Mobile penetration testing has become a hot topic in the security industry, but many people are not sure how to go about it. There is confusion as to what the scope should be and what considerations need to be made. In this blog post, we will discuss some of those considerations and how they can help your business improve its mobile app security.
What is Mobile App Penetration Testing?
Penetration testing is an important part of any security program, and mobile penetration testing should be no different. Penetration tests attempt to identify vulnerabilities in the system that can lead to a data breach or other negative event.
Mobile apps are still fairly new on the scene so it’s not surprising that there isn’t as much guidance available for them compared with traditional web applications. The important step towards securing your mobile app is understanding what risks exist within it.
Approaches for Mobile App Pentesting
For starters, one needs to consider that there are three different types of apps – native iOS apps, hybrid Android apps, and web applications.
Each type requires specific test procedures depending on their category/type so you cannot simply use one set of test methods for all types of apps or else your tests would lack context which could lead you down the wrong path when looking for vulnerabilities.
The best way to move forward with iOS or Android penetration testing is to combine various test methods and techniques to more accurately assess the security of your mobile apps.
Another important factor you need to consider is if you’re going to be doing on-site or off-site testing. Off-site (remote) penetration tests are useful for web applications while on-site tests work best when assessing local apps such as native iOS and Android apps, especially since these types of pen tests require physical access against an actual device being tested.
This would mean that different skill sets will have to be used in each case so it is very important that companies look at their resources carefully before deciding which type of test suits them better. As far as target devices go, one should know whether they want a “lite” version of testing which requires less time, effort and resources to conduct. This type of test includes assessing the app’s network capabilities, identifying vulnerabilities in any open ports or services running on them, checking for common misconfigurations etc., but does not involve much vulnerability analysis as it is mostly done at a very high level.
The next step up from here would be “standard penetration tests” where all aspects are tested thoroughly including looking for bugs that could lead to code execution within the application itself. It also involves more detailed information gathering such as enumerating API endpoints using tools like Burp Suite proxy, putting together fuzzing lists based on known issues with iOS/Android apps (e.g.: Heartbleed unearthing sensitive information), and even writing custom exploits for vulnerabilities that were identified.
Finally, there is the “advanced penetration test” which involves more complex tests such as reverse-engineering the app to find out how it works and then basing exploitability of bugs on this information (e.g.: exploiting a bug found in an older version of iOS). This would be suitable if you want to conduct several types of testing at once or have significant time/resources available since it takes quite some time so do not undertake such tests lightly.
Mobile App Penetration Testing Scope Considerations
1. Device Simulator/Emulator vs Real Device:
Not every company has hundreds (or thousands) of physical devices lying around waiting to be tested against exploits. One option would be hiring testers who have their own personal smartphones they could use during each test. While this is an option, it’s also important to remember that these devices are often used outside of work and maybe miss security updates or contain other vulnerabilities on their own. Another more secure method would be using a mobile device simulator/emulator which runs on your network instead of physical hardware.
2. Network Penetration Test:
Once the testing environment has been established, penetration testers can begin searching for flaws within it. It’s important not to forget about the connections between internal components while conducting mobile app penetration tests. This includes checking things like VPNs, firewalls, web proxies, wireless access points (WAP), SSL certificates, etc., depending upon how they’re being utilized by the company in. These items should all be checked to ensure they’re configured securely and used in a way that’s consistent with your company policies.
Mobile App Penetration Testing Report
While conducting the penetration test, testers should document each issue found along with how it could be exploited. It may also help to provide some guidance on how these issues can be resolved (or mitigated) by the business.
For example, if an app is sending plain text passwords over SSL then one potential mitigation would be to enable certificate pinning within the application itself so there is no chance of accidentally using a rogue connection. This allows for tighter control while still giving employees access to all their legitimate resources outside of work hours where possible.
Creating your mobile app pen testing report that summarizes all of the issues found and provides recommended fixes is considered a good scoping option.
Conclusion
If you are looking to do a penetration test on your mobile app, there are many things that need to be considered. Knowing the scope of the project is crucial for developing an accurate budget and timeline so you can determine how much time should be spent analyzing each type of vulnerability. For example, if your goal is only to ensure confidentiality, then this would limit your testing to vulnerabilities in data encryption methods or key exchange algorithms. You may also want to look at other aspects such as availability by performing denial-of-service attacks against nodes within the network system. When it comes down to it, defining what exactly needs to be tested will dictate whether or not you’ve done enough due diligence before releasing any sort of application into production environments.