BERRY9 IT Services, home +91 86868 92922

OWASP Mobile Top 10: What Each Item Involves

The OWASP Mobile Top 10 is the buyer-facing list — the version that gets cited in RFPs and procurement documents. The OWASP Mobile Application Security Verification Standard (MASVS) is the corresponding test plan. BERRY9 maps its mobile work to both. Here is what each Top 10 item involves in a test.

Request a scoping call Call +91 86868 92922

Mobile apps · By Thimmagurudu Bathini · Published · 7 min read · Last reviewed

M1 Improper Credential Usage

Hardcoded keys, tokens in shared preferences without encryption, secrets in build configs. We grep the binary, decompile, and verify every secret has an appropriate storage mechanism.

M2 Inadequate Supply Chain Security

Third-party SDKs with known CVEs, code-signing chain weaknesses, build pipelines without artifact integrity checks. We enumerate every SDK in the app and check current vulnerability status.

M3 Insecure Authentication / Authorization

Often the highest-impact category. Verified server-side, not client-side. We walk every auth flow including biometric prompts, MFA, and session refresh.

M4 Insufficient Input / Output Validation

Injection at deep-link handlers, intent extras, push notification payloads, file pickers. We send unexpected input to every entry point.

M5 Insecure Communication

TLS configuration, certificate pinning, fall-back to HTTP. Covered in intercepting mobile API traffic.

M6 Inadequate Privacy Controls

Excessive permissions requested, PII logged to system logs, screen-capture and screenshots showing sensitive data, accessibility-service abuse.

M7 Insufficient Binary Protections

Anti-tampering and anti-instrumentation. Defense in depth, not a security boundary.

M8 Security Misconfiguration

Debug builds in production, accessible content providers, exported activities without proper guards, allowBackup enabled, applicationId conflicts.

M9 Insecure Data Storage

Detailed in insecure data storage.

M10 Insufficient Cryptography

Hardcoded IVs, ECB mode, weak KDFs, custom crypto.

See mobile application penetration testing.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp