This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

OWASP Mobile Security Testing Guide

From OWASP
Revision as of 06:21, 1 February 2017 by Bernhard Mueller (talk | contribs) (How-To)

Jump to: navigation, search
OWASP MSTG Header.jpg

Our Vision

"Define the industry standard for mobile application security."

We are writing a security standard for mobile apps and a comprehensive testing guide that covers the processes, techniques, and tools used during a mobile app security test, as well as an exhaustive set of test cases that enables testers to deliver consistent and complete results.

Main Deliverables

Masvs-sample-mini.jpg Mobile App Security Requirements and Verification

The OWASP Mobile Application Security Verification Standard (MASVS) is a standard for mobile app security. It can be used by mobile software architects and developers seeking to develop secure mobile applications, as well as security testers to ensure completeness and consistency of test results. The latest release of the OWASP MASVS is already highly usable and can be downloaded in PDF format.

Testing-guide-sample-mini.jpg Mobile App Security Testing Guide

A comprehensive guide for iOS and Android mobile security testers with the following content:

  1. Mobile platform internals
  2. Testing in the secure development lifecycle
  3. Basic white-box and black-box security testing
  4. Mobile reverse engineering and tampering
  5. Assessing software protections
  6. Detailed white-box and black-box test cases that map to the requirements in the MASVS.

The MSTG is a work-in-progress. Currently, we hope to be "feature-complete" in Q2 2017. You can contribute and comment in the GitHub Repo. A table-of-contents for the current master branch is available here.

Checklist.jpg Mobile App Security Checklists

Checklists to be used during verification and testing will be made available shortly.


Classifications

Owasp-breakers-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg

Project Leaders

Bernhard Mueller

Sven Schleier

Project Initiator

Milan Singh Thakur

Road Map

  • Q2 2017: Beta release
  • Q3 2017: Version 1.0
  • Q4 2017: Produce A Printable Book

Parent Project

OWASP_Mobile_Security_Project

Licensing

The guide is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

The OWASP Mobile Application Security Project offers three document that are closely interrelated:

  1. The Mobile Application Security Verification Standard (MASVS) contains generic security requirements along with mappings to verification levels that can be chosen depending on the overall need for security.
  2. The currently-in-development Mobile Security Testing Guide (MSTG) provides verification instructions for each requirement in the MASVS, as well as security best practices for apps on each supported mobile operating system (currently Android and iOS). It is also useful as a standalone learning resource and reference guide for mobile application security testing,
  3. The checklist can be used to apply the MASVS requirements during practical assessments and generate some basic reporting. It also conveniently links to the MSTG test case for each requirement.

Overview-800px.jpg

Depending on the context, the documents can be used either standalone or in combination. For example, one could build the MASVS security requirements into the mobile app SDLC, or refer to them in a mobile app procurement policy. In mobile app development, the MASVS requirements are useful in the planning stages, while the checklist and testing guide are helpful for manual security testing and for the generation of automated tests.

For Mobile App Security Testing

TODO

For Security Engineering in the SDLC

TODO

January 31st, 2017: Mobile App Security Verification Standard v0.9.2 Release and Requirements Freeze

The MASVS has undergone a major revision including a re-write of the security model and verification levels. We also revised many security requirements to address the multitude of issues raised on GitHub.

As the current iteration of the MASVS has reached a quite mature state, we have decided to freeze the MASVS requirements until the MSTG and checklists "catch up" (changes to the requirements list make it necessary to update the other documents as well, causing considerable repeated effort). Save for major issues, the current list of requirements will therefore remain in place until MASVS/MSTG v1.0, and further changes will be reserved for v1.1 or later releases.

MASVS v0.9.2 is available for download in PDF format.

January 28th, 2017: Mobile Crackmes and Reversing Tutorials

Uncrackable-250.png

A key goal of the OWASP Mobile Testing Project is to build the ultimate learning resource and reference guide for mobile app reversers. As hands-on hacking is by far the best way to learn, we'd like to link most of the content to practical examples.

