Cyber Strategy
Cyber Secure
Cyber Operations
Cyber Response
Cyber Resilience
Menu
Cyber Secure
Services
Cyber Secure
Services
Mobile Application Security Testing
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Many mobile applications we have assessed recently across the region, indicate the need for continuous security assessment of mobile applications.
Poorly hardening and securely configured mobile applications by the software developers, often outsourced by organizations, do not even follow the most basic of security guidelines.
Mobile applications are increasing in numbers every day. Today more mobile phones / tablets accesses web applications than PCs. More than 90% of government services in UAE can be transacted through mobile applications. Increase in the use of mobile applications means, application vulnerabilities and thus security incidents that may impact the client device or backend systems that support the mobile application.
Mobile Application vulnerabilities often lead to customer privacy violations and/or data loss. Considering this, it is important to perform a holistic security review as part of your mobile application deployment strategy.
DTS expert team of mobile application security consultants offers a detailed security analysis of your mobile application as part of our Mobile Application Security Assessment service. Our testing methods use both automated testing as well as manual testing using a combination of Mobile Application Security Framework (MobSF), OS simulators and SDK kits. Our “automated tests” detects many of the common vulnerabilities of your mobile application. However, manual testing by our security experts uncovers much more issues than the automated tests especially during a grey-box test.
Our Mobile Application Security methodology is based on the OWASP Mobile Security project and performs tests both client application as well as the server-side testing.
Application Mapping
The initial step in the Mobile application security assessment is the mapping of the application for each type of the Operating System architecture. This will provide a detailed understanding of the application and the data flow, within the application as well as to the server.
- Application understanding
- Data Flow mapping
Network Attacks
In this stage, the communication channel between the client and the server undergoes the review and attack. Sensitive plain text traffic is retrieved by analyzing
- Installation traffic
- Run time traffic
Client-Side Attacks
In this stage, the focus of the testing is to understand the weaknesses on the client side. This includes the analysis of temporary storage, sensitive information and client-side encryption
- Binary Analysis and Identification of insecure APIs
- File system analysis for identification of sensitive files and weak encryption implementation
- Memory and Process analysis
Server-Side Attacks
The final phase of a mobile application security assessment is to assess the security of the server. In this, the server-side application would be tested to find out how it responds to various malicious requests.
- TCP attacks are performed to identify vulnerabilities such as Buffer Overflows
- HTTP Attacks are performed to identify application vulnerabilities such as XSS, SQL injection and other OWASP listed vulnerabilities
|
M1. Weak Server-Side Control |
Test Name |
| M1-01 | Excessive port opened at Firewall |
| M1-02 | Default credentials on Application Server |
| M1-03 | Exposure of Webservices through WSDL document |
| M1-04 | Security Misconfiguration on Webserver |
| M1-05 | Input validation on API |
| M1-06 | Information Exposure through API response message |
|
M2. Insecure Data Storage |
Test Name |
| M2-01 | Unrestricted Backup file |
| M2-02 | Unencrypted Database files |
| M2-03 | Hard-coded credentials |
| M2-04 | Insecure Shared Storage |
| M2-05 | Insecure Application Data Storage |
|
M3. Insufficient Transport Layer Protection |
Test Name |
| M3-01 | Insecure Transport Layer Protocols |
| M3-02 | SSL/TLS Weak Encryption |
| M3-03 | Disable certificate validation |
| M3-04 | Self-signed certificate |
|
M4. Unintended Data Leakage |
Test Name |
| M4-01 | Information Disclosure through Logcat/Apple System Log (ASL) |
