Dynamic Mobile Application Penetration Testing

Mobile security encompasses network security (i.e. mobile apps often operate on the public internet and connect to back end servers) and application/software security, among other things.It is important to thoroughly test the security of your mobile applications.

Dynamic penetration testing is one of the most powerful techniques that can test enterprise mobile application to ensure complete data security on every mobile OS and platform available in the market in great number.

Dynamic mobile testing comprises of testing mechanisms with tools like Drozer (Andriod) and Needle(IOS),and these tools include the testing of:

  • Authentication protocols.
  • Session management parameters.
  • Access control mechanisms.
  • Input validation implementation.
  • Device data storage.
  • Transport layer encryption.
  • Feasibility of reverse engineering
  • These testing techniques offer a full range of measures that can help to ensure that your mobile applications are safe, secure and will stand up to any offensive front. Below is a brief overview of each of these security testing mechanisms that make up dynamic mobile testing:

AUTHENTICATION TESTING

Authentication Testing includes dynamically testing the implementation of protocols for gaining authorized access to the system via proper credentials (e.g. username, password,PIN), and is important to test in order to determine whether a malicious person can gain access to the system by inputting commands, utilizing malware,or by using automated software, etc This includes checking how data is pulled from back-end databases and how user input is parsed and pushed to the back-end, which can help to mitigate certain types of attacks that allow for bypassing authentication (e.g. SQL injection).

SESSION MANAGEMENT

Session management includes the proper use of cookies, session expiration, timeouts, session IDs/PINs, and cryptographic keys that are used in network data exchanges between a certain, authenticated user and the server. How the authenticated user’s data is stored – and used later to identify that user – is very important, as malicious users can use the session data of an authenticated user to perform session hijacking and bypass authentication.

ACCESS CONTROL (AC)

Access control (AC) encompasses authentication, unique electronic identifiers, etc. and binds the aforementioned points together as a system that allows authorized users to access data on the server or to establish sessions with the server. It is imperative that your company utilizes and implements a robust access control system that allows only fully-authenticated, authorized users to gain access to the system.

INPUT VALIDATION

Input validation is the practice of validating user input before the data is parsed. This stops a user on the client side from using command injection in order to run malicious code on the server that could allow for a data breach or unauthorized access to the system. Many attack vectors (e.g. SQLi) can be mitigated by input validation since any malicious code would be rendered benign before it is passed to the database server. According to the Common Weakness Enumeration Report, SQL injection ranked among the highest security attack vector used against applications. OWASP ranks Injection as the most prevalent attack used against applications.

SECURE STORAGE OF DATA

The secure storage of data on mobile devices is very important, as everything from encryption to the database framework in use must be taken into account. In addition to this, the vulnerabilities that are common to the OS in use may present greater security flaws that can allow such mobile storage systems to be exploited. Embedded databases such as SQLite are known to have several security issues.

NETWORK SYSTEMS IN MOBILE APPLICATIONS

When dealing with network systems in mobile applications, a sufficiently strong cipher (e.g. AES instead of RC4) must be used with Transport Layer Security (TLS) for end-to-end encryption to ensure that data is kept private and fully secure. Data in transit over a public network must be encrypted so that any data that is sniffed does not appear in plaintext.

REVERSE ENGINEERING

Reverse engineering an application into source code can reveal many secrets about the application such as encryption ciphers used, backdoors that may be present, security vulnerabilities and language-specific weaknesses in the code that can be exploited, along with hard-coded secrets and more.
It is also important to note that many dynamic, automated scanning tools exist that offer only a partial understanding of your security posture. These often exist as basic scripts or even complex software that many non-professional “hackers” (e.g. “script kiddies”) can use on your applications to compromise them without having detailed knowledge of application hacking. Thus it is very important to run penetration tests on your applications to “hack yourself first”, especially since a more advanced hacker could use both automated tools and thorough manual hacking techniques to compromise your mobile applications.