Editor's note

understanding why testing mobile applications and the
platforms they sit on is important. Whereas in the past
our phones were largely a static mass of code that let
us make phone calls and send SMS messages they
are now multifunction devices that run a dynamic set
of applications with a complex ecosystem surrounding
them. Whether you are interested in the security of an
entire handset or tablet or just a single application there
is now an extensive attack surface to consider.
The implication of all this is that whether you are using a
phone within a business or are releasing an App for your
userbase you need to understand the risks that exist. Even
if you are simply releasing an App to the public there are
lots of risks that you need to consider, does the application
expose your user’s information either to another App on
the device or whilst in transit across a network? Does
the application make the user’s entire phone more
vulnerable to attack, thereby putting all their data at risk
of compromise? If you need to find an answer to those
questions you need to understand the security model of
the platform in question and you need to perform some
level of security testing or similar assurance activities.
The Prerequisites for Testing
If you are going to look at any mobile platform, just as with
any other area of security testing or research, you need to
have an environment you can use to for your testing. There
are effectively four things you will need for any platform
although the ability to obtain all of these and the cost
overhead associated with them will vary across platforms:
Phone or tablet hardware
There is nothing like the real deal with hardware to test
out your findings on and to understand how the platform
works in the real world. Whilst on some platforms you
can get away with just using the emulator provided by the
vendor you will find these often have less attack surface
than the real device. Also, If your objective is to go out
and find real world vulnerabilities before anyone else
don’t underestimate the benefit of looking at code written
by the OEMs before they ship their own hardware as this
will be a rich source of bugs just waiting to be found.
Development Environment and Compiler
If you want to find and exploit vulnerabilities on the
platforms it certainly pays to have a development
environment and compiler available to you. One of the
most common methods for exploiting vulnerabilities in
mobile Apps is to write your own malicious App that can
attack from the inside and to do that you w ill need to
either write or modify some code. On some platforms
you will not be able to side load your apps without
a special developer unlocked device or publishing
starterkit 02/2011(2)
through the platform’s application store but on many
you will be able to write and run your own code.
Emulator and Debugger
Even if you have your own shiny hardware to play with
you will find an emulator and debugging tools invaluable in
your efforts to find and exploit security bugs. An emulator
will give you freedom to experiment and debug to your
heart’s content and in many cases will even let you test
shellcode you can port directly to your hardware.
Scripting language or interface
In any form of security testing you will need your
favourite scripting language close at hand. Whether it
s for some adhoc fuzzing, sending some data over the
network or delivering a payload for that remote code
execution vulnerability you just found you can be sure
that a scripting language will be your friend.
Testing Mobile Platforms
Whilst mobile platforms all have their own eccentricities
and differences from those which they evolved from, if
you are going to understand a mobile security model
of the platform you should know about the Operating
System you are interested in. It’s not within the scope
of this article to talk extensively about security testing
against Linux, Windows CE or any of the other platforms
that are the foundation of today’s mobile platforms. If
you are going to be performing a mobile security test
the area you will probably need most support with is in
assessing the applications that run on top of the OS and
most importantly how significant any vulnerabilities you
find actually are. So my message is don’t overlook the
security of the mobile platform itself but there are plenty
of resources out there already and certainly don’t leave
your standard tools behind if looking at this!
One other thing to consider is the way the platform will
be used in the environment it is destined for. You may
be focussing on the OS and the Apps that run on top of it
but there are much wider considerations. For example,
is a corporate policy being enforced, is corporate and
user data segregated, can data be pushed into a cloud
based service and how are backups and other important
admin tasks handled. Make sure you don’t forget about
these when assessing any mobile platform or solution.
With the platform covered off lets now get stuck into
testing the mobile Apps themselves.
Google Android Testing
If you are looking for vulnerabilities in applications on
any of the major mobile platforms it could be argued that
Android is one of the easiest to find them in, if you know
what to look for! The reason why is explained here:
Page 13 http://pentestmag.com