This document provides an overview of mobile application security testing. It discusses the mobile security stack including the infrastructure, hardware, operating system and application layers. It then covers topics like mobile threat modeling, mobile application auditing techniques including dynamic and static analysis. The document also discusses the OWASP top 10 mobile risks and provides case studies and demonstrations on pentesting real mobile applications and reverse engineering Android malware.
Mobile Threats and Trends Changing Mobile App SecurityDevOps.com
Deploying your high-value mobile app to untrusted environments such as consumer mobile devices can be a risky proposition. Are some of your customers’ devices compromised? Do your users also download apps from untrusted sources? Is there malware residing on their devices that target apps such as yours?
Despite your best efforts to code secure apps, assess their security posture, and remediate any identified vulnerabilities – it’s not quite enough in today’s mobile threat landscape. Safeguarding mobile apps during runtime and empowering them to protect themselves in hostile environments is becoming a necessity in the face of ever-evolving mobile attack tactics and techniques.
During this webinar, we will:
Discuss today’s mobile app threat landscape
Explain how changing distribution models (e.g., Fortnite for Android) affect your app’s security
Illustrate the potential financial impact of mobile threats on a business’s bottom line
Demonstrate mobile overlay and other attacks
Reveal how mobile apps can protect themselves against these attacks with app shielding and runtime protection
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.comIdexcel Technologies
Application development has come a long way in last two decades, but it is puzzling to see that despite major security breaches, security testing takes a back seat as compared to other forms of quality testing measures such as usability or functional testing.
Mobile Threats and Trends Changing Mobile App SecurityDevOps.com
Deploying your high-value mobile app to untrusted environments such as consumer mobile devices can be a risky proposition. Are some of your customers’ devices compromised? Do your users also download apps from untrusted sources? Is there malware residing on their devices that target apps such as yours?
Despite your best efforts to code secure apps, assess their security posture, and remediate any identified vulnerabilities – it’s not quite enough in today’s mobile threat landscape. Safeguarding mobile apps during runtime and empowering them to protect themselves in hostile environments is becoming a necessity in the face of ever-evolving mobile attack tactics and techniques.
During this webinar, we will:
Discuss today’s mobile app threat landscape
Explain how changing distribution models (e.g., Fortnite for Android) affect your app’s security
Illustrate the potential financial impact of mobile threats on a business’s bottom line
Demonstrate mobile overlay and other attacks
Reveal how mobile apps can protect themselves against these attacks with app shielding and runtime protection
Mobile Application Security Testing, Testing for Mobility App | www.idexcel.comIdexcel Technologies
Application development has come a long way in last two decades, but it is puzzling to see that despite major security breaches, security testing takes a back seat as compared to other forms of quality testing measures such as usability or functional testing.
SOURCE CODE ANALYSIS TO REMOVE SECURITY VULNERABILITIES IN JAVA SOCKET PROGR...IJNSA Journal
This paper presents the source code analysis of a file reader server socket program (connection-oriented
sockets) developed in Java, to illustrate the identification, impact analysis and solutions to remove five
important software security vulnerabilities, which if left unattended could severely impact the server
running the software and also the network hosting the server. The five vulnerabilities we study in this
paper are: (1) Resource Injection, (2) Path Manipulation, (3) System Information Leak, (4) Denial of
Service and (5) Unreleased Resource vulnerabilities. We analyze the reason why each of these
vulnerabilities occur in the file reader server socket program, discuss the impact of leaving them
unattended in the program, and propose solutions to remove each of these vulnerabilities from the
program. We also analyze any potential performance tradeoffs (such as increase in code size and loss of
features) that could arise while incorporating the proposed solutions on the server program. The
proposed solutions are very generic in nature, and can be suitably modified to correct any such
vulnerabilities in software developed in any other programming language. We use the Fortify Source
Code Analyzer to conduct the source code analysis of the file reader server program, implemented on a
Windows XP virtual machine with the standard J2SE v.7 development kit
PHP is one of the most commonly used languages to develop web sites because of i
ts simplicity, easy to
learn and it can be easily embedded with any of the databases. A web developer with his basic knowledge
developing an application without practising secure guidelines, improper validation of user inputs leads to
various source code
v
ulnerabilities. Logical flaws while designing, implementing and hosting the web
application causes work flow deviation attacks.
