesCleartextTraffic="true"
  • iOS ATS (App Transport Security) exception detection in Info.plist
  • Weak TLS version and cipher suite analysis
Example Finding
NSAllowsArbitraryLoads = true found in Info.plist — disables ATS for all connections

Modern mobile applications should enforce TLS 1.2+ and certificate pinning for all production endpoints. Strata checks both the app binary and the network security configuration.

M6

Inadequate Privacy Controls

Medium

Analysis of permission declarations, PII handling, and data leakage vectors including logs, caches, and clipboard access.

Detection Techniques
  • Over-permissioning detection (dangerous permissions without clear need)
  • PII logging — detection of email, phone, and token values passed to Log.d/e
  • Clipboard access for sensitive data without clearing
  • Analytics SDK data collection scope analysis
Example Finding
Log.d("Auth", "Token: " + userToken) — authentication token written to logcat

Privacy regulations (GDPR, CCPA) place legal obligations on developers. Strata surfaces both regulatory risks and practical data leakage vectors.

M7

Insufficient Binary Protections

Medium

Assessment of obfuscation, anti-tampering controls, root/jailbreak detection, and debug flag presence.

Detection Techniques
  • ProGuard/R8 obfuscation detection via class and method name analysis
  • Debuggable flag detection (android:debuggable="true" in manifest)
  • Absence of root/jailbreak detection logic
  • Presence of development artifacts (test classes, staging endpoints)
Example Finding
android:debuggable="true" in AndroidManifest.xml — enables ADB debugging in release build

Binary protections are the last line of defence against reverse engineering. Strata checks for common weaknesses without requiring a full dynamic analysis environment.

M8

Security Misconfiguration

High

Detection of dangerous permission combinations, exported components without intent filters, and overly permissive configurations.

Detection Techniques
  • Exported Activity/Service/BroadcastReceiver without permission requirement
  • Dangerous permission combinations (READ_CONTACTS + INTERNET)
  • Backup flag enabled (android:allowBackup="true") on sensitive apps
  • Network security configuration policy mismatches
Example Finding
android:exported="true" on LoginActivity with no permission check — accessible to any app

Android's component export model is a frequent source of privilege escalation. Strata parses the full manifest and maps exported components to their declared permissions.

M9

Insecure Data Storage

Critical

Analysis of how sensitive data is persisted, including SharedPreferences, SQLite, external storage, and keychain usage.

Detection Techniques
  • Sensitive data in SharedPreferences without encryption
  • SQLite databases on external storage or without WAL encryption
  • Unencrypted Realm or Room database schemas for sensitive models
  • Files written to world-readable external storage
Example Finding
SharedPreferences.putString("auth_token", token) — stored in plaintext XML on device

On rooted devices, plaintext SharedPreferences are trivially readable. Strata checks storage calls and their context to distinguish credential storage from benign preferences.

M10

Insufficient Cryptography

High

Detection of weak encryption algorithms, hardcoded keys, predictable IVs, and improper random number generation.

Detection Techniques
  • Weak algorithm detection (DES, 3DES, MD5, SHA1 for security purposes)
  • ECB mode usage in block cipher detection
  • Hardcoded encryption keys and IVs in source code
  • Seeded or predictable Random() usage for security-critical values
Example Finding
Cipher.getInstance("AES/ECB/PKCS5Padding") — ECB mode leaks patterns in plaintext

Cryptographic misuse is subtle and often introduced by well-meaning developers. Strata checks algorithm selection, mode of operation, key management, and entropy sources.

Severity Mapping

How Findings Are Rated

Strata Security assigns severity using a combination of CVSS-aligned scoring and mobile-specific risk context.

Critical

Immediately exploitable, high impact. Examples: hardcoded credentials, disabled TLS validation, cleartext password storage. Address before shipping.

High

Significant risk with realistic attack path. Examples: exported components without permission, weak encryption algorithms, ECB mode usage.

Medium

Notable risk that requires specific conditions to exploit. Examples: log data leakage, missing obfuscation, ATS exceptions for specific domains.

Low

Informational or low-impact issues. Examples: backup enabled on non-sensitive apps, overly permissive but unused permissions.

Info

Observations that do not represent a vulnerability but may be relevant to your security posture or compliance review.

Quality

Our False Positive Philosophy

Static analysis is inherently imperfect. Our goal is to surface actionable findings, not to bury developers under noise.

Strata Security takes the following approach to minimise false positives:

  • Context-aware detection — we consider the code path, not just the pattern. A hardcoded string in a test file is treated differently from one in production code.
  • Entropy thresholds — credential detection uses entropy analysis to distinguish real secrets from example placeholders and documentation strings.
  • Semantic severity adjustment — a permission declared but demonstrably unused by the application logic is rated differently from one actively exercised by the app.
  • Suppression support — findings you have reviewed and accepted as intentional can be suppressed in future scans with an audit trail.

We acknowledge that some findings will require human judgement. Strata Security provides enough context — file path, line number, and surrounding code — for a reviewer to make a quick determination.

Staying Current

Continuously Updated Detection

The mobile threat landscape evolves constantly. New SDK vulnerabilities emerge, platform APIs change, and attackers discover novel techniques. Strata Security updates its detection rules continuously — not quarterly.

  • CVE database cross-references updated daily via the OSV feed
  • OWASP Mobile Top 10 2024 mapping (updated from 2016)
  • SDK-specific rules updated as vendor advisories are published
  • Community-sourced patterns from the security research community

When you scan the same app twice — once today and once in three months — you may get different results as we improve detection accuracy and add coverage for newly discovered techniques. We believe that is a feature, not a bug.

Get Started

Try Full OWASP Coverage
Free Today

Upload an APK or IPA and get a fully mapped OWASP Mobile Top 10 report in under 30 seconds. No credit card required.

Start Free Scan →View Pricing