Mobile Application Security

More users than ever before rely on mobile applications for a majority of their digital tasks over traditional desktop applications. In 2015 in the U.S. alone, users spent 54% of their digital media time on mobile devices actively using mobile apps. These applications have access to large amounts of user data, much of which is sensitive data and must be protected from unauthorized access.

All popular mobile platforms provide security controls designed to help software developers build secure applications. However, it is often left to the developer to choose from myriad of security options. A lack of vetting can lead to security feature implementation that can be easily circumvented by attackers.

Common issues that affect mobile apps include:

• Storing or unintentionally leaking sensitive data in ways that it could be read by other applications on the user’s phone.
• Implementing poor authentication and authorization checks that could be bypassed by malicious applications or users.
• Using data encryption methods that are known to be vulnerable or can be easily broken.
• Transmitting sensitive data without encryption over the Internet.

These issues could be exploited in many ways; for example, by malicious applications on a user’s device, or by an attacker who has access to the same WiFi network as an end user.

Mobile application security testing involves testing a mobile app in ways that a malicious user would try to attack it. Effective security testing begins with an understanding of the application’s business purpose and the types of data it handles. From there, a combination of static analysis, dynamic analysis, and penetration testing results in an efficient holistic assessment to find vulnerabilities that would be missed if the techniques were not used together effectively. The testing process includes:

• Interacting with the application and understanding how it stores, receives, and transmits data.
• Decrypting encrypted parts of the application.
• Decompiling the application and analyzing the resulting code.
• Using static analysis to pinpoint security weaknesses in the decompiled code.
• Applying the understanding gained from reverse engineering and static analysis to drive dynamic analysis and penetration testing.
• Utilizing dynamic analysis and penetration testing to evaluate the effectiveness of security controls (e.g., authentication and authorization controls) that are used within the application.

There are a number of free and commercial mobile application security tools available that assess applications using either static or dynamic testing methodologies with varying degrees of effectiveness. However, no single tool provides a comprehensive assessment of the application. Rather, a combination of both static and dynamic testing with manual review is required to provide the best coverage.

Mobile application security testing can be thought of as a pre-production check to ensure that security controls in an application work as expected, while safeguarding against implementation errors. It can help discover edge cases (that turn into security bugs) that the development team may have not anticipated. The testing process takes into account both code and configuration issues in a production-like environment to ensure that issues are discovered before going live.