In this paper, we are analyzing the complete behaviour of a
web application through static and dynamic analysis methodologies
Null Mumbai Meet_Android Reverse Engineering by Samrat Dasnullowaspmumbai
Android Reverse Engineering by Samrat Das
Abstract
• Intro to Reverse Engineering
• Short walkthough with Windows RE
• Introduction to Mobile Security Assessments
• Dalvik Virtual Machine vs JVM
• APK Walkthrough
• Components of Android
• Steps of Reverse Engineering Android Applications
• Hands-on demos on manual reversing of android apps
• Introduction to APPuse VM for droid assessments
• Detecting developer backdoors
• Creating Infected Android Applications
• Anti-Reversing | Obfuscation
MALWARE DETECTION USING MACHINE LEARNING ALGORITHMS AND REVERSE ENGINEERING O...IJNSA Journal
This research paper is focused on the issue of mobile application malware detection by Reverse Engineering of Android java code and use of Machine Learning algorithms. The malicious software characteristics were identified based on a collected set of total number of 1958 applications (including 996 malware applications). During research a unique set of features was chosen, then three attribute selection algorithms and five classification algorithms (Random Forest, K Nearest Neighbors, SVM, Nave Bayes and Logistic Regression) were examined to choose algorithms that would provide the most effective rate of malware detection.
Reading Group Presentation: Why Eve and Mallory Love AndroidMichael Rushanan
This presentation contains multiple pointers to academic research pertaining to Android and its security model. I presented these works to a weekly Security and Privacy reading group.
The academic proceeding can be found here:
www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf
This talk is going to give an overview of Android operating system and it´s apps ecosystem from the security point of view of a penetration tester.
So lets dive into topics like Pentest Environment Setup, Tools of the Trade, App Analysis and some security hints for Android developers.
SOURCE CODE ANALYSIS TO REMOVE SECURITY VULNERABILITIES IN JAVA SOCKET PROGR...IJNSA Journal
This paper presents the source code analysis of a file reader server socket program (connection-oriented
sockets) developed in Java, to illustrate the identification, impact analysis and solutions to remove five
important software security vulnerabilities, which if left unattended could severely impact the server
running the software and also the network hosting the server. The five vulnerabilities we study in this
paper are: (1) Resource Injection, (2) Path Manipulation, (3) System Information Leak, (4) Denial of
Service and (5) Unreleased Resource vulnerabilities. We analyze the reason why each of these
vulnerabilities occur in the file reader server socket program, discuss the impact of leaving them
unattended in the program, and propose solutions to remove each of these vulnerabilities from the
program. We also analyze any potential performance tradeoffs (such as increase in code size and loss of
features) that could arise while incorporating the proposed solutions on the server program. The
proposed solutions are very generic in nature, and can be suitably modified to correct any such
vulnerabilities in software developed in any other programming language. We use the Fortify Source
Code Analyzer to conduct the source code analysis of the file reader server program, implemented on a
Windows XP virtual machine with the standard J2SE v.7 development kit
PHP is one of the most commonly used languages to develop web sites because of i
ts simplicity, easy to
learn and it can be easily embedded with any of the databases. A web developer with his basic knowledge
developing an application without practising secure guidelines, improper validation of user inputs leads to
various source code
v
ulnerabilities. Logical flaws while designing, implementing and hosting the web
application causes work flow deviation attacks.
In this paper, we are analyzing the complete behaviour of a
web application through static and dynamic analysis methodologies
Null Mumbai Meet_Android Reverse Engineering by Samrat Dasnullowaspmumbai
Android Reverse Engineering by Samrat Das
Abstract
• Intro to Reverse Engineering
• Short walkthough with Windows RE
• Introduction to Mobile Security Assessments
• Dalvik Virtual Machine vs JVM
• APK Walkthrough
• Components of Android
• Steps of Reverse Engineering Android Applications
• Hands-on demos on manual reversing of android apps
• Introduction to APPuse VM for droid assessments
• Detecting developer backdoors
• Creating Infected Android Applications
• Anti-Reversing | Obfuscation
MALWARE DETECTION USING MACHINE LEARNING ALGORITHMS AND REVERSE ENGINEERING O...IJNSA Journal
This research paper is focused on the issue of mobile application malware detection by Reverse Engineering of Android java code and use of Machine Learning algorithms. The malicious software characteristics were identified based on a collected set of total number of 1958 applications (including 996 malware applications). During research a unique set of features was chosen, then three attribute selection algorithms and five classification algorithms (Random Forest, K Nearest Neighbors, SVM, Nave Bayes and Logistic Regression) were examined to choose algorithms that would provide the most effective rate of malware detection.