| M4-02 | Exposing Device Specific Identifiers in Attacker Visible Elements |
| M4-03 | Application Backgrounding (Screenshot) |
| M4-04 | URL Caching (HTTP Request and Response) |
| M4-05 | Keyboard Press Caching |
| M4-06 | Copy/Paste Buffer Caching |
|
M5. Poor Authorization and Authentication |
Test Name |
| M5-01 | Bypassing business logic flaws |
| M5-02 | Remember Credentials Functionality (Persistent authentication) |
| M5-03 | Client Side Based Authentication Flaws |
| M5-04 | Client Side Authorization Breaches |
| M5-05 | Insecure version of Android OS Installation Allowed |
|
M6. Broken Cryptography |
Test Name |
| M6-01 | Cryptographic Based Storage Strength |
| M6-02 | Poor key management process |
| M6-03 | Use of custom encryption protocols |
|
M7. Client-Side Injection |
Test Name |
| M7-01 | Insufficient WebView hardening (XSS) |
| M7-02 | Content Providers: SQL Injection and Local File Inclusion |
| M7-03 | Injection (SQLite Injection, XML Injection) |
| M7-04 | Local File Inclusion through NSFileManager or Webviews |
|
M8. Security Decisions Via Untrusted Inputs |
Test Name |
| M8-01 | Abusing Android Components through IPC intents (“exported” and “intent-filter”) |
| M8-02 | Abusing URL schemes |
|
M9. Improper Session Handling |
Test Name |
| M9-01 | Session invalidation on Backend |
| M9-02 | Session Timeout Protection |
| M9-03 | Cookie Rotation |
| M9-04 | Token Creation |
|
M10. Lack of Binary Protections |
Test Name |
| M10-01 | Reverse Engineering the Application Code |
| M10-02 | Unauthorized Code Modification |
| M10-03 | Debug the application behavior through runtime analysis |
Mobile applications are increasing in numbers every day. Today more mobile phones / tablets accesses web applications than PCs. More than 90% of government services in UAE can be transacted through mobile applications. Increase in the use of mobile applications means, application vulnerabilities and thus security incidents that may impact the client device or backend systems that support the mobile application.
Mobile Application vulnerabilities often lead to customer privacy violations and/or data loss. Considering this, it is important to perform a holistic security review as part of your mobile application deployment strategy.
DTS expert team of mobile application security consultants offers a detailed security analysis of your mobile application as part of our Mobile Application Security Assessment service. Our testing methods use both automated testing as well as manual testing using a combination of Mobile Application Security Framework (MobSF), OS simulators and SDK kits. Our “automated tests” detects many of the common vulnerabilities of your mobile application. However, manual testing by our security experts uncovers much more issues than the automated tests especially during a grey-box test.
Our Mobile Application Security methodology is based on the OWASP Mobile Security project and performs tests both client application as well as the server-side testing.
Application Mapping
The initial step in the Mobile application security assessment is the mapping of the application for each type of the Operating System architecture. This will provide a detailed understanding of the application and the data flow, within the application as well as to the server.
- Application understanding
- Data Flow mapping
Network Attacks
In this stage, the communication channel between the client and the server undergoes the review and attack. Sensitive plain text traffic is retrieved by analyzing
- Installation traffic
- Run time traffic
Client-Side Attacks
In this stage, the focus of the testing is to understand the weaknesses on the client side. This includes the analysis of temporary storage, sensitive information and client-side encryption
- Binary Analysis and Identification of insecure APIs
- File system analysis for identification of sensitive files and weak encryption implementation
- Memory and Process analysis
Server-Side Attacks
The final phase of a mobile application security assessment is to assess the security of the server. In this, the server-side application would be tested to find out how it responds to various malicious requests.
