The document discusses standards and resources for testing mobile application security, including the OWASP Mobile Application Security Verification Standard (MASVS), Mobile Security Testing Guide (MSTG), and Hacking Playground. The MASVS provides high-level security requirements, the MSTG provides detailed testing methodology mapped to MASVS requirements, and the Hacking Playground allows practicing security testing on intentionally vulnerable apps. The speaker encourages contribution to these open source projects.

1. OWASP for testing
mobile applications
Pawel Rzepa (pawel.rzepa@owasp.org)
OWASP Poland Day 2nd October 2017

2. Agenda
OWASP MASVS
OWASP MSTG
Hacking Playground
Do we need new
standards?
How exactly mobile
security should be
tested?
Where to practice?
and some extras…

3. Who am I?
Security Consultant in
Top contributor in
Follow me @Rzepsky

4. Common myth…
All standards
applicable to
web apps can
be also
applicable to
mobile apps

5. Yyy… well… no
• Different distribution model
• Different threat model (e.g. evil maid attack)
• Sandboxing (e.g. no CSRF in mobile app by
design)
• Etc…
• Conclusion?
We need different
approach for mobile
apps!

6. Mobile Application Security Verification
Standard to the rescue!

7. Mobile Application Security Verification
Standard
• Fork project of OWASP ASVS
• High level security requirements for mobile
applications standard, divided into 8
sections:
– V1: Architecture, Design and Threat Modeling Requirements,
– V2: Data Storage and Privacy Requirements,
– V3: Cryptography Requirements,
– V4: Authentication and Session Management Requirements,
– V5: Network Communication Requirements,
– V6: Environmental Interaction Requirements,
– V7: Code Quality and Build Setting Requirements,
– V8: Resiliency Against Reverse Engineering Requirements

8. Example: Network Communication
Requirements

9. MASVS: Maturity levels
• MASVS-L1: Standard Security (all apps)
• MASVS-L2: Defense-in-Depth (handle
sensitive data)
• MASVS-R: Resiliency Against Reverse
Engineering and Tampering (protects
intellectual property and hinders
tampering)

10. MASVS: Verification types
• MASVS-L1 (e.g. social media app)
• MASVS-L1+R (e.g. mobile games)
• MASVS-L2 (e.g. healthcare app)
• MASVS-L2+R (e.g. banking apps)

11. MASVS for Business Analyst
VS
The app should
be secure
The app should
be compliant
with MASVS L2
X

12. MASVS for Developers
VS

13. MASVS for testers

14. OWASP MASVS: Project details
• Project repository:
https://itsssl.com/Of6gr
• Latest version in PDF:
https://itsssl.com/9uljU

15. How exactly mobile security should be
tested?
• We need one comprehensive guide how to
test security of mobile apps
• Books and courses are cool, but still are
not comprehensive and may be outdated

16. OWASP MSTG to the rescue!!!

17. OWASP MSTG
• Detailed manual for testing the security of
mobile apps
• Includes a list of test cases, each of which
maps to a requirement in the MASVS
• Focused on Android & iOS

18. OWASP MSTG: Structure

19. OWASP MSTG: How to use it?
1
2
3

20. OWASP MSTG: Project details
• Official repo:
https://itsssl.com/zgGCh
• Readable GitBook format (always up to
date):
https://itsssl.com/PrLtg
• Want to contribute? Join the Slack group:
https://itsssl.com/6iIGR

22. We need a practice!
• You have to see a vulnerability to be able
to find it in real applications
• Intentionally vulnerable applications usually
contains just a few vulnerabilities from
OWASP top 10
• You should practice security testing
methodology BEFORE using it in
commercial work

23. OMTG Hacking Playground to the
rescue!

24. OMTG Hacking Playground
• Implements each vulnerability described in
MSTG for educational purpose
• A developer can identify vulnerable code
and fix it using MSTG recommendations
• Pentesters can identify bad practices,
dangerous methods and classes they
should look for

25. Hacking Playground: How does it look
like?

26. Hacking Playground: How does it look
like?

27. Hacking Playground: current state
• So far only Android App
• Implements 20 test cases
• Just clone the repo and open it in Android
Studio
• All required dependencies can be installed
from Android Studio

28. Hacking Playground: project details
• Official repo:
https://itsssl.com/1oV8u
• Description of implemented test cases:
https://itsssl.com/p7542

29. Extras
• List of great mobile vulnerable apps and CTFs:
https://itsssl.com/BSBD0
• Mobile vulnerability scanner:
• QARK: https://itsssl.com/2JcoV
• MobSF: https://itsssl.com/RxYmG
• Tools:
• For testing Android apps: https://itsssl.com/Ff8Eb
• For testing iOS apps: https://itsssl.com/TcFiL

30. Summary
• You can find high level security requirements in
OWASP Mobile Application Security Verification
Standard
• You can find a detailed guide of security testing
methodology in OWASP Mobile Security Testing
Guide
• You can practice security testing skills on
intentionally vulnerable OMTG Hacking Playground
• You are more than welcome to contribute in any of
above mentioned project

31. Contact me: pawel.rzepa@owasp.org