Mobile app attestation
Mobile app attestation is a platform service that issues a signed statement about the genuineness of an application and the integrity of the device it is running on, which the application’s backend then verifies. It moves the trust decision off the device, which is what client side integrity checks cannot do.
The mechanism is a chain of signatures the attacker cannot forge. The operating system, backed by hardware on modern devices, produces a token asserting that this is the genuine application, installed by the expected distribution channel, on a device that passes the platform’s integrity checks. The application sends that token with its request, and the server validates the signature against the platform’s public keys before deciding what to allow. Both major platforms provide such a service.
It is a real improvement on root and jailbreak detection because the verdict is produced and checked outside the attacker’s control. It is not absolute: it says nothing about a device compromised below the level the platform can observe, it depends on services the application must reach, and it excludes users on older or unsupported devices, which is a product decision as much as a security one.
The implementation failure we find is monotonous. The token is requested and sent, and the backend either does not verify the signature, accepts a token without checking it was issued for this request, or verifies it and proceeds anyway because rejecting users caused support tickets. A replayed token from a clean device then covers a modified one. Like certificate pinning, this is a control the client believes is deployed and the server behaviour says otherwise, which is why it is checked directly in the mobile testing where the backend’s verification of the attestation is checked, not just its presence.