Best Practices
Many mobile app developers with the best of intentions have rushed COVID-19 apps to Google Play and the App Store to assist with contact tracing, symptom diagnosis and outbreak maps. But in the speed to get apps that can help fight the pandemic out to the public quickly, some security and privacy vulnerabilities went undetected prior to release. Because the sensitive nature of healthcare information creates unique security and privacy challenges, I advise mobile app developers and security analysts to heed the following advice to avoid fairly common security, privacy and compliance issues.
With the Android 11 preview beta being released last month, you may be scratching your head asking, “What did I miss in Android 10?” Developers will face a Nov. 2 deadline to update their mobile apps to accommodate a target SDK of Android API level 29 or higher. The addition of Scoped Storage ushers in noteworthy changes to external storage, otherwise known as public storage, SD card, shared storage, or emulated storage.
The California Consumer Privacy Act (CCPA) took effect on Jan. 1, 2020, and is currently the toughest, most comprehensive privacy law in the United States. It has also spawned state privacy laws and proposed legislation. Given the level of personal data that mobile apps collect, store and transmit, companies must ensure their apps safeguard sensitive information and comply with CCPA and other relevant privacy laws.
Reverse engineering refers to the process of taking something apart to see how it works. The NowSecure Services team frequently performs reverse engineering on mobile apps to uncover security vulnerabilities and privacy flaws. This tutorial will help you master the basics of analyzing an Android app and knowing what to look for.
Although we recommend periodic in-depth pen tests for high-risk mobile apps that run organization-critical processes or access sensitive information, this practice doesn’t scale well for DevOps teams. Mobile app pen testing requires intense human labor that simply can’t keep pace with the volume, velocity and frequency of DevOps releases. Many organizations can benefit from incorporating automated mobile appsec testing in the mobile DevSecOps toolchain to speed the delivery of secure mobile apps.
Recent enhancements to the Frida open-source dynamic instrumentation toolkit greatly ease the process of conducting jailed testing. You no longer have to manually package the Frida Gadget in your target app. As long as the app is debuggable, Frida does that for you. This post will walk you through the process of using Frida on a jailed device.
Many people have heard about mobile man-in-the-middle (MiTM) attacks but aren’t sure just exactly what they are or how they happen. Learn more including the development and security issues that can leave apps vulnerable to MiTM attacks, tips for testing and the layers of network defense that can help you avoid these issues.
To improve the guest experience and keep pace with competition, hotels worldwide are deploying digital key technology that allows guests to skip the front desk and use their mobile apps to remotely check in and go directly into their rooms without needing key cards. However, hotel mobile apps have vulnerabilities that can be exploited, as researchers demonstrated at the Black Hat USA 2019 conference.
Both static and dynamic security testing are essential components of the mobile app software development life cycle (SDLC). While Static Application Security Testing (SAST) tests snippets of source code, Dynamic Application Security Testing (DAST) fully exercises the compiled mobile binary as a user would. Read more about the misconceptions of DAST for mobile.
Managers can find guidance for mobile app security verification and testing requirements from the OWASP Mobile Security Verification Standard (MASVS). We recommend using MASVS as a starting point for developing a plan of attack and standardizing testing using the Mobile AppSec Model. Learn more about it here.