Mobile App Security Testing
Service Intro
Mobile App Security Testing
Today organizations are using Mobile Applications extensively for seamless business experience for its workplace and customers. These applications range from banking applications, healthcare platforms, m-commerce apps and other business applications. Identifying and mitigating security risks of these mobile apps are paramount for protecting the workforce and customers.
Methodology For Mobile App Security Testing
Discovery
You can get information about an app by going through third-party libraries, search engines, or finding the leaked source code by developer forums, and social media etc. Having an understanding of the platform is a relevant aspect of app penetration testing. In terms of creating the threat model for an application, it gives you a better brief from an external point of view.
Application Mapping
Identify the application details and map them to various aspects of threat profile created. Some parameters include (a) Key chains, brute-force attacks, parameter tampering (b) Malicious input, fuzzing (c) SQLite database password fields, configuration file encryption (d) Session IDs, time lockouts (e) Error and exception handling (f) Logs, access control to logs.
Client Side Attack Simulation
Key focus areas of client side attack simulation are (a) Interaction with platform (b) Local storage (c) use of encryption (d) binary & final analysis (e) insecure API calls and (f) files with adequate access controls.
Network Layer Attack Simulation
Network layer attack simulation include communication channel attacks, capturing network traffic and assessing transport layer protection.
Back-end / Server side attack simulation
Back-ends such as web services and API provides the application its intended functionality. Our testing team simulates attack of web services & APIs consumed by the mobile application.
Assessment/Analysis
Mobile apps have a special way of analysis or assessment, and the testers should check an app pre as well as post-installation. It can be performed through static analysis without executing the app, on the decompiled or provided accompanying files and source code or dynamic analysis which takes place while an app is running on the device. You can also perform the Archive Analysis where app installation packages for the iOS and Android platform will be extracted as well as inspected for reviewing configuration files. Reverse engineering can also be attempted for converting compiled apps into human-readable source code.
Reporting & re-tests
We will provide reports that detail the risks identified in the mobile application. The report includes recommendations for remediation and risk rating.Re-tests are performed to validate the closure of vulnerabilities.
Key Focus Areas of Mobile App Security Testing
01
Mobile App on device security
Analyse how the mobile application interacts with the platform in secure state and in the jailbreak state.
02
Local data storage security
Controls for protection of sensitive data, if stored locally, such as user credentials, private information
03
Data in Motion
Assessment of controls such as encryption while transmitting sensitive data to back-end systems
04
Authentication and Authorization
Assessment of authentication and authorization controls. Review of session and token management
05
Web services and API back-end
Assess the security of Web Services and API consumed by the mobile application
06
Manual Review
Our Mobile Application Security Assessment utilizes a great amount of manual testing
07
Reverse Engineering
We will simulate hacker techniques such as reverse engineering to understand the working of app
08
Binary & File Level Analysis
Review the application binary and perform file level analysis for identifying vulnerabilities
09
Mobile App Source code review
Perform automated and manual code review for identifying security weaknesses in the code.
Benefits for Mobile Penetration Testing?
The Mobile Application Security Audit provides you with end-to-end services which include app mapping as well as reverse engineering for identifying technical vulnerabilities in the mobile applications. This second phase of the project is to develop the controls to treat the risks identified.
NESA Risk Treatment Plan provides the directions for this phase of the implementation.
