[PDF] Fixing Mobile AppSec The OWASP Mobile Security Testing Project PDF OWASP_Day_Indonesia_2017_-_Fixing_Mobile

•One of the project leaders for the OWASP Mobile Security Testing Guide (MSTG) and Mobile •Focusing on iOS and Android native applications •Goal is to

Security • Expert for Mobile App Testing • Developed the Mobile Security Testing Motivation for Mobile Security Testing Guidelines for Android and iOS

[PDF] Fixing Mobile AppSec The OWASP Mobile Security Testing Project

•One of the project leaders for the OWASP Mobile Security Testing Guide (MSTG) and Mobile •Focusing on iOS and Android native applications •Goal is to

[PDF] Introduction to Mobile Security Testing - German OWASP Day

Example: Android decompiled source code Vulnerability Analysis Manual OWASP, Mobile Security Testing Guide, 2018 (0x05a-Platform-Overview html)

[PDF] OWASP Mobile Security Testing Guide

Sven is an experienced penetration tester and security architect who specialized in implementing secure SDLC for web application, iOS and Android apps He is a

[PDF] Analysis of testing approaches to Android mobile - CEUR-WSorg

The Mobile Security Testing Guide (MSTG): The MSTG is a manual for testing the security of mobile apps It provides verification instructions for the requirements

[PDF] OWASP MOBILE SECURITY TESTING GUIDE - RandoriSec

10 déc 2019 · MOBILE SECURITY TESTING: LE GUIDE ▸ 3 grandes parties : une section générale, une section Android, une section iOS ▸ + 500 pages

[PDF] Penetration Testing of Android-based Smartphones - CORE

Nmap 5 5: Nmap is a popular and widely useful tool for port scanning It includes a network scanning guide and it is a free and open source utility for network

[PDF] Mobile Application Security Testing - Deloitte

rooted Android devices along with specialised tools are required to execute fine grained mobile app security tests Skill sets Mobile app security testing requires

[PDF] MOBILE APPLICATION SECURITY WITH OPEN-SOURCE TOOLS

Android mobile app asks for permissions like any other app when installing in the controls to mitigate such risks, security tools, mobile security testing guide,

VANTAGEPOINT

Fixing Mobile

The OWASP Mobile Security Testing

Project

/usr/bin/whoami

Hi everyone my name is Sven.

Principal Security Consultant at Vantage Point Security

Based in Singapore, originally from Germany

Unix nerd since 1999

Professional Penetration tester since 2010

Security Architect for Web and Mobile Apps during SDLC One of the project leaders for the OWASP Mobile Security Testing Guide (MSTG)

Why Mobile Application Security?

Application

Attack Surface

It all started with Network &

Protecting the perimeter

Ensuring endpoints are

Network Security still plays

an important part

But, different skills are

Common Situation

Key Pain Points

development teams the development life cycle technologies

Impact

OWASP Mobile Security Project - Our ͞Products"

Mobile Security

Testing Guide

Printed Book!

Mobile AppSec

PDF Download

Mobile AppSec

Excel I

security https://github.com/OWASP/ OWASP Mobile Application Security Verification Standard (MASVS)

Started as a fork of the ASVS

Formalizes best practices

Mobile

OWASP Mobile Application Security Verification Standard (MASVS) Sample Question: Do we recommend using E2E encryption? OWASP Mobile Application Security Verification Standard (MASVS) Sample Question: Do we recommend using E2E encryption? Pros

Additional security layer

Protects data in case TLS tunnel

Protects data from exposure to

Introduces additional complexity

Implementation prone to errors

Adds security by obscurity

Makes testing difficult

False sense of security

Doesn't add much security beyond what

TLS already provides

OWASP Mobile Application Security Verification Standard (MASVS)

Our Philosophy

19 Defense

13 8 OWASP Mobile Application Security Verification Standard (MASVS) OWASP Mobile Application Security Verification Standard (MASVS)

MASVS all

OWASP Mobile Application Security Verification Standard (MASVS) MASVS OWASP Mobile Application Security Verification Standard (MASVS) MASVS (Optional) Tamper OWASP Mobile Application Security Verification Standard (MASVS)

Level 1 vs. Level 2

Might be overkill

for some apps! OWASP Mobile Application Security Verification Standard (MASVS)

Ok, so why are security

requirements so important?

To avoid this:

Pentesters

turning a report in... OWASP Mobile Application Security Verification Standard (MASVS) Ok, so why are security requirements so important? They enable you to build security into the app from the beginning They should be identified and defined already in the early stages of the SDLC Security requirements should be mapped to the user stories / journeys to address OWASP Mobile Application Security Verification Standard (MASVS) Goal:

Ok, so why are security

requirements so important? OWASP Mobile Application Security Verification Standard (MASVS)

How To Use the MASVS (as Developer)

What MASVS level (L1, L2, R) and requirements are appropriate for the app? Use the MASVS as starting point and extend it with custom requirements as needed All involved parties need to agree on the decisions made This is the basis for all design decisions and security activities Track the security requirements during development and implement them:

Ideally in your issue tracking (e.g. Jira)

Excel Checklist is available as an alternative

OWASP Mobile Application Security Verification Standard (MASVS)

How To Use the MASVS (as Security Tester)