Reading Group Presentation: Why Eve and Mallory Love AndroidMichael Rushanan
This presentation contains multiple pointers to academic research pertaining to Android and its security model. I presented these works to a weekly Security and Privacy reading group.
The academic proceeding can be found here:
www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf
This talk is going to give an overview of Android operating system and it´s apps ecosystem from the security point of view of a penetration tester.
So lets dive into topics like Pentest Environment Setup, Tools of the Trade, App Analysis and some security hints for Android developers.
SecureDroid: An Android Security Framework Extension for Context-Aware policy...Giuseppe La Torre
Mobile devices became the main repository of personal data and source of user-generated contents as well as the principal controller of our social networked life. In this scenario, malicious applications try to take advantage of all the possibilities left open by users and operating systems. In this paper, we propose SecureDroid: an extension of the Android security frame- work able to enforce flexible and declarative security policies at run-time, providing a fine-grained access control system. In particular, we focus on context dependent policies that allow the user to specify the way in which applications work according to current context.
A case study of malware detection and removal in android appsijmnct
With the proliferation of smart phone users, android malware variants is increasing in terms of numbers
and amount of new victim android apps. The traditional malware detection focuses on repackage,
obfuscate and/or other transformable executable code from malicious apps. This paper presented a case
study on existing android malware detection through a sequence of steps and well developed encoding SMS
message. Our result has demonstrated a solid testify of our approach in the effectiveness of malware
detection and removal.
This presentation gives detailed overview of Android, Android Architecture, Software Stack, Platform, Database Support, Licensing, File System, Network Connectivity, Security and Permissions, IDE and Tools, Other IDEs Overview, Development Evaluation, Singing your application, Versioning your application, Preparing to publish your application, Publish your App on Android Market. This presentation also includes links to sample exampled.
Note: Few slides from this presentation are taken from internet or slideshare.com as it is or modified little bit. I have no intention of saying someone’s else work as mine. I prepared this presentation to just educate co-workers about android. So I want the best material from internet and slideshare.com.
Garbage Management using Android Smartphoneijsrd.com
Environmental pollution nowadays is a major aspect to be considered. Pollution has to be avoided and there are several ways to control it. In this paper, we propose an innovative software application, via which a user can send an alert text message and location details to the garbage/waste management department in the campus and also post the same details on the dedicated web server. This information essentially helps the respective department to take care of garbage present in the campus.
ABSTRACT
Shoreline monitoring is important to overcome the problems in the measurement of the shoreline. Recently,
many researchers have directed attention to methods of predicting shoreline changes by the use of
multispectral images. However, the images being captured tend to have several problems due to the weather.
Therefore, identification of multi class features which includes vegetation and shoreline using multispectral
satellite image is one of the challenges encountered in the detection of shoreline. An efficient framework
using the near infrared–histogram equalisation and improved filtering method is proposed to enhance the
detection of the shoreline in Tanjung Piai, Malaysia, by using SPOT-5 images. Sub-pixel edge detection and
the Wallis filter are used to compute the edge location with the subpixel accuracy and reduce the noise. Then,
the image undergoes image classification process by using Support Vector Machine. The proposed method
performed more effectively and reliable in preserving the missing line of the shoreline edge in the SPOT-5
images.
ABSTRACT
Smartphones are used by billions of people that means the applications of the smartphone is increasing, it is out of control for applications marketplaces to completely validate if an application is malicious or legitimate. Therefore, it is up to users to choose for themselves whether an application is safe to use or not. It is important to say that there are differences between mobile devices and PC machines in resource management mechanism, the security solutions for computer malware are not compatible with mobile devices. Consequently, the anti-malware organizations and academic researchers have produced and proposed many security methods and mechanisms in order to recognize and classify the security threat of the Android operating system. By means of the proposed methods are different from one to another, they can be arranged into various classifications. In this review paper, the present Android security threats is discussed and present security proposed solutions and attempt to classify the proposed solutions and evaluate them.
