Devices - Penetration Testing Like a Hacker. - SecNiche Security Labs

FOCUSMobile ApplicationSecurity TestingMobile apps are more than the sum of their componentsThriving vendor marketplaces (such as iTunes and the Androidstore) encourage the rapid development and deploymentof mobile applications to consumers and businesses alike.Additionally, alternative 3 rd -party download and install marketsopen up as software writers seek opportunities, outside the walledgardens provided by the mainstream stores.Having your software purchased and downloadedby millions of people worldwide has long beenthe holy grail of mobile software developers, butit also attracts the attention of fraudsters who recognizethe accessibility and lack of security features of theseplatforms. The mobile platform opens several attackavenues for malicious software and opportunities todefraud victims due to its lax control mechanisms, andlack of standardization of the user experience offering.Therefore, mobile applications should be designed,developed, and tested having security in mind, muchlike web applications that handle sensitive information.The design and development of mobile applications issignificantly different to thatof traditional client-serversor web applications. Mobileapplications should takeinto account both theenvironment (platform,libraries, capabilities), together with major differences inend-user expectations. Mobile users demand a simpleuser experience (in terms of details), and often requirecompletely different business processes compared withother interaction channels.Security ChallengesThere are two main security challenges to mobileapplications that stem from their usage and limitations:• Insecure Connections• Simplified User ExperienceAny foreign code that runs on the mobileplatform has the potential to alter the userexperience and manipulate the locally storeddata as well as the data in transit.Insecure ConnectionsMobile devices are used in a number of unknown andoften insecure connection profiles (from public Wi-Fi, through rogue cells that proxy communication).This makes them vulnerable to simple attacks notconsidered in the threat modeling of a traditional webapplication. Additionally, insecure communications areoften used to overcome platform limitations and designconsiderations such as: battery consumption profiles,processing speed, and communication overhead.Insecure communicationsfor mobile applicationsexpose several exploitationavenues (including local andremote), and enable fraudulentapplication creation usingextremely simple tools and techniques that are freelyavailable in the market. This not only puts the end userat risk of data loss, but also allows attackers an easyaccess path into the organization that provides servicesthrough the mobile applications. Any foreign code thatruns on the mobile platform has the potential to alterthe user experience and manipulate the locally storeddata as well as the data in transit. Thus fraudsters gaina prime opportunity to conduct their attacks.05/2011 (5) SeptemberPage 22http://pentestmag.com