Solved

Mobile penetration testing

Posted on 2016-10-28
2
125 Views
Last Modified: 2016-10-28
Hi to all of you,
I've been asked to write guidelines on how to perform Penetration Testin over mobile devices.

Can you please provide me some help , in particular based on your experience the methodology and  tools you use .
Thank you
Carlo
0
Comment
Question by:carlettus
2 Comments
 
LVL 63

Accepted Solution

by:
btan earned 500 total points
ID: 41863714
You can check out OWASP top ten mobile threats and the pentest scope should include them minimally in scope of appl checks. See checklist in https://www.owasp.org/index.php/OWASP_Mobile_Security_Project

However, for a more comprehensive coverage of Penetration testing, it should include minimally
a) vulnerability scanning that covers network/OS scan and appl scans. The appl scan will cover whitebox check (source code, if avail) and blackbox check (dynamic exchanges with appl). The OWASP can be reference as mentioned earlier
b) manual check for weak spots in the mobile device/architecture/access control/configuration to further intrude so as to surface the potential damage to the whole mobile setup (leading to data breaches). primarily is also to verify the existing safeguards control in place  

Determine the scope of the pentest is important otherwise you need to cover check for the whole robustness of the security architecture, mobile OS (apples/Android/Windows Phone etc) and device hardening and services integrity. This is very different if just going for mobile appl pentest that is driven more from OWASP check as shared earlier. See one PT sharing on iPhone/Android platform.
https://www.owasp.org/images/4/40/Pentesting_Mobile_Applications.pdf

The final report of the mobile security PT should cover the scope, tools, rule of engagement, findings, severity of vulnerability, remediation action and risk acceptance (for findings not closed). have caveats that the testing does not introduce backdoor, bring outage or damage the target or compromise actual target sensitive (personal data) information.
1
 

Author Closing Comment

by:carlettus
ID: 41863720
Thank you , this is an excellent point to start.
0

Featured Post

Webinar: Aligning, Automating, Winning

Join Dan Russo, Senior Manager of Operations Intelligence, for an in-depth discussion on how Dealertrack, leading provider of integrated digital solutions for the automotive industry, transformed their DevOps processes to increase collaboration and move with greater velocity.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

In this increasingly digital world, security hacks are no longer just a threat, but a reality. As we've witnessed with Target's big identity hack 2013, Heartbleed in 2015, and now Cloudbleed, companies and their leaders need to prepare for the unthi…
The related questions "How do I recover the passwords for my Q-See DVR" and "How can I reset my Q-See DVR to eliminate a password" are seen several times a week.  Here we discuss the grim reality of the situation.
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

837 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question