Securing Mobile Apps: Approov's Award-Winning Attestation Technology

Upwardly Mobile - Episode Title: Securing Mobile Apps: Approov's Award-Winning Attestation Technology

Welcome to Upwardly Mobile, the podcast exploring the latest innovations in mobile technology. In this episode, we delve into the critical world of mobile application security and explore a groundbreaking solution that's garnering industry recognition. We focus on Approov Limited and their patented app attestation technology (U.S. Patent 11,163,858 B2). This innovative approach addresses the growing challenge of ensuring the integrity and trustworthiness of mobile applications and their interactions with backend systems.Key

Discussion Points:

• The Growing Need for Mobile App Security: We discuss the vulnerabilities faced by mobile apps, including tampering, reverse engineering, and API abuse. Learn why simply authenticating users isn't enough to protect sensitive data and transactions.
• Introducing Approov's App Attestation Technology: We explain how Approov's technology works to verify the integrity of a running mobile application on the server-side. This involves cryptographic methods and runtime security checks to ensure that only legitimate, untampered app instances can access backend APIs.
• How Client Software Attestation Works (Based on the Patent):
  • A client software application calculates a cryptographic hash fingerprint of its executing code.
  • This fingerprint is communicated to an attestation service.
  • The attestation service generates a pass or fail result.
  • This result is communicated to the server, which can then control its behaviour based on the attestation outcome.
  • The system can employ challenge-response mechanisms using a nonce to prevent replay attacks.
  • Signed tokens can be used for indirect communication of the attestation status, secured with a shared secret key.
• Addressing Limitations of Native Platform Solutions: We highlight how Approov's cross-platform solution overcomes the limitations of platform-specific solutions like Apple's App Attest and Google's Play Integrity API, particularly concerning rooted or jailbroken devices.
• Real-World Impact and Use Cases: Discover how global leaders in sensitive industries like fintech, healthcare, retail, and automotive are using Approov to reduce fraud, enhance API security, and ensure compliance. We touch upon examples such as the BMW Group's car-sharing platform and fintech companies like Papara.
• Recognition and Awards: We celebrate Approov winning the Cyber Innovation Award at the 2025 Scottish Cyber Awards. This prestigious recognition underscores their pioneering work in mobile app security. Approov was also a finalist alongside other esteemed organisations.
• Alignment with Regulatory Frameworks: We discuss how Approov's technology supports compliance with emerging regulations like the EU Digital Markets Act (DMA) and the UK Digital Markets, Competition, and Consumers Bill (DMCC). We include a quote from Ted Miracco, CEO of Approov Limited, regarding the significance of the DMCC Bill.

Links:

• Approov Website (Sponsor): https://approov.io/
• Approov Patents: Search for US Patent 11,163,858 B2 on the USPTO website (uspto.gov)
• Application for Best Innovation in Cybersecurity Award for Scottish Companies: [Link to the PDF - 2021.11.02_US11163858.pdf in your source material]
• Approov Limited Shortlisted for Cyber Innovation Award at the 2025 Scottish Cyber Awards: [No direct link provided in source, search for "Approov Limited Shortlisted Scottish Cyber Awards 2025"]
• Winners announced for the 2025 Scottish Cyber Awards: