Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider in my testing.

Security Testing

Malicious Functionality (Activity monitoring and data retrieval)

  1. Unauthorized dialing, SMS, and payments
  2. Unauthorized network connectivity (exfiltration or command & control)
  3. UI Impersonation
  4. System modification (rootkit, APN proxy config)

Vulnerabilities

  1. Sensitive data leakage (inadvertent or side channel)
  2. Unsafe sensitive data storage
  3. Unsafe sensitive data transmission
  4. Hard-coded password/keys

Any help or pointers are highly appreciated.

share|improve this question
add comment

4 Answers 4

up vote 2 down vote accepted

Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing.

That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security Development Lifecycle to ensure that the application is designed and built with security in mind.

This starts as a discussion with your architect, and stakeholders.

share|improve this answer
add comment

Hope the below link is helpful for you...

http://palpapers.plynt.com/issues/2009Apr/mobile-application-security-testing/

share|improve this answer

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

1  
This answer would be more helpful if it were to summarize (or at least mention) the salient points of that article. –  user246 Dec 18 '13 at 16:12
add comment

Have you looked at the OWASP top 10 mobile risks? https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks

Compare those to the ones in your list

share|improve this answer

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

add comment

Few scenarios which I can suggest here:

Unauthorized dialing - if a user can dial, even if screen is locked etcc.. or keep some proxy on device, capture the network traffic using freeware like charles and analyse what kind of information is being passed .. etc.

SMS - You can check if SMS doesn't contain sensitive information like credit card number etc.. also if there is any log created on successful sending a sms, failure of sms or network failure, then log shouldn'y have any sensitive information. etc..

payments - you can check if any scripting tag like alert("11") can be executed successfully on any web page while making a payment etcc..

UI Impersonation - same as payments, just check if UI is disturbed on entering any scripting or html tags etc..

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.