Advanced Malware Analysis Training Session 8 - Introduction to Androidsecurityxploded
This presentation is part of our Advanced Malware Analysis Training Series program.
For more details refer our Security Training page
http://securityxploded.com/security-training-advanced-malware-analysis.php
Optimize mobile applications defects with our mobile testing/mobile applications testing services. There are different types of Testing / Mobile Testing / Mobile Application Testing (iPhone Mobile Testing, iPad Testing, Android Mobile Testing, BlackBerry Testing &Windows Phone Testing) and this slide presentation helps you to learn in systematic way.
Unit 8 - Information and Communication Technology (Paper I).pdfThiyagu K
This slides describes the basic concepts of ICT, basics of Email, Emerging Technology and Digital Initiatives in Education. This presentations aligns with the UGC Paper I syllabus.
Francesca Gottschalk - How can education support child empowerment.pptxEduSkills OECD
Francesca Gottschalk from the OECD’s Centre for Educational Research and Innovation presents at the Ask an Expert Webinar: How can education support child empowerment?
Introduction to AI for Nonprofits with Tapp NetworkTechSoup
Dive into the world of AI! Experts Jon Hill and Tareq Monaur will guide you through AI's role in enhancing nonprofit websites and basic marketing strategies, making it easy to understand and apply.
Acetabularia Information For Class 9 .docxvaibhavrinwa19
Acetabularia acetabulum is a single-celled green alga that in its vegetative state is morphologically differentiated into a basal rhizoid and an axially elongated stalk, which bears whorls of branching hairs. The single diploid nucleus resides in the rhizoid.
2024.06.01 Introducing a competency framework for languag learning materials ...Sandy Millin
http://sandymillin.wordpress.com/iateflwebinar2024
Published classroom materials form the basis of syllabuses, drive teacher professional development, and have a potentially huge influence on learners, teachers and education systems. All teachers also create their own materials, whether a few sentences on a blackboard, a highly-structured fully-realised online course, or anything in between. Despite this, the knowledge and skills needed to create effective language learning materials are rarely part of teacher training, and are mostly learnt by trial and error.
Knowledge and skills frameworks, generally called competency frameworks, for ELT teachers, trainers and managers have existed for a few years now. However, until I created one for my MA dissertation, there wasn’t one drawing together what we need to know and do to be able to effectively produce language learning materials.
This webinar will introduce you to my framework, highlighting the key competencies I identified from my research. It will also show how anybody involved in language teaching (any language, not just English!), teacher training, managing schools or developing language learning materials can benefit from using the framework.
The Roman Empire A Historical Colossus.pdfkaushalkr1407
The Roman Empire, a vast and enduring power, stands as one of history's most remarkable civilizations, leaving an indelible imprint on the world. It emerged from the Roman Republic, transitioning into an imperial powerhouse under the leadership of Augustus Caesar in 27 BCE. This transformation marked the beginning of an era defined by unprecedented territorial expansion, architectural marvels, and profound cultural influence.
The empire's roots lie in the city of Rome, founded, according to legend, by Romulus in 753 BCE. Over centuries, Rome evolved from a small settlement to a formidable republic, characterized by a complex political system with elected officials and checks on power. However, internal strife, class conflicts, and military ambitions paved the way for the end of the Republic. Julius Caesar’s dictatorship and subsequent assassination in 44 BCE created a power vacuum, leading to a civil war. Octavian, later Augustus, emerged victorious, heralding the Roman Empire’s birth.
Under Augustus, the empire experienced the Pax Romana, a 200-year period of relative peace and stability. Augustus reformed the military, established efficient administrative systems, and initiated grand construction projects. The empire's borders expanded, encompassing territories from Britain to Egypt and from Spain to the Euphrates. Roman legions, renowned for their discipline and engineering prowess, secured and maintained these vast territories, building roads, fortifications, and cities that facilitated control and integration.
The Roman Empire’s society was hierarchical, with a rigid class system. At the top were the patricians, wealthy elites who held significant political power. Below them were the plebeians, free citizens with limited political influence, and the vast numbers of slaves who formed the backbone of the economy. The family unit was central, governed by the paterfamilias, the male head who held absolute authority.
