In this lesson,
we're going to explore mobile scans,
focusing on different types
of scans used to identify vulnerabilities
and mobile applications and devices.
Mobile scanning is essential for ensuring
the security of mobile apps,
which are increasingly becoming
a target for attackers.
Let's start by defining what mobile scanning is.
Mobile scanning involves using tools
and techniques to analyze mobile applications
and devices to identify security vulnerabilities,
misconfigurations, and potential threats.
Given the widespread use of mobile devices
and the sensitive data they often contain,
securing mobile applications is crucial.
Mobile scanning can be divided into several types,
including static analysis, dynamic analysis,
and behavioral analysis.
We'll focus on two key types of scans,
Static Application Security Testing (SAST),
and Dynamic Application Security Testing (DAST),
as they apply to mobile apps.
Static application security testing (SAST),
for mobile apps involves analyzing
the source code by code or binary code
of an application without executing it.
SAST tools look for vulnerabilities
such as insecure coding practices,
hardcoded credentials,
and potential injection points.
This type of analysis is performed early
in the development lifecycle to catch security issues
before the application is deployed.
For example, SAST tools, like MobSF,
can decompile and analyze Android APK
and iOS IPA files to identify potential security issues.
This is useful for analyzing third-party applications
or libraries when the source code is not available.
Dynamic Application Security Testing (DAST),
for mobile apps involves analyzing application
while it is running.
DAST tools simulated text to identified vulnerabilities
that can be exploited at runtime,
such as insecure communication channels,
improper session handling, and data leakage.
Tools like OWASP ZAP and Burp Suite
can be used to intercept
and analyze network traffic between the mobile app
and its backend services,
checking for issues like insecure transmissions
of data or improper authentication mechanisms.
Additional mobile app security techniques
include permission analysis and configuration analysis.
Mobile applications often request various permissions
to access device features.
Analyzing these permissions help identify
potential security risks associated
with over-privileged applications.
Misconfigurations in mobile applications
can lead to security vulnerabilities.
Tools like QARK (Quick Android Review Kit),
can analyze the configuration settings of mobile apps
to identify common security misconfigurations,
such as improper SSL/TLS implementation
or insecurity data storage.
So remember, mobile scans are essential for identifying
and mitigating vulnerabilities in mobile
applications and devices.
Static Application Security Testing (SAST),
analyzes the source code or binary code
of the application without executing it,
identify potential security falls
early in the development cycle.
Dynamic application security testing (DAST),
analyzes the running application, simulates attacks
to identify vulnerabilities that occur at runtime.