I recently started thinking about an attacker which would clone a mobile application, and add some code which would do something malicious, e.g. credential theft. This cloned app would communicate with a legitimate server and therefore offer a legitimate service to the user.

On the web this is solved by relying on user to check the URL, but also with protections like CORS.

I am wondering how the mobile attack variant can be prevented on the server side. First thing that comes to mind is using some form of credentials. However, with enough effort, this be broken with reverse engineering.

Can you think of anything better or more reassuring?

1 Answer 1


After some digging, I’ve found the answer to the question.

Essentially, the application needs to authenticate to the server. This means that there has to be a shared secret between the application and the server. However, the secret cannot be hard coded into the application, because it would be copied by cloning.

In Android and iOS, each application instance is given a unique ID. Verify this ID on the server side proves app authenticity. Source: https://developers.google.com/instance-id

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.