Culturally, the Romans were eclectic, absorbing and adapting elements from the civilizations they encountered, particularly the Greeks. Roman art, literature, and philosophy reflected this synthesis, creating a rich cultural tapestry. Latin, the Roman language, became the lingua franca of the Western world, influencing numerous modern languages.
Roman architecture and engineering achievements were monumental. They perfected the arch, vault, and dome, constructing enduring structures like the Colosseum, Pantheon, and aqueducts. These engineering marvels not only showcased Roman ingenuity but also served practical purposes, from public entertainment to water supply.
Biological screening of herbal drugs: Introduction and Need for
Phyto-Pharmacological Screening, New Strategies for evaluating
Natural Products, In vitro evaluation techniques for Antioxidants, Antimicrobial and Anticancer drugs. In vivo evaluation techniques
for Anti-inflammatory, Antiulcer, Anticancer, Wound healing, Antidiabetic, Hepatoprotective, Cardio protective, Diuretics and
Antifertility, Toxicity studies as per OECD guidelines
Welcome to TechSoup New Member Orientation and Q&A (May 2024).pdfTechSoup
In this webinar you will learn how your organization can access TechSoup's wide variety of product discount and donation programs. From hardware to software, we'll give you a tour of the tools available to help your nonprofit with productivity, collaboration, financial management, donor tracking, security, and more.
Synthetic Fiber Construction in lab .pptxPavel ( NSTU)
Synthetic fiber production is a fascinating and complex field that blends chemistry, engineering, and environmental science. By understanding these aspects, students can gain a comprehensive view of synthetic fiber production, its impact on society and the environment, and the potential for future innovations. Synthetic fibers play a crucial role in modern society, impacting various aspects of daily life, industry, and the environment. ynthetic fibers are integral to modern life, offering a range of benefits from cost-effectiveness and versatility to innovative applications and performance characteristics. While they pose environmental challenges, ongoing research and development aim to create more sustainable and eco-friendly alternatives. Understanding the importance of synthetic fibers helps in appreciating their role in the economy, industry, and daily life, while also emphasizing the need for sustainable practices and innovation.
3. Part 1: Mobile Application Security
Part 2: Pentesting Mobile Application
Part 3: Owasp Top Ten Mobile Application Risk
Part 4: Case Study & Demonstrations.
4.
5. Introduction to Mobile Application Security.
Mobile Security Stack.
Mobile Threat Model
Modus Operandi for Mobile Application Audit.
Roadblocks
Future of Mobile Application Security
6. Modern mobile applications run on mobile devices
that have the functionality of a desktop or laptop
running a general purpose operating system.
In this respect many of the risks are similar to those of
traditional spyware, Trojan software, and insecurely
designed apps.
Mobile devices are designed around personal and
communication functionality which makes the mobile
application and mobile security risks different from
the top traditional computing risks.
9. 1. Dynamic Analysis
1. Debug the Running App (on device or in emulator)
2. Analyze Network Traffic
3. Analyze Remote Services (Http/SOAP/etc)
2. Static Anlysis
1. Get Application
1. Extract application from device
2. Receive application package from developers
2. Source code review
3. Reverse engineering
4. Disassembly
5. Patching
10.
11.
12. OWASP guidelines, procedures for testing are not yet available like Web
applications.
Mobile application also includes vulnerabilities in the underlying
architecture (OS & Vendor specific) unlike web application in which only
application vulnerabilities are concerned.
Applications can use various modes of communications like
SMS,MMS,EDGE, GPRS,3G and WiFi due to which security testing
becomes difficult.
Simulator's have their own limitations:
Can not simulate SMS communication (In case of communicating with SMS Gateway )
though, they provide mechanism to send & receive sms between simulators.
Simulator’s don’t allow intercepting installed applications traffic.
( It has to be done, forcefully by interjecting an application into running
simulator to intercept network communication from that process)
13.
14.
15.
16.
17.
18.
19. Pen testing Mobile Application – Android
Background.
Setting up the Test Environment.
Setting up a proxy.
Android Application Penetration Testing Toolkit.
