Mobile Application Security Testing (MAST)
Specialist services to protect your business
The Mobile Application Security Testing is an Application Security Assessment service proposed by ISGroup for the iOS and Android platforms. It is adapted according to the programming language used for the development of native apps (Objective-C, Swift, Java, Kotlin) or apps built with hybrid frameworks (such as React, React Native, Cordova, Xamarin, Titanium Appcelerator, Ionic, PhoneGap).
There are many companies that have invested in mobile applications but there is often little attention to security because the vulnerabilities and the related possibilities of attack by a malicious user are less known.
The ISGroup team is constantly updated on the latest developments in Mobile Security, both from the attacker's and the developer's point of view, in order to provide the best possible analysis service for its customers.
Through the use of manual techniques and advanced tools, the tester is able to perform static and runtime analysis of the application, in order to bypass any limitations or any implemented business logic.
The mobile applications are by their nature also subjected to client-side vulnerabilities related to the interaction of the application with the operating system and the underlying device. For example, the application may not check if the phone or tablet is jailbroken or rooted, or if it stores sensitive or important data in an unsafe manner.
Finally the auditor takes care of the verification related to the interactions between the application and the remote server, which may be subjected to vulnerabilities similar to those affecting web applications (Authentication and Authorization checks, SQL Injection).
A Mobile Application Security Testing activity represents the simulation of an attacker against an application which is directly downloadable from the official stores (AppStore and PlayStore) or provided in an alternative way for internal use.
The test can be carried out in Grey Box or Black Box mode.
In the first case the tester analyzes the application code that the customer provided in order to fully identify the vulnerabilities that could otherwise be hidden by code obfuscation. Then he continues with the client-side runtime analysis of the application and the interactions with the server-side services exposed.
In the case of the black box analysis, the tester finds himself in the situation of an attacker who analyzes the application downloaded from the store, like a normal user.
Since the client application code is on the device, the tester tries to reverse engineer it and attempts to verify the presence and strenght of any countermeasures implemented to prevent theft of intellectual property and the knowledge of any security mechanisms that could then be bypassed this way.
Subsequently is verified the possibility of application manipulation during its execution. Finally all the parameters identified in the requests are tested, both manually and by the use of tools.
Depending on the type of application and on the level of access obtained, the tester will try to modify the application flow and to manipulate and exploit the data saved locally and on the remote server.
You will receive a clear, detailed document divided into three areas.
It is placed at the beginning of the Report and is no longer than one page. It consists in a non-technical overview, and is dedicated to Management.
It consists in a technical part describing the discovered vulnerabilities and their impact in detail. It is dedicated to the Security Manager.
A technical section with detailed and precise instructions on how to resolve the identified problems. It is dedicated to the Developers.
From €5,000 + VAT
For a single app. The price increases with the platforms to be tested (iOS, Android), the app's roles and flows, APIs and backend services, and the criticality of the data processed.
At the end of the Mobile Application Security Testing you receive a signed document, in Italian and English, stating activity, period and scope. Unlike the report, it contains no vulnerabilities or technical details: you can hand it to anyone who asks for it without exposing yourself. It is included in the service.
Mobile Application Security Testing simulates an attacker targeting an iOS or Android app, whether published on the stores or distributed internally. ISGroup specialists combine manual checks with supporting tools to analyse how the app behaves on the device, the data it stores locally and its communication with the server. Our technical references are OWASP MASVS and MASTG.
In a Black Box test the tester starts from the app downloaded from the store, as any user would. In a Grey Box test the client provides the source code and, where agreed, documentation or credentials: code analysis comes first, followed by runtime checks on the client side and of the interactions with server-side services.
We need the app to be tested, through the store or internal distribution, and an agreed scope, including the platforms and backend services involved.
No. MAST is a manual activity supported by tools and includes the verification of false positives. An automated scan is a different service: if that is what you need, see the Ostorlab mobile app scan.
ISGroup analyses the requests exchanged between the app and the server, where vulnerabilities similar to those of web applications can appear, such as authentication or authorisation flaws and SQL Injection. If you also need to test the related portal or other web applications, consider a Web Application Penetration Test.
You receive a report in three parts: a one-page Executive Summary for management, Vulnerability Details describing vulnerabilities and impact for the Security Manager, and a Remediation Plan with fixing instructions for developers. The signed certificate of execution, in Italian and English, is also included, and you can share it without disclosing any vulnerability.
The retest reassesses the reported vulnerabilities after your team has applied its fixes and indicates whether each one is fully resolved, partially resolved, unresolved or not testable. It is optional for €5,000 projects and included in higher-value projects.
Mobile Application Security Testing starts at €5,000 + VAT for a single app. The price increases with the platforms to be tested, the app's roles and flows, APIs and backend services, and the criticality of the data processed.
Shape your security priorities into a tailored proposal