This category merges 2016's Code Tampering and Reverse Engineering. Attackers decompile apps to find API keys, premium-feature checks, and proprietary algorithms, then patch the binary to bypass licensing, payment, or anti-cheat logic and redistribute it. Without server-side attestation, the backend cannot tell a modified client from a genuine one.
Keep secrets and sensitive logic on the server, apply code obfuscation, add runtime integrity and tamper detection, use platform attestation (Play Integrity, App Attest) so the backend can reject modified clients, and monitor stores for repackaged copies.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#07mobile07-2024 Insufficient Binary Protections
