Home / Attacks & tests / UI Security Vulnerabilities
4 test cases
UI Security Vulnerabilities
UI security testing examines whether what the user sees is a reliable account of what they are doing, and whether decisions the interface appears to enforce are actually enforced anywhere else.
What an attacker is trying to achieve
The attacker wants the user's genuine, deliberate interaction to be captured by something other than the interface they believe they are using — or, from the other direction, wants to remove a restriction the interface imposes because nothing behind it repeats the check.
Test cases
4 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
Android
Android permits applications to draw over others and to observe window state, so overlay attacks are the principal concern.
AND-UISEC-01 Tapjacking and Overlay Attacks
Objective — Determine whether another application can draw over the target's interface so that a user's tap reaches a control other than the one they believe they are pressing.
How it is tested — Identify the views carrying consequential actions — permission grants, payments, transfers, deletions, consent. From a test application, draw an overlay above each and establish whether touches still reach the target. Determine whether the application requests that obscured touches be discarded, and whether it does so on every consequential view rather than one. Establish whether an overlay can observe which view is displayed.
Prerequisites — A device; a test application able to draw overlays; the list of views with consequential actions.
Indicators — Touches reaching a consequential control while obscured; obscured-touch filtering absent or applied unevenly; the displayed view inferable by another application.
Coverage — MASVS-PLATFORM-3CWE-1021CWE-451
Depth — Manual Confirmation requires a second application drawing over the target; the code alone does not show whether filtering is applied where it matters.
AND-UISEC-02 Client-Side Authorization Decisions in the Interface
Objective — Determine whether functionality the interface hides or disables is genuinely unavailable, or merely not offered.
How it is tested — Identify controls that are hidden, disabled or absent for the current user, and establish what data drives that decision. Modify that data, in the server response and in the running application, so the controls become available, then use them. Establish whether the server refuses the resulting operations or performs them. Include entire screens the navigation never offers to this role.
Prerequisites — Two accounts at different privilege; a proxy able to modify responses; a device permitting instrumentation.
Indicators — A hidden control's operation succeeding when invoked; a screen reachable by instrumentation that the navigation withholds; entitlement enforced only by what is rendered.
Coverage — MASVS-AUTH-1MASVS-CODE-4CWE-602CWE-285
Depth — Manual The test is whether the server repeats the interface's decision, which requires driving the operation past the interface.
iOS
iOS does not permit one application to draw over another, so the emphasis moves to what the interface reveals and to whether its restrictions are enforced behind it.
IOS-UISEC-01 Interface Spoofing and Overlay Exposure
Objective — Determine whether the application's own interface can be made to misrepresent what the user is doing, or reveal content it should withhold.
How it is tested — Establish whether any part of the interface renders content from outside the application — web views, notification content, message bodies, deep-link parameters — that could present a convincing prompt for credentials or approval. Test whether incoming links can display a view that appears to be a system or authentication prompt. Establish whether sensitive fields are obscured from screenshots and screen recording.
Prerequisites — A device; the ability to send crafted links and content into the application; the list of views handling credentials or approval.
Indicators — Externally supplied content rendered in a way that resembles a system prompt; a link displaying a credential-collecting view; sensitive fields captured in screenshots or recordings.
Coverage — MASVS-PLATFORM-3CWE-451CWE-1021
Depth — Manual Judging whether a rendering is convincing enough to mislead is a human assessment.
IOS-UISEC-02 Client-Side Authorization Decisions in the Interface
Objective — Determine whether functionality the interface withholds is genuinely unavailable, or merely not presented.
How it is tested — Identify controls and screens hidden or disabled for the current user, and establish what data drives that decision — a role in a response, a subscription state, a feature flag. Modify it in transit and by instrumenting the running application, then invoke the operations it unlocks. Establish whether the server refuses them. Include purchase-gated features, where the entitlement is often decided entirely on the device.
Prerequisites — Two accounts at different entitlement; a proxy able to modify responses; a device permitting instrumentation.
Indicators — A withheld operation succeeding when invoked; a purchase-gated feature unlocked by modifying client state; entitlement enforced only by what is rendered.
Coverage — MASVS-AUTH-1MASVS-CODE-4CWE-602CWE-285
Depth — Manual Requires driving the operation past the interface and confirming against the server.
What we need from you
A device; a second application able to draw over or alongside the target for the overlay cases; instrumentation for the client-side decision cases; and a proxy to establish whether the server repeats any check the interface makes.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- MASVS-PLATFORM-3 — The app uses the user interface securely.
- CWE-1021 — Improper Restriction of Rendered UI Layers or Frames
- CWE-451 — User Interface (UI) Misrepresentation of Critical Information
- MASVS-AUTH-1 — The app uses secure authentication and authorization protocols and follows the relevant best practices.
- MASVS-CODE-4 — The app validates and sanitizes all untrusted inputs.
- CWE-602 — Client-Side Enforcement of Server-Side Security
- CWE-285 — Improper Authorization
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.