Mobile app security testing

Question

I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider in my testing.

Security Testing

Malicious Functionality (Activity monitoring and data retrieval)

1. Unauthorized dialing, SMS, and payments
2. Unauthorized network connectivity (exfiltration or command & control)
3. UI Impersonation
4. System modification (rootkit, APN proxy config)

Vulnerabilities

1. Sensitive data leakage (inadvertent or side channel)
2. Unsafe sensitive data storage
3. Unsafe sensitive data transmission
4. Hard-coded password/keys

Any help or pointers are highly appreciated.

Answer 1

Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing.

That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security Development Lifecycle to ensure that the application is designed and built with security in mind.

This starts as a discussion with your architect, and stakeholders.

Answer 2

Have you looked at the OWASP top 10 mobile risks? https://www.owasp.org/index.php/Projects/OWASP_Mobile_Security_Project_-_Top_Ten_Mobile_Risks

Compare those to the ones in your list

Answer 3

A good reference, which is also free and community driven, is the Mobile Security Testing Guide. It is a sister project to the OWASP Mobile Security Project. As the title suggests, it goes beyond just providing a "top ten" list, and provides details on security testing for mobile apps.

This would be a good place to start for most cases.

Answer 4

You can run static code analysis on the app.

This will give a detailed report on the possible security issues with your app.

There are some tools available which will help you to do so.

In fact, I have designed a web application which runs this analysis on .apk or .ipa files that a user would upload and displays the result of the scan in HTML format.

Feel free to explore https://thesecurityscan.com/

Answer 5

Mobile Application Testing is known as the testing of software application for mobile devices to verify their functionality, usability, security and performance to prevent fraud attacks on the mobile app, virus or malware infection to the mobile app. Mobile Application Security Testing includes the following:

1. Authentication,
2. Authorization,
3. Data security,
4. Vulnerabilities for hacking

Below are the Mobile App Security Testing tools:

1. Zed Attack Proxy: Is open-source security testing tool which is actively maintained by hundreds of international volunteers. It is easy to install and available in 20 different languages and also used as manual security testing.

2. QARK: IS an open-source tool that provides in-depth information about security vulnerabilities and generate a report about potential vulnerability and provide information about what to do in order to fix them.It highlights the issue related to the Android version also QARK scans all the component for security threats.enter link description here

Answer 6

Hope the below link is helpful for you...

http://palpapers.plynt.com/issues/2009Apr/mobile-application-security-testing/