Mobile App Penetration Test

Securing The Front Door

Mobile Applications are a necessary component of how many companies interact with customers. They compliment the technology stack acting as the “front door” to the customer in fulfilling their business mission.

This critical asset is often overlooked in terms of security. In the mobile application development process, it is common for security to be neglected, tacked on at the end, or even completely forgotten.

A Specialized Approach

The storage of critical data, the proper use of user credentials, the method of communication with external resources, the implementation of cryptographic APIs - all of these components should be assessed for their security posture.

Due to the locked down environment in which they operate, mobile applications are often more secure than their desktop and server counterparts. Mobile applications normally have a smaller attack surface in the classical sense. This changes the focus of the Mobile App Penetration Test to the protection of data on the device and how the application interacts with external resources.

Mobile apps often interact with protocols and complex systems such as third party APIs, cars, servers on external networks across the world, Bluetooth devices, a broad variety of IoT devices. These external systems are potentially susceptible to vulnerabilities, network and web application attacks.

This expanded attack surface should be included in the mobile application’s Threat Model.

The Cybermode Comprehensive Mobile App Penetration Test is informed by the excellent OWASP Mobile Application Security Standard (MASVS) and the OWASP Mobile Security Testing Guide (MASTG). The following is representative of the testing methodology.