Mobile Platform, IoT, and OT Hacking · Topic 1 of 4
Mobile Attack Vectors, Android and iOS
Learn mobile attack vectors, the OWASP Mobile Top 10, Android rooting and iOS jailbreaking, and how both platforms protect apps, with defenses for CEH v13.
- 5 min
- Rooting is for Android, and jailbreaking is for iOS. Both remove built-in protections.
- Untethered, semi-untethered, semi-tethered and tethered describe jailbreak persistence.
- Android apps are APK files, sandboxed per app and governed by permissions.
What it is
Mobile devices hold email, banking, photos and corporate data, and they connect over cellular, Wi-Fi and Bluetooth. This makes them a rich target.
This page covers the mobile attack surface (Mobile Platform Attack Vectors) and the two main platforms, Android (Hacking Android OS) and iOS (Hacking iOS). The exam expects you to recognize attack types, platform security features and the meaning of rooting and jailbreaking.
How it works
Mobile attack vectors
| Vector | Description | Defense |
|---|---|---|
| Malicious apps | Apps with hidden spyware, trojans or ransomware, often in third party stores | Install from official stores only |
| Sideloading | Installing apps from outside the official store | Block unknown sources |
| Smishing and phishing | Text or messaging links that steal credentials or install malware | User training, link filtering |
| Network attacks | Rogue Wi-Fi and on-path attacks that read unprotected traffic | VPN, certificate validation |
| OS and app vulnerabilities | Unpatched flaws that allow takeover | Fast updates |
| Rooting or jailbreaking | Removes platform protections, which exposes the device | Detect and block such devices |
| Data leakage | Insecure storage or logs expose sensitive data | Encryption, secure coding |
| SIM swap | The attacker moves the victim's number to a new SIM to receive codes | Carrier PIN, app based authentication |
| Physical loss | A lost device exposes data | Screen lock, encryption, remote wipe |
OWASP Mobile Top 10 (2024)
| Code | Risk |
|---|---|
| M1 | Improper Credential Usage |
| M2 | Inadequate Supply Chain Security |
| M3 | Insecure Authentication/Authorization |
| M4 | Insufficient Input/Output Validation |
| M5 | Insecure Communication |
| M6 | Inadequate Privacy Controls |
| M7 | Insufficient Binary Protections |
| M8 | Security Misconfiguration |
| M9 | Insecure Data Storage |
| M10 | Insufficient Cryptography |
Android
Android is based on the Linux kernel. Each app runs as its own Linux user inside an application sandbox, and apps declare the permissions they need. Apps are packaged as APK files. Google Play Protect scans apps, and Android uses SELinux to enforce access rules.
Rooting gives the user superuser (root) access. It lets a user remove restrictions, but it also breaks the sandbox, lets malware reach all app data and weakens verified boot. Rooting tools include Magisk.
Common Android risks include malicious apps with excessive permissions, sideloaded APKs, exposed debug features such as Android Debug Bridge (ADB) left on, and insecure data in shared storage.
Testers use tools such as Android Debug Bridge to interact with a device, apktool and decompilers to inspect an APK, Mobile Security Framework (MobSF) for automated static and dynamic app analysis, Drozer to probe app components, and Frida to observe a running app. Burp Suite is used to inspect the traffic an app sends.
iOS
iOS apps run in a sandbox, must be code signed, and are distributed through the App Store after review. Data is protected by hardware encryption backed by the Secure Enclave, and the Keychain stores credentials. Secure boot checks each stage of start up.
Jailbreaking removes Apple's restrictions so that unsigned code and unofficial app sources can be used. It is classified by how long it survives a restart.
| Type | After a reboot |
|---|---|
| Untethered | The device stays jailbroken and boots normally |
| Semi-untethered | Boots normally, but the user must run a tool to re-apply the jailbreak |
| Semi-tethered | Boots normally but without jailbreak, the user must use a computer to re-apply |
| Tethered | The device cannot boot normally without a computer |
Well known jailbreak tools include checkra1n, unc0ver and Palera1n. Analysis tools for iOS apps include Frida, Objection and MobSF.
A worked example
An employee installs a free flashlight app from a link in a text message. The app is not in the official store, and during install it asks for access to messages, contacts and the microphone.
This is a sideloaded malicious app combined with smishing. It abuses excessive permissions to steal data. The countermeasures are to allow installs only from official stores, review requested permissions, train users on links, and enforce this through device management.
How the exam asks about this
- "Which jailbreak keeps a device jailbroken after every reboot?" → Untethered.
- "What file format is an Android app package?" → APK.
- "Which OWASP Mobile Top 10 category covers storing sensitive data in clear text on the device?" → M9, Insecure Data Storage.
What to remember for the exam
- Rooting is for Android, and jailbreaking is for iOS. Both remove built-in protections.
- Untethered, semi-untethered, semi-tethered and tethered describe jailbreak persistence.
- Android apps are APK files, sandboxed per app and governed by permissions.
- iOS relies on code signing, App Store review, sandboxing and the Secure Enclave.
- Install apps only from official stores and keep the OS updated.
Do not swap the words. A question about an Android device that has been "jailbroken" is a distractor, because Android devices are rooted.
Common mistakes
Trusting the app store blindly. Official stores reduce the risk but malicious apps still slip through, so permissions matter.
Thinking iOS cannot be attacked. It is more closed, but phishing, outdated versions and jailbreaks all work against it.
Mixing semi-tethered and semi-untethered. Semi-untethered needs only the device to re-apply the jailbreak, and semi-tethered needs a computer.
Check yourself
What is rooting?
Gaining superuser access on Android, which removes sandbox protections.
Which iOS feature stores credentials securely?
The Keychain, supported by the Secure Enclave hardware.
What is sideloading?
Installing an app from outside the official store.
Topic 1 of 4 in Mobile Platform, IoT, and OT Hacking
Test yourself on Mobile Platform, IoT, and OT Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.