App Attacker Model

web security mobile

Definition

App Attacker Model

In the app attacker model the attacker controls an app (a PUA) and loads a benign website inside it. The attacker cannot modify the website but can manipulate the page through the embedding app’s WebView APIs — the app-to-web direction.

Contrast with the Web Attacker

Obs

The model is the inverse of the web attacker model. In the web attacker model the attacker controls a website loaded inside a benign app, and the attack surface is the web-to-app direction (JS bridge). In the app attacker model the attacker controls the app and the attack surface is the app-to-web direction: JavaScript code injection and cookie access/modification inside the loaded page.