Share the status of your security requirements with the Penetration Tester This will allow him to focus on specifically these security controls Makes testing more efficient, as things like SSL Pinning might be out of scope according to your decision and then it won't be raised as ǀulnerability Makes testing consistent and tester and developers are on the same page OWASP Mobile Security Testing Guide Standard (MSTG) What is the Mobile Application Security Testing Guide? Manual for testing security maturity of mobile Apps

Maps directly to the MASVS requirements

Focusing on iOS and Android native applications

Goal is to ensure completeness of mobile app security testing through a consistent For security checks of the endpoint the OWASP Web Application Testing Guide should be used OWASP Mobile Security Testing Guide Standard (MSTG)

Structure

Gitbook:

General Testing Guide

Android Testing Guide

iOS Testing Guide

Platform Overview

Security Testing Basics

Test Cases

Reverse Engineering

OWASP Mobile Security Testing Guide Standard (MSTG)

Example of some Key Topics

Clarify how data can be stored on iOS and Android

Check the usage of cryptographic functions

Testing Platform Interaction

App permissions

Verify usage of Interprocess communication (IPC)

Check the implementation of WebViews

Biometric Authentication (Touch ID)

OWASP Mobile Security Testing Guide Standard (MSTG)

MSTG -

Security Testers have no good

protection schemes

MSTG -

Developers and Pentesters are confused

lack of obfuscation" as a critical security issue.

MinifyEnabled = true?

Maybe encrypt strings?

Apply complex control flow obfuscation?

Maybe use some whitebox crypto?

We want to develop a proper assessment methodology.

MSTG -

Skills needed for assessing ant

Every software protection scheme can be defeated.

Never to be used as replacement for security controls

Viable uses: IP

Traditional the domain of malware reversers

MSTG -

Building a reverse engineering requirements for free

Static and dynamic analysis

MSTG -

Tampering, patching and runtime instrumentation

MSTG -

Testing Anti

Root Detection

Anti

Detecting Reverse Engineering Tools

Emulator Detection / Anti

File and Memory Integrity Checks

Device Binding

Obfuscation

MSTG -

Some Original Research

Android ART: Anti

Frida Detection

Frida server detection by local portscan

Memory scan to detect Frida agent/gadget artefacts

Some variations of ptrace

See chapter ͞Testing Anti-Reǀersing Defenses" Also, see blog posts from Bernhard Mueller: http://goo.gl/hsU6bS

MSTG -

Practical Challenges!

Check out the "

MSTG -

Ongoing Work

Obfuscation Metrics

https://github.com/b

Assessment Methodology

https://github.com/OWASP/owasp

Reverse

Help is always needed!

MSTG

65 Contributors according to GitHub

https://github.com/OWASP/owasp Big Thanks to everybody that was already supporting the project! MSTG We are still looking for people to support the project. So how to get started contributing RTFM:

Slack:

Issues:

Resources

MASVS on GitHub

MSTG as GitBook

https://b

VANTAGEPOINT

Thank you. Any questions?

sven@vantagepoint.sg / sven.schleier@owasp.orgquotesdbs_dbs14.pdfusesText_20

[PDF] [PDF] Fixing Mobile AppSec The OWASP Mobile Security Testing Project

VANTAGEPOINT

Fixing Mobile

The OWASP Mobile Security Testing

Project

Hi everyone my name is Sven.

Based in Singapore, originally from Germany

Unix nerd since 1999

Professional Penetration tester since 2010

Why Mobile Application Security?

Application

Attack Surface

It all started with Network &

Protecting the perimeter

Ensuring endpoints are

Network Security still plays

But, different skills are

Common Situation

Key Pain Points

Impact

OWASP Mobile Security Project - Our ͞Products"

Mobile Security

Testing Guide

Printed Book!

Mobile AppSec

PDF Download

Mobile AppSec

Excel I

Started as a fork of the ASVS

Formalizes best practices

Mobile

Additional security layer

Protects data in case TLS tunnel

Protects data from exposure to

Introduces additional complexity

Implementation prone to errors

Adds security by obscurity

Makes testing difficult

False sense of security

Doesn't add much security beyond what

TLS already provides

Our Philosophy

19 Defense

MASVS all

Level 1 vs. Level 2

Might be overkill

Ok, so why are security

To avoid this:

Pentesters

Ok, so why are security

How To Use the MASVS (as Developer)

Ideally in your issue tracking (e.g. Jira)

Excel Checklist is available as an alternative

How To Use the MASVS (as Security Tester)

Maps directly to the MASVS requirements

Focusing on iOS and Android native applications

Structure

Gitbook:

General Testing Guide

Android Testing Guide

Platform Overview

Security Testing Basics

Test Cases

Reverse Engineering

Example of some Key Topics

Clarify how data can be stored on iOS and Android

Check the usage of cryptographic functions

Testing Platform Interaction

App permissions

Verify usage of Interprocess communication (IPC)

Check the implementation of WebViews

Biometric Authentication (Touch ID)

MSTG -

Security Testers have no good

MSTG -

Developers and Pentesters are confused

MinifyEnabled = true?

Maybe encrypt strings?

Apply complex control flow obfuscation?

Maybe use some whitebox crypto?