Scan results

Recommendation: Use With Caution

The app controls MOVA and Dreame brand robot vacuums and smart home devices but embeds backend authentication information directly in the installable file, enabling backend access if the file is extracted. Analytics and behavioral data are shared with multiple providers, including ByteDance, Umeng, and Aliyun, that are not reflected in the App Store privacy label. JavaScript bridge interfaces in the in-app browser lack origin validation, which may allow a network attacker to access device identifiers or initiate payment actions without user interaction.

Key Findings

Data Security - 1 finding (1 low)

Network Security - 1 finding (1 medium)

Code Safety - 6 findings (1 critical, 1 high, 2 medium, 2 low)

Privacy - 0 findings

Privacy Concerns

What Leaves the Device

• Device identifiers and install IDs: sent to ByteDance Rangers Analytics (BDAutoTrack), with GPS tracking capability, for behavioral analytics
• Wi-Fi network name: may be exposed to ByteDance through the in-app browser analytics bridge
• Device signals and identifiers: sent to BDASignalSDK (ByteDance) for device signal collection
• Analytics and usage data: sent to Umeng Analytics (Alibaba) for performance tracking
• Device and app data: sent to Aliyun EMAS (Alibaba Cloud) for cloud infrastructure services
• Crash reports: sent to Firebase Crashlytics for stability monitoring
• Advertising identifiers (with user consent): may be sent to Facebook SDK for analytics and attribution

What Stays on the Device

No sensitive data was identified as processed only on the device.

Third-Party Data Sharing

Third parties that may receive data from the app:

• ByteDance Rangers Analytics (BDAutoTrack) - behavioral analytics and device tracking
• BDASignalSDK (ByteDance) - device signal collection and fingerprinting
• Facebook SDK - advertising and analytics
• Umeng Analytics (Alibaba) - app usage analytics
• Aliyun EMAS (Alibaba Cloud) - cloud infrastructure services
• Firebase Crashlytics - crash and stability reporting
• FingerprintJS - device fingerprinting
• Baidu Mobile Ads - advertising
• AMap / Gaode Maps - mapping and location services
• Tencent IoT Explorer - IoT device connectivity
• Agora - real-time voice and video communication
• PayPal PPRiskMagnes - payment fraud detection
• Zendesk - customer support
• Google Sign-In - account authentication
• AWS Cognito / AWS IoT - cloud authentication and device connectivity
• OpenInstall - app install attribution
• GetUI - push notification delivery

Understanding the Scores

Security: 58/100
Privacy: 78/100

Security Breakdown

• Data Security: 80/100. Login session information is stored in the iOS Keychain, which provides strong protection for account access. Some app files may remain accessible while the device screen is locked due to a weaker file protection configuration in the storage layer.
• Network Security: 77/100. Standard HTTPS is used for most communications. The MQTT IoT layer links SSL bypass flags that, if active at runtime, may allow a network attacker to intercept device commands and sensor readings.
• Code Safety: 66/100. Backend authentication information and encryption keys are embedded directly in the installable app file and can be recovered without any specialized tools. The Alipay and ByteDance in-app browser bridges do not validate the origin of web content before accepting calls, which may allow injected content to initiate payments or read device identifiers.

Privacy Breakdown

• Data Collection: 83/100. The ATT consent framework is integrated to gate advertising identifier access before any collection occurs. Firebase is limited in scope to crash reporting. Multiple analytics SDKs from ByteDance and Alibaba collect behavioral and persistent device identity data.
• Data Sharing: 82/100. Data flows to a broad set of analytics and infrastructure providers. ByteDance, Umeng, and Aliyun receive device and behavioral data that the App Store privacy label does not currently disclose.
• User Control: 87/100. The ATT consent framework gives users control over advertising identifier access before it is used. Zendesk integration provides a direct customer support channel, and Google Sign-In is available as an alternative account option.

Positive Security Features

• Login session information is stored in the iOS Keychain, providing stronger protection than unencrypted files or system settings storage.
• Apple's device integrity framework is integrated to detect and block connections from compromised devices before they can interact with the backend.
• The ATT consent framework is integrated, requesting user permission before any advertising identifier is accessed.
• Widget data is shared only within the developer's own first-party app group and is not accessible to third-party services.
• Firebase is limited to crash reporting and does not contribute to behavioral analytics or advertising data flows.

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Accurate App Store Privacy Label
   The App Store privacy label should reflect all third-party data flows, including data shared with ByteDance, Umeng, and Aliyun, to align with Apple's data collection disclosure requirements and give users an accurate picture before download.

2. Privacy Manifest
   Adding an app privacy manifest could make the App Store privacy label more complete and improve transparency around third-party SDK data usage.

Security Enhancements

1. Remove Embedded Backend Access Information
   Backend authentication information and encryption keys shipped inside the installable app file can be extracted by anyone with a copy of the app. Moving to server-side or runtime-fetched access information would prevent unauthorized backend access.

2. Strengthen IoT Encryption
   The IoT communication layer uses a static embedded encryption key with a basic cipher configuration that does not protect against block-level pattern analysis or command-substitution attacks. Using authenticated encryption with randomly generated session keys would make IoT traffic significantly more resilient.

3. Add In-App Browser Origin Validation
   The Alipay and ByteDance JavaScript bridges in the in-app browser do not validate the origin of web content before accepting method calls. Adding origin checks would prevent a network attacker from using injected content to initiate payments or read device identifiers.

4. Enable Stronger File Protection
   Applying the strongest iOS file protection level app-wide would ensure that stored app data cannot be accessed while the device screen is locked.

5. Remove Development Endpoints
   Development and staging server addresses present in the production build should be removed before release to reduce exposure through less-secured environments.

Technical Context

App Type: IoT smart home controller (robot vacuum management and home automation)
Classes Analyzed: Not applicable (iOS binary analysis)
Third-Party Services: 20 identified
Context Tags: iot, ads, third_party_risk, location, camera

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: MOVA Technology
Version: 1.6.3 (Build 334)
Analysis Date: 2026-08-04
Package: com.mova.smarthome

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 1.6.3 analyzed on 2026-08-04
• May not reflect server-side security controls
• Cannot detect all runtime behaviors