I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider in my testing.

Security Testing

Malicious Functionality (Activity monitoring and data retrieval)

  1. Unauthorized dialing, SMS, and payments
  2. Unauthorized network connectivity (exfiltration or command & control)
  3. UI Impersonation
  4. System modification (rootkit, APN proxy config)


  1. Sensitive data leakage (inadvertent or side channel)
  2. Unsafe sensitive data storage
  3. Unsafe sensitive data transmission
  4. Hard-coded password/keys

Any help or pointers are highly appreciated.


Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing.

That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security Development Lifecycle to ensure that the application is designed and built with security in mind.

This starts as a discussion with your architect, and stakeholders.


Have you looked at the OWASP top 10 mobile risks? https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks

Compare those to the ones in your list


A good reference, which is also free and community driven, is the Mobile Security Testing Guide. It is a sister project to the OWASP Mobile Security Project. As the title suggests, it goes beyond just providing a "top ten" list, and provides details on security testing for mobile apps.

This would be a good place to start for most cases.


Hope the below link is helpful for you...


  • 2
    This answer would be more helpful if it were to summarize (or at least mention) the salient points of that article.
    – user246
    Dec 18 '13 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.