- The Open Web Application Security Project publishes
the mobile app security checklist.
And it can be used on both sides of the fence.
So if you are a developer,
you take a look at this security checklist and say,
"Am I addressing all of these concerns?"
It's a large Excel spreadsheet, xlsx format.
This is the full spreadsheet on a 4k display.
I've zoomed into the first two sections here.
So for example,
all security controls have a centralized implementation,
explicit policy for cryptographic keys.
So as I mentioned, both sides of the fence,
if you are investigating an application,
take a look at this list
and see if that application complies
with the security recommendations in this checklist.
If you're the developer, it is highly recommended
that you comply with the majority of these recommendations
in the security checklist.
As far as tools, in order to to sharpen your sword,
with respect to investigating applications
on both iOS and Android,
there are some learning projects available to you
starting off with
the Open Web Application Security Projects, iGoat tool.
This is an application that is known vulnerable.
Similarly, the Damn Vulnerable iOS Application
is known vulnerable.
There's challenge categories here
in the Damn Vulnerable iOS Application
like insecure data storage, runtime manipulation.
So they have the challenge
and then an explanation of the findings.
So it's very helpful in order to learn
how to analyze these applications.
For Android, there is another one as well.
These Uncrackable Mobile Apps,
we have four challenge levels for Android,
two for iOS, available at this URL here.