NIIS 9 reviews iOS and Android products as compositions: application code, OS services, hardware-backed keys, and every radio the SDK requested. The interesting bugs are rarely “SQL injection in a mobile skin.” They are confused deputies between apps, leftover backup surfaces, WebViews that launder origin, and Bluetooth permissions that turn a lifestyle app into a beacon logger.
Typical questions
- What can another app on the same device learn, induce, or intercept?
- What can a local radio peer do without unlocking the phone?
- Which secrets live in hardware, which live in the filesystem, and which live in a vendor’s analytics pipeline?
- Does attestation prove the thing the product thinks it proves?
Method on mobile
Reviews combine threat modeling of the client, radio, and backend system with hands-on analysis of the shipped builds. Platform-specific controls (attestation, biometric gates, permission states, backup exclusion, clipboard, screenshot, notification leakage) are treated as controls to be validated, not slogans to be copied into a report.
Third-party SDKs are modeled as co-tenants. If they can reach location, Bluetooth, or install referrers, they belong on the data-flow diagram beside the product’s own code.