Starting now, we'll be adding crackmes for Android and iOS to the GitHub repo that will then be used as examples throughout the guide. The goal is to collect enough resources for demonstrating the most important tools and techniques in our guide, plus additional crackmes for practicing. For starters there are three challenges:

One of these three already has a documented solution in the guide. Tutorials for solving the other two still need to be added.

We Need More Authors and Contributors!

Maybe you have noticed that the reverse engineering sections in the Mobile Testing Guide are incomplete. The reason: We're still in the starting stages and don't have a lot of authors and contributors (in fact, 99% of the reversing content was produced by one guy). We'd love to welcome *you* as a contributor of crackmes, tutorials, writeups, or simply new ideas for this project.

What You Can Do

The OWASP MSTG is an open project and there's a lot of flexibility - it mostly depends on your skill set and willingness to commit your time. That said, the some areas that need help are:

  • Solving crackmes and contributing a tutorial to the guide (preferable a technique that's not already documented. Check the TOC first).
  • Writing and adding new crackmes along with solutions (should also describe something not already in the guide. Cracking white-boxes, dynamic analysis using an emulator / introspection, etc. etc.).
  • General reversing write-ups to describe specific processes and techniques
  • Help us figure out resiliency testing processes and obfuscation metrics

The reversing part of the guide consists of the following chapters:

How To Join

Read the author's guide first, and join the OWASP Mobile Security Project Slack Channel, where you'll find all the other project members. You can sign up for an account here.

January 22th, 2017: Mobile Testing Guide TOC Available

As of now, we'll be auto-generating a table of contents out of the current MSTG master branch. This reflects the current state of the guide, and should make it easier to coordinate work between authors. A short-term goal is to finalize the structure of the guide so we get a clearer picture of what will be included in the final document. Lead authors are encouraged to complete the outline of their respective chapters.

On another note, we still need additional authors to help with all sections of the guide, including mobile operating system overviews, testing processes and techniques, and reverse engineering. Especially iOS authors are in short supply! As usual, ping us on the Slack Channel if you want to contribute.

December 4th, 2016: Call For Authors: The Ultimate Open-Source Mobile App Reverse Engineering Guide

Reverse engineering is an art, and describing every available facet of it would fill a whole library. The sheer range techniques and possible specializations is mind-blowing: One can spend years working on a very specific, isolated sub-problem, such as automating malware analysis or developing novel de-obfuscation methods. For mobile app security testers, it can be challenging to filter through the vast amount of information and build a working methodology. Things become even more problematic when one is tasked to assess apps that are heavily obfuscated and have anti-tampering measures built in.

One of the main goals in the MSTG is to build the ultimate resource for mobile reverse engineers. This includes not only basic static and dynamic analysis, but also advanced de-obfuscation, scripting and automation. Obviously, writing all this content is a lot of work, both in terms of general content and OS-specific how-tos. We're therefore looking for talented authors that want to join the project early on. Topics include the following:

  • Basic Hybrid Static/Dynamic Analysis
  • Code Injection and Dynamic Instrumentation (Substrate, FRIDA)
  • Dynamic Binary Instrumentation (Valgrind, PIE)
  • Analysis Frameworks (Metasm / Miasm)
  • Symbolic Execution
  • DCA and DPA attacks on white-box crypto
  • Dynamic analysis frameworks (PANDA / DroidScope,...)
  • Anything else we might have missed

What is in for me?

All of this is unpaid, volunteer work. However, depending on your contribution, you will be named in the "lead authors" or "contributors" list, and you'll be able to point to the fact that you co-authored the guide. You'll also be contributing to the field, helping others who are just starting out, and in turn becoming a happier person yourself (reaping the full benefits of your altruism).

Where do I sign up?

First of all, have a look at the existing RE chapters outline:

You'll probably immediately have ideas on how you can contribute. If that's the case, read the author's guide first.

