Do It Yourself: Security Testing for your mobile apps
I once read somewhere: "The lock is for the honest man, the thief will anyway break it!"
I'm reminded of this when I hear about cybersecurity in the technology world. Being an honest guy myself :), I've never tried this kind of stuff to break-into another network and steal data. But, there are people who do it and we need to take precaution so that personal data is not stolen from systems. Every other day, we keep hearing that our Aadhaar data (finger print scans, personal details etc.) isn't safe and that there are millions of records at security risk. The governing body rejects these reports but there is a general perception that these are "steal-able" and that there are so many people taking mobile connections using fake Aadhar cards!
Being part of the technology world, what can one do about this?
The first and foremost is to be aware of the threat and acknowledge that there's danger lurking around.
The second is to see what we can do at individual levels to maintain security, whether it's from a developer perspective or from a QA perspective or from a process and DevOps perspective.
More than training people on better/ secure coding practices, we need to be trained on basics of how people hack into systems.
A few years ago, we were working on a home-automation project that used HTTP commands to control devices from a mobile app. We tried using a HTTP proxy to intercept the commands and change the input parameters (Man-in-the-middle attacks). So, for ex: if I were to turn ON a device from my phone, I could intercept the request and modify it to turn OFF the device and the user will be left confused! This, of course, can happen only if you knew the wifi password. There are people/ techniques for cracking wifi passwords, but that's not our matter in focus at the moment, so we'll save it for a later time.
On a more recent project, I was researching into how I can identify potential security risks in our iOS mobile apps. There were quite a lot of paid tools available, but what caught my eye was the open source tool called MobSF. I was skeptical first, but later decided to give it a try. Interested people can follow this tutorial.
I was able to quickly install the tool with some online help/ documentation. A few errors popped up and I resolved them by installing the dependencies. In about 3 hours, I was all set to do some tests by running the following command:
Excited, I decided to put the .ipa for static binary analysis. Just drag and drop:
The report was informative:
We use HTTP on purpose and so this can't be completely avoided, so I can decide on taking any action on this. Next, I decided to do some source code analysis. So, I bundled the whole source code and put it to test. Since there's a limitation of 256MB for the zipped source, I had to remove some large files before compressing them and uploading for analysis. The generated report was again useful (the files list have been masked by intention):
The report can be looked into for more details. For ex: this report highlights an issue with code CWE-312 (Common Weakness Enumeration). This can be looked up at CWE-312
Similarly, other issues can be searched and we can read more about them.
The score that gets shown is also interesting. In this case, we see Average CVSS as 5.8 and security score as 42/100. CVSS stands for Common Vulnerability Scoring System, details here. As per their qualitative scoring system, a score of 4.0 to 7.0 indicates a "Medium" score and organizations can get a high level assessment of the risks from the rating.
Overall, I was pretty much impressed with some "insights" that could be gathered.
The same tests are usually conducted by some of the "authorized" security testers, they use the same tool and provide the same report, but charge a bomb! But when products are mandated to adhere to processes defined by the regulatory bodies of various countries, they tend to spend and ensure these tests are done and necessary plans have been made to mitigate these risks OR de-prioritise certain features due to various factors specific to the product (end user environment, requirements etc.)
From what I saw, MobSF can also be integrated into our build system and we can run these tests on a regular basis to identify potential threats early. The best part is that this tool doesn't send your source code/ binary to any 3rd party site for analysis. I just had a problem with PDF report generation, but thats a problem that I'll solve another day!
I'm reminded of this when I hear about cybersecurity in the technology world. Being an honest guy myself :), I've never tried this kind of stuff to break-into another network and steal data. But, there are people who do it and we need to take precaution so that personal data is not stolen from systems. Every other day, we keep hearing that our Aadhaar data (finger print scans, personal details etc.) isn't safe and that there are millions of records at security risk. The governing body rejects these reports but there is a general perception that these are "steal-able" and that there are so many people taking mobile connections using fake Aadhar cards!
Being part of the technology world, what can one do about this?
The first and foremost is to be aware of the threat and acknowledge that there's danger lurking around.
The second is to see what we can do at individual levels to maintain security, whether it's from a developer perspective or from a QA perspective or from a process and DevOps perspective.
More than training people on better/ secure coding practices, we need to be trained on basics of how people hack into systems.
A few years ago, we were working on a home-automation project that used HTTP commands to control devices from a mobile app. We tried using a HTTP proxy to intercept the commands and change the input parameters (Man-in-the-middle attacks). So, for ex: if I were to turn ON a device from my phone, I could intercept the request and modify it to turn OFF the device and the user will be left confused! This, of course, can happen only if you knew the wifi password. There are people/ techniques for cracking wifi passwords, but that's not our matter in focus at the moment, so we'll save it for a later time.
On a more recent project, I was researching into how I can identify potential security risks in our iOS mobile apps. There were quite a lot of paid tools available, but what caught my eye was the open source tool called MobSF. I was skeptical first, but later decided to give it a try. Interested people can follow this tutorial.
I was able to quickly install the tool with some online help/ documentation. A few errors popped up and I resolved them by installing the dependencies. In about 3 hours, I was all set to do some tests by running the following command:
python manage.py runserver
Excited, I decided to put the .ipa for static binary analysis. Just drag and drop:
The report was informative:
Similarly, other issues can be searched and we can read more about them.
The score that gets shown is also interesting. In this case, we see Average CVSS as 5.8 and security score as 42/100. CVSS stands for Common Vulnerability Scoring System, details here. As per their qualitative scoring system, a score of 4.0 to 7.0 indicates a "Medium" score and organizations can get a high level assessment of the risks from the rating.
Overall, I was pretty much impressed with some "insights" that could be gathered.
The same tests are usually conducted by some of the "authorized" security testers, they use the same tool and provide the same report, but charge a bomb! But when products are mandated to adhere to processes defined by the regulatory bodies of various countries, they tend to spend and ensure these tests are done and necessary plans have been made to mitigate these risks OR de-prioritise certain features due to various factors specific to the product (end user environment, requirements etc.)
From what I saw, MobSF can also be integrated into our build system and we can run these tests on a regular basis to identify potential threats early. The best part is that this tool doesn't send your source code/ binary to any 3rd party site for analysis. I just had a problem with PDF report generation, but thats a problem that I'll solve another day!
Perfect! My area of work and topic of interest too. CVSE rating of even 7 is considered too much unsafe by us and is taken care of on various platforms. However, in many cases we too should admit that we go for a waiver when there is too much of complexity involved in addressing the issue, concerning platform security.
ReplyDelete