thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Insecure Communication (Mobile)

Mobile Top 10 risk (M5) where an app transmits data without strong transport security or validates certificates improperly.

Definition

Problems include cleartext HTTP, accepting any certificate, ignoring hostname verification, weak TLS versions and leaking data over SMS or push notifications. Mitigations are TLS 1.2+ everywhere, platform-default certificate validation, App Transport Security or Network Security Configuration, and certificate pinning for high-risk apps.

Example

An app uses a custom TrustManager that accepts all certificates, allowing interception on public Wi-Fi.

Exam tip

Disabled certificate validation is the most common mobile TLS flaw.

Related terms