Android security model (sandboxing, app permissions, SELinux), iOS security (code signing, sandbox, XNU kernel), App lifecycle and inter-process communication (Intents, AIDL, XPC), Secure boot chain and verified boot,...
Android security model (sandboxing, app permissions, SELinux), iOS security (code signing, sandbox, XNU kernel), App lifecycle and inter-process communication (Intents, AIDL, XPC), Secure boot chain and verified boot, Mobile device management (MDM) frameworks, Root/jailbreak detection bypasses, Hardware security (TEE, ARM TrustZone).
Static analysis (MobSF, QARK), Dynamic analysis (Frida, Objection), Reverse engineering (APKTool, Hopper, IDA), Common vulnerabilities (insecure storage, hard-coded secrets, improper IPC), OWASP Mobile Top 10, Certificate pinning bypass, Runtime hooking and SSL pinning evasion, Binary protection (obfuscation, RASP).
802.11 wireless fundamentals (WEP, WPA, WPA2, WPA3), Wi-Fi attack vectors (evil twin, KRACK, PMKID), Enterprise security (802.1X/EAP methods: PEAP, EAP-TLS), Bluetooth Low Energy (BLE) security (pairing modes, Just Works vulnerability), BLE attacks (knob turning, spoofing), Zigbee/IoT protocol security, Wireless IDS/IPS.
GSM/CDMA vulnerabilities (A5/1 cracking, IMSI catchers), LTE/4G security (EPS-AKA, SUCI encryption), 5G security architecture (SUPI concealment, SEAF authentication), Mobile network attacks (SS7 exploitation, Diameter signaling), IMS/SIP security, Roaming security risks, SIM toolkit and OTA attacks, eSIM security.
Mobile malware evolution (banking trojans, spyware), Phishing and social engineering vectors, MDM bypass and enterprise compromise, Mobile forensics (logical, file system, physical extraction), JTAG/ISP chip-off methods, Anti-forensics (app shredders, secure erase), Mobile security frameworks (MASA, GSMA NESAS).