Reverse Engineering Android Applications
File Permissions in android
20. Android is a Linux based platform developed by
Google and the open handset alliance.
Application programming for it is done exclusively in
java.
The android operating system software stack consist
of java applications running on a Dalvik virtual
machine (DVK).
The current version as of august 2010 is 2.2. there are
over 90,00 application available in the android market.
21.
22. There are several ways to test mobile application e.g:
Using burp with a proxy.
Using a phone emulator with a proxy.
Using a phone to test and proxy outgoing phone data to
a PC.
Requirements:
Computer running a Windows OS.
Java 6
Eclipse SDk – Helios/Indigo
Android 3.5 SDK
Burp! Proxy
23.
24. If Application using is using HTTP(s), or is a
website that you are testing on Android
browser, the next step is to setup a proxy tool
such as Burp!
There are 4 main ways of setting up such a
proxy:
25. Specify the proxy details when starting the
emulator using the command below. This
command is to use a proxy listening on port
8080
Emulator -avd testavd -http-proxy http://localhost:8080
26. The second option is to specify the proxy details in the emulator
APN setting as shown below:
Home-> Menu-> Wireless & networks > Mobile Network -> Access
Point Names
Update the following:
NAME: Internet
APN: Internet
Proxy: IP address of your
Computer
USERNAME: <N/A>
PASSWORD:<N/A>
27. The third option is to specify it using the adb shell
using the export command to set an environment
variable, for example:
Export HTTP_PROXY=http://localhost:8080
28. Final alternative is by changing the proxy setting in
the settings database from where the android web
browser reads. The settings database uses SQLite.
Familiarity with basic SQL commands is
recommended if your plan to use this method.
Change the hostname and port information
appropriately using the below command:
32. Android Debug Bridge: It is part of the Android SDK. It has
it’s own shell, which allows you to execute linux commands
such as ls –l . The android developer’s guide lists the full
range of ADB commands but we highlight a few below:
ADB could be used to locate all the emulators and android
devices connected to the computer to the computer using
the command below:
adb devices
33. In our case the command found one instance
of the emulator running. If multiple instances
are running you can use the –s option in order
to run commands against a specific device or
emulator.
Adb –s emulator-5554 install Foobar.apk
Another important provided by the adb is to
push or pull files to and from the
device/Emulator.
34. Every application running on android has an
AndroidManifest.xml file. This file is very
important from a security perspective as it
defines the permission an application request.
The Manifest Explorer tool is a utility that allows
you to review this xml file with ease when
testing it is important to verify that the
application follows the principle of “Least
privilege” and does not use permission that are
ot required for it to function.
35.
36. Intent is a mechanism in android to move
data process. It forms the core of android’s
Inter process Communication (IPC). Inetnts
could indicate a number of actions such as
startservice, sendbroadcast etc. The Intent
Sniffer tool performs monitoring of Intents.
37. Busybox provides some linux commands that
could be useful during the penetration testing
process. It extends the capability of android’s
toolbox. In order to install busybox you can
go through the following steps:
Download the busybox
39. Dissembler: is a computer program that translate
machine language into assembly language ( The
inverse operating of an assembler). A dissembler
differs from a decompiler which targets a high level
language rather than an assembly language.
Reverse Engineering: Reverse engineering involves
reversing a program's machine code (the string of 0s
and 1s that are sent to the logic processor) back into
the source code that it was written in, using
program language statements.
40. Android file permission uses the same model as Linux, to check the
permissions of a file, go to the ADB shell and type ls –l.
Every .apk file installed on the emulator has its own unique user ID.
This prevents one application from accessing the other application’s
data, any file created by the application will be assigned that
application’s user ID and will not normally accessible to other
applications.
41.
42.
43.
44. Owasp Top Ten Mobile Application Risk’s.
M1: Insecure Data Storage
M2: Weak Server Side Controls
M3: Insufficient Transport Layer Protection
M4:Client Side Injection
M5: Poor Authorization & Authentication
M6: Improper Session Handling
M7: Security Decision Via Untrusted Inputs
M8: Side channel Data Leakage
M9: Broken Cryptography
M10: Sensitive Information Disclosure.
45.
46. Case Study:
Facebook.apk : Pentesting a real world Application
Demonstrations:
Reverse Engineering a first Trojan for Android
Malware.