I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider in my testing.

Security Testing

Malicious Functionality (Activity monitoring and data retrieval)

  1. Unauthorized dialing, SMS, and payments
  2. Unauthorized network connectivity (exfiltration or command & control)
  3. UI Impersonation
  4. System modification (rootkit, APN proxy config)


  1. Sensitive data leakage (inadvertent or side channel)
  2. Unsafe sensitive data storage
  3. Unsafe sensitive data transmission
  4. Hard-coded password/keys

Any help or pointers are highly appreciated.


Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing.

That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security Development Lifecycle to ensure that the application is designed and built with security in mind.

This starts as a discussion with your architect, and stakeholders.

| improve this answer | |

Hope the below link is helpful for you...


| improve this answer | |
  • 1
    This answer would be more helpful if it were to summarize (or at least mention) the salient points of that article. – user246 Dec 18 '13 at 16:12

Have you looked at the OWASP top 10 mobile risks? https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks

Compare those to the ones in your list

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.