Mobile App Security Test

Mobile security testing shall include security testing of the mobile app (e.g. iOS or Android), mobile application backend (e.g. web services or APIs that send or receive data from the app), and the encryption between them. The eventual goal of mobile security testing is to ensure that the mobile ecosystem is secure, private and respond to the enacted regulatory standards such as PCI DSS or GDPR. Mobile security testing may be both manual (mobile penetration testing) and automated (mobile vulnerability scanning).

Mobile security threats lay in the mobile app, its backend and may also involve insufficient or missing encryption between them. Most of the security threats and known privacy weaknesses of the mobile app (e.g. iOS or Android ones are comprehensively covered by OWASP Mobile Top 10 list) require some specific conditions in order to be exploited (e.g. presence of attacker in the same network as the victim, theft of a device, or a pre-installed malware app on the victim’s device) and thus few of them may be considered critical issues.

The vulnerability laying in the mobile app backend (e.g. micro services and APIs that get or send data to the mobile app) may contain critical security vulnerabilities allowing the attacker, for example, to get the entire database of all users who use the mobile app. The range of such vulnerabilities is pretty broad and is well described by SANS Top 25 list of vulnerabilities. Finally, missing or weak encryption of the data sent by the mobile app to its backend may lead to a compromise of an individual user if attacker has access to the network by which the data transits.

Most of the mobile security vulnerabilities are described by OWASP Mobile Top 10 list. They include various weaknesses and misconfigurations of the mobile app, both iOS and Android ones, that under certain circumstances may allow attacker to compromise the mobile app’s data security, the mobile device or even the entire mobile infrastructure that serves all users of the mobile app.

For example, a hardcoded password or API key may jeopardize all users of the mobile app at once, while missing or insecurely configured HTTPS data encryption between the mobile app and its backend (e.g. web services or APIs that send or receive data from the app) will likely impact only a specific user if attacker has access to the network by which the data is sent over. You may test mobile security vulnerabilities impacting your iOS and Android mobile app by using free online mobile scanner provided as a part of ImmuniWeb Community Edition.

OWASP is a non-profit organization dedicated to application security and driven by open community of security professionals from almost all countries around the globe. OWASP Top 10 is a list of most popular web application vulnerabilities which is updated every three years. OWASP Mobile Top 10 is a list of most common mobile application weaknesses that is also regularly updated. There are some controversies around these lists related to inclusion or exclusion of some specific types of vulnerabilities. Therefore, it’s recommended to enhance OWASP Top 10 testing a more inclusive list of security flaws such as SANS Top 25 for example.

Mobile application shall be tested for security, privacy and compliance threats that may endanger not just the individual user of mobile app but the entire ecosystem of the mobile application such as external databases storing data from all users of the application. The most popular ways of mobile application security testing are static (SAST), dynamic (DAST) and interactive (IAST) testing. SAST usually involves access to the application source code, or runs fuzzing of the binary under certain circumstances. DAST implies fuzzing and scanning of a running mobile application by interacting with various built-in features and capacities of the app.

While IAST is a sort of combination of SAST and DAST enhanced with various correlating mechanisms. To verify whether the mobile application security is weakened by vulnerable third-party or native libraries, it is also recommended to run Software Composition Analysis (SCA) testing of the app. You may launch all these tests on your iOS or Android app by using free online mobile scanner by ImmuniWeb Community Edition.

iOS is deservingly considered to be a secure operating system for mobile devices. It is a proprietary, closed-source system by Apple. Its closeness makes external vulnerability research time-consuming and complicated. Importantly, all mobile apps available in Apple Store are rigorously vetoed and regularly monitored by Apple security professionals to remove malicious apps or apps that may jeopardize user privacy.

Moreover, Apple’s security ecosystem also involves proprietary security mechanisms embedded into its hardware, making some attack vectors against the devices unfeasible on all levels. Therefore, compared to other modern mobile vendors, Apple’s consolidated approach to device security effectively advances iOS operating system among other mobile operating systems. To preserve iOS security avoid jailbreaking your device unless you have a clear a specific goal to do so, and you understand all the risks you get from a jailbroken device.

iOS is considered to be a secure, proprietary system maintained and continuously improved by Apple. To ensure that your installation of iOS is secure, first make sure that your device is up2date. Apple regularly releases security and reliability patches, and installing them in a timely manner is essential for your device security.

Then make sure all of the installed mobile applications are likewise up2date, and consider removing those apps that you don’t use to minimize exposure of your device to app-specific vulnerabilities. Finally, make sure you have 8-digit or stronger device PIN code, or even a pass phrase, to make data extraction attacks harder for an attacker when your device is stolen or lost.

Given the variety of Android versions maintained by different vendors, and the openness of the app ecosystem, Android security largely depends on the device and specific branch and version of Android operating system that you have. It is essential to ensure that your Android device is up2date, that vendor timely releases security updates and enables smooth mechanism to automatically install newly available security updates.

Once you are confident that your device operating system is up2date, revise carefully installed applications you have and especially their permissions. This is because it is common for malicious developers to request many intrusive permissions to be granted by non tech-savvy users, and additionally older versions of Android have insecure mechanisms of permission management by granting a permanent permission to application (upon its installation) to access your camera or SMS for example. Finally, avoid rooting your Android device unless you have a specific goal to do so, and understand the security and privacy risks it may bring.

SAST stands for Static Application Security Testing. It implies access to the source code, or sometimes a binary, of the application for testing. DAST is Dynamic Application Security Testing and involves fuzzing and scanning or a running application to interact with its features and functionalities while the application runs.

Both methods have different pros and cons, and it is recommended to combine them in order to attain highest vulnerability coverage and ensure holistic security testing. You may run both SAST and DAST security testing of your mobile app via free online security test by ImmuniWeb Community Edition.