- TCP attacks are performed to identify vulnerabilities such as Buffer Overflows
- HTTP Attacks are performed to identify application vulnerabilities such as XSS, SQL injection and other OWASP listed vulnerabilities
|
M1. Weak Server-Side Control |
Test Name |
| M1-01 | Excessive port opened at Firewall |
| M1-02 | Default credentials on Application Server |
| M1-03 | Exposure of Webservices through WSDL document |
| M1-04 | Security Misconfiguration on Webserver |
| M1-05 | Input validation on API |
| M1-06 | Information Exposure through API response message |
|
M2. Insecure Data Storage |
Test Name |
| M2-01 | Unrestricted Backup file |
| M2-02 | Unencrypted Database files |
| M2-03 | Hard-coded credentials |
| M2-04 | Insecure Shared Storage |
| M2-05 | Insecure Application Data Storage |
|
M3. Insufficient Transport Layer Protection |
Test Name |
| M3-01 | Insecure Transport Layer Protocols |
| M3-02 | SSL/TLS Weak Encryption |
| M3-03 | Disable certificate validation |
| M3-04 | Self-signed certificate |
|
M4. Unintended Data Leakage |
Test Name |
| M4-01 | Information Disclosure through Logcat/Apple System Log (ASL) |
| M4-02 | Exposing Device Specific Identifiers in Attacker Visible Elements |
| M4-03 | Application Backgrounding (Screenshot) |
| M4-04 | URL Caching (HTTP Request and Response) |
| M4-05 | Keyboard Press Caching |
| M4-06 | Copy/Paste Buffer Caching |
|
M5. Poor Authorization and Authentication |
Test Name |
| M5-01 | Bypassing business logic flaws |
| M5-02 | Remember Credentials Functionality (Persistent authentication) |
| M5-03 | Client Side Based Authentication Flaws |
| M5-04 | Client Side Authorization Breaches |
| M5-05 | Insecure version of Android OS Installation Allowed |
|
M6. Broken Cryptography |
Test Name |
| M6-01 | Cryptographic Based Storage Strength |
| M6-02 | Poor key management process |
| M6-03 | Use of custom encryption protocols |
|
M7. Client-Side Injection |
Test Name |
| M7-01 | Insufficient WebView hardening (XSS) |
| M7-02 | Content Providers: SQL Injection and Local File Inclusion |
| M7-03 | Injection (SQLite Injection, XML Injection) |
| M7-04 | Local File Inclusion through NSFileManager or Webviews |
|
M8. Security Decisions Via Untrusted Inputs |
Test Name |
| M8-01 | Abusing Android Components through IPC intents (“exported” and “intent-filter”) |
| M8-02 | Abusing URL schemes |
|
M9. Improper Session Handling |
Test Name |
| M9-01 | Session invalidation on Backend |
| M9-02 | Session Timeout Protection |
| M9-03 | Cookie Rotation |
| M9-04 | Token Creation |
|
M10. Lack of Binary Protections |
Test Name |
| M10-01 | Reverse Engineering the Application Code |
| M10-02 | Unauthorized Code Modification |
| M10-03 | Debug the application behavior through runtime analysis |
Solutions
Network and Infrastructure Security
Zero Trust and Private Access
Endpoint and Server Protection
Vulnerability and Patch Management
Data Protection
Application Security
Secure Software and DevSecOps
Cloud Security
Identity Access Governance
Governance, Risk and Compliance
Security Intelligence Operations
Incident Response
Dubai
Abu Dhabi Office 7, Floor 14
Makeen Tower, Al Mawkib St.
Al Zahiya Area
Abu Dhabi, UAE
Kuwait Mezzanine Floor, Tower 3
Mohammad Thunayyan Al-Ghanem Street, Jibla
Kuwait City, Kuwait
+971 4 3383365
[email protected]
London 160 Kemp House, City Road
London, EC1V 2NX
United Kingdom
Company Number: 10276574
The website is our proprietary property and all source code, databases, functionality, software, website designs, audio, video, text, photographs, icons and graphics on the website (collectively, the “Content”) are owned or controlled by us or licensed to us, and are protected by copyright laws and various other intellectual property rights. The content and graphics may not be copied, in part or full, without the express permission of DTS Solution LLC (owner) who reserves all rights.
DTS Solution, DTS-Solution.com, the DTS Solution logo, HAWKEYE, FYNSEC, COMPLYAN, FRONTAL, HAWKEYE CSOC WIKI and Firewall Policy Builder are registered trademarks of DTS Solution, LLC.