HARDEN YOUR MOBILE APP FROM THE INSIDE

WHAT ARE THE CORE CAPABILITIES OF MASC?

• Runtime Application Self-Protection (RASP)

  MASC Core embeds hundreds of runtime application self‑protection checks directly into the app. These checks detect compromise signals while the app is running and can trigger configurable responses (e.g., step‑up, restrict, block, or report - depending on your implementation and policy model).

  Capabilities:

  • Root and jailbreak detection – Identify higher-risk environments
  • Emulator and simulator detection – Distinguish physical devices from virtualized
  • Hooking and debugging detection – Detect instrumentation frameworks and attached debuggers
  • Screen manipulation detection – Overlays, synthetic touch, mirroring, suspicious capture behavior
  • Accessibility abuse monitoring – Flag suspicious accessibility usage patterns
  • Unknown input method detection – Untrusted keyboards / providers (as supported)
  • Sideloading and integrity validation – Detect tampered packages and installs outside expected channels
  • Google Play integrity support – Integrate Play integrity signals to strengthen Android integrity decisions

• App & Asset Protection

  Protecting code and bundled assets helps reduce the impact of reverse engineering, repackaging, and extraction of embedded material - especially in high‑value regulated apps.

  Capabilities:

  • Android DEX encryption at rest with runtime integrity checks
  • Asset encryption and checksum validation (Androis and iOS)
  • Encrypted configuration and protected handling for sensitive app material (e.g., API keys, allowlists)
  • Integrity checks for dynamic libraries/dependencies (optional startup verification where applicable)
  • Safe dependency/network patterns for third-party SDKs (e.g., allowlisting and controlled routing - architecture dependent)

• Shield secrets and sessions

  Mobile apps place sensitive assets on public devices. MASC Core helps protect secrets and sessions with secure storage patterns and device‑bound controls.

  Capabilities:

  • Encrypted, device‑bound storage for keys, credentials, and tokens
  • Native PIN/password/biometric gates for sensitive storage access
  • Anti‑lifting and anti‑cloning patterns for protected items
  • Hardened key derivation mechanisms (where applicable)

• Network & API Protection

  All mobile apps depend on APIs. MASC Core hardens the network layer to improve confidentiality and integrity - especially for high‑risk calls.

  Capabilities:

  • Certificate pinning with rotation/update patterns

  • Hardened TLS / certificate validation behavior (avoid reliance on brittle trust assumptions)

  • Session binding options to reduce replay and token misuse (architecture dependent)

  • Optional message‑level payload protection for high‑risk operations

  • OAuth 2.0 token protection and cookie shielding 

  • WebSocket support and WebView routing controls (as supported)

• Demonstrated Proof of Possession (DPoP)

  Bearer tokens can be copied and replayed. With DPoP (RFC 9449), the app can present a cryptographic proof that it holds the right private key at the time of the request, making stolen tokens significantly harder to abuse.

  MASC Core can generate and sign DPoP proofs and can be integrated with your authorization infrastructure (and/or server‑side verification components) to validate proof objects and enforce policy.

• Cryptographic operations & crypto agility

  MASC Core supports cryptographic operations used in protected mobile flows - designed to help teams adopt crypto agility and reduce long‑term dependency on fixed algorithms.

  Capabilities:

  • Crypto agility patterns (including PQC‑ready options, depending on deployment requirements)

  • Key generation and signing flows for transaction security / dynamic linking type use cases (program dependent)

  • Signing and encryption utilities integrated into protected flows, without embedding sensitive key material in app code

  Need centralized policy and server‑side verification for these signals?  Explore MASC Assurance

• Development and implementation

  CI/CD integration:

  • Native SDKs for Android and iOS with tutorials, API docs, and sample apps

  • Separate development / testing / production build profiles

  • ConfPacker for encrypted YAML configuration (if you keep this, add a 6–10 word explainer: “encrypts and packages runtime configuration”)

  • Gradle and Xcode integration with prebuilt configs for dev/prod

  • Designed for minimal code changes and low overhead (benchmarks available on request)

  • Compatible with server‑side verification services when used (deployment model varies)

• PLATFORM SUPPORT

  Android: API 24 (Android 7.0) and up

  iOS: iOS 9 and up

  Frameworks supported:

  • Native: Kotlin, Java, Swift, Objective‑C

  • Hybrid (scope documented): React Native, Flutter, Cordova, Kotlin Multiplatform