Then contact Bernhard Mueller - ideally directly on the OWASP Mobile Security Project Slack Channel, where you'll find all the other project members. You can sign up for an account here.

How can I participate in your project?

First of all, read the author's guide and decide in what for you would like to contribute. Then, contact the lead author responsible for the chapter you are interested in. You can find their name and GitHub handle in the project README. Please always check with the responsible person first, or you might end up working on a chapter that's already being done by someone else. In any case, we encourage you to join OWASP Mobile Security Project Slack Channel, where you'll find all the other project members. You can sign up for an account here.

The home of the OWASP Mobile Security Testing Guide is on GitHub. The MASVS is hosted in a separate repository.

Where do you guys need help the most?

There's a lot of areas where you can help out:

  • Writing original content, such as describing testing processes and writing test cases. We're all doing this in our spare time, which unfortunately means that things sometimes slow down to a crawl. If you're knowledgeable in some area and have time available, we'd be incredibly thankful to anyone who contributes, even if it's only one or two test cases.
  • Reviewing content and giving feedback. The proper channel for questions and feedback is the GitHub issues system of the respective repo, contacting us on OWASP Mobile Security Project Slack Channel is another possibility.
  • Developing tools. For example, we still don't have an automated way of generating checklists out of the GitHub repo.
  • Contributing to auxiliary projects: The obfuscation metrics project is an auxiliary project that deals with specific forms of control flow and data obfuscation. This project needs experts in advanced obfuscation / de-obfuscation. Please contact us if you have experience in this area.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

I contributed to the original Google Doc, but I'm not credited in the new version of the MSTG?

As we migrated some of the existing content, we did our best to backtrack the original authors and credit them appropriately. We also added a revision history that lists all the authors from old Google Docs. If you are not on that list but feel you should be, please contact Bernhard or Sven and they'll fix it. Or better yet, re-join the author's team and start contributing to the new guide.

Contributors

The Mobile Security Testing Guide was initiated by Milan Singh Thakur in 2015. The original document was hosted on Google Drive. Guide development was moved to GitHub in October 2016. Below is the full list of contributors for each revision.

MSTG in its current form

Lead Authors:

  • Stephen Corbiaux
  • Bernhard Mueller
  • Sven Schleier
  • Francesco Stillavato
  • Stefan Streichsbier
  • Abdessamad Temmar
  • Stephanie Vanroelen
  • Gerhard Wagner
  • Jeroen Willemsen

Contributors:

  • Davide Cioccia
  • Bao Le
  • Shiv Patel
  • Prathan Phongthiproek
  • Abhinav Sejpal
  • Anant Shrivastava
  • Pragati Singh
  • Milan Singh Thakur
  • Blessen Thomas
  • Dennis Titze
  • Bernard Wagner

MSTG "Beta 2" on Google Drive

Authors:

  • Mirza Ali
  • Stephen Corbiaux
  • Ryan Dewhurst
  • Mohammad Hamed Dadpour
  • David Fern
  • Ali Yazdani
  • Bao Lee
  • Anto Joseph
  • Nutan Kumar Panda
  • Rahil Parikh
  • Julian Schütte
  • Abhinav Sejpal
  • Anant Shrivastava
  • Pragati Singh
  • Milan Singh Thakur
  • Stephanie Vanroelen
  • Gerhard Wagner

Reviewers:

  • Andrew Muller
  • Jonathan Carter
  • Stephanie Vanroelen
  • Milan Singh Thakur

MSTG "Beta 1" on Google Drive

Authors:

  • Mirza Ali
  • Mohammad Hamed Dadpour
  • David Fern
  • Rahil Parikh
  • Abhinav Sejpal
  • Pragati Singh
  • Milan Singh Thakur

Reviewers:

  • Andrew Muller
  • Jonathan Carter

Top Contributors:

  • Jim Manico
  • Yair Amit
  • Amin Lalji
  • OWASP Mobile Team