In this lecture, we will see one of the most important tools for any penetration testing and Gedmin
not only for mobile security, but for any application assessment, and that is batsuit.
OK, and you can set up so to actually view the traffic coming from an Android emulator docking to potentially
beacon infrastructure.
OK, now mobile applications of any kind, such as banking, social networking or any application that
actually contains a lot of functionality that requires Internet communication, they basically have
a typical client server architecture.
So in other words, they actually communicate potentially to the cloud to communicate Wilbekin.
OK.
So whenever you want to understand the exact sort of face for these kind of apps, it is required to
consider all the possibilities of the application, which includes the client application itself, the
API that is actually using to connect to the backend and the server related vulnerabilities and the
database as well.
That is why it's important that you actually have a good security open lifecycle whenever you are creating
your application infrastructure.
But unfortunately, that's not always the case.
And you as a tester may take advantage of the different and that not only the users are actually running
on those applications, but the actual backend infrastructure.
And that's where you can actually use things like Bulbasaur to actually proxy out and evaluate and assist
the victim security posture of that backend infrastructure.
OK, so looking for API abuse, looking for CROSSEYED scripting potentially in some backend servers
or potentially lethal injection.
So don't limit yourself just by looking at the app itself, if not the infrastructure.
As a matter of fact, that's what you are going to probably find most of the vulnerabilities.
OK, now on the defensive side, this is why it's important to have a good trade modeling methodology,
OK?
And this is actually done to identify the traits your application has by defining the assets, the value
that actually provides and the perspective threat actors who might actually be interested to attack
those assets.
And in this case, not only the app or the backend infrastructure, as I mentioned before.
Now, threat modeling ideally needs to be done during the design phase of the application.
However, you as a tester can also build your own tech modeling.
This is actually often considered as the part of the Oregonian's phase in European test engagement.
OK, now let's explore some common threads to mobile apps that have to be addressed during the design
phase for the mobile applications or that you can take advantage of during your testing.
So the first one is the application data at risk of an application store data in the plane side, many
mobile application store sensitive data on the device without any encryption.
This is one of the major problems of mobile applications.
These data can be sensitive, confidential and private.
So data at rest on the device can definitely be exploited in many ways.
OK, so an attacker who actually got physical access to the device can gain access to this data with
pretty much not doing anything.
And potentially also a malicious application that it's actually compromised may gain access to this
data if the device is actually routed or broken.
And from attempt and testing perspective, this is a little tricky because you actually need physical
access to the device or to create a malicious app and then the user to install it in his device, which
in some cases may be out of the scope of your engagement.
But if you are actually doing some type of a more in-depth security research or more in-depth assessment
for your client, absolutely.
You can do this as long as it's the part of the scope.
Now, let's talk about application data in-transit.
Mobile applications that communicate with the backend are highly exposed to attacks that target the
data in transit.
So it is actually quite common to find end users basically joining a public available network.
And you can combine some methodologies like fake access points or even screens and then eavesdrops on
the data using two tools like Boxwood or many proxy or SSL management or the pineapple and many more
ones.