Free OWASP Top 10 CBT

Language agnostic. Complete at your own pace.
Real exploit concepts around web application threats, vulnerabilities & strategies to mitigate them.

2 Days Training

2 Days Training

11 Chapters <br />12 Interactive Labs

11 Chapters
12 Interactive Labs

Mobile Developers, QA/Analysis, Security Testers

Mobile Developers, QA/Analysis, Security Testers

Instructor Led<br />CBT / Remote<br /> Training Available

Instructor Led
CBT / Remote
Training Available

Course Overview

Students will discover mobile hacking techniques for Android and iOS. They will understand the platform security models, device security models, app analysis, file system analysis and runtime analysis for these popular mobile operating systems.

This course will provide students with the knowledge necessary to assess mobile app security including what hackers look for in mobile apps. Hacking apps themselves will equip them with the skills required to protect their own apps from attacks.

Students will come out with an understanding of the pitfalls to mobile device security and the importance of developing mobile apps securely. They will learn the concepts necessary to securely develop mobile in your organization.

Learning Objectives

  • Perform attacks against sample mobile apps to understand the weaknesses that exist in the current device security models.
  • Implement secure coding techniques into your mobile development lifecycle to protect your mobile apps from high risk attacks.
  • Communicate mobile device security threats and the risks associated with mobile devices from an enterprise perspective.

Outline

Introduction

  • The mobile landscape

1. Device Security Model

  • Mobile OS security models
  • App distribution models
  • Sandboxing and permissions structure
  • Differences from iPhone/Android platforms
  • The risk of users who trust apps too much
  • Common attack vectors in mobile security

2. Protocol Analysis

  • Proxying Android / iPhone
    • Handling SSL certificate trust
  • Emulator & simulator proxying
  • Physical device proxying
  • Tools required for intercepting traffic
  • LAB: Proxying mobile app traffic
  • LAB: Mobile traffic manipulation

3. Device File System Analysis

  • Android file system analysis
    • Using android debugging bridge
    • Retrieving files from the device
  • iPhone file system analysis
    • SSH access to iPhone
    • SCP to retrieve files from device
  • LAB: Insecure file storage
  • Common data storage types for mobile OS'
  • Logging for developers
  • Assessing logs on Android/iPhone
  • LAB: Insecure Logging

4. Mobile App Decompilation

  • Android APK packaging
    • Application layout
    • Android manifest and permissions
    • Disassembly and decompilation
  • LAB: Basic encryption
  • iPhone IPA packaging
    • Handling plists
    • Assessing the binary
  • LAB: Advanced encryption

5. Mobile Run-time Analysis

  • Why runtime analysis?
  • Debugging as an attack vector
  • Rooting and Jailbreak of devices
  • Accessing Android memory at runtime
    • DDMS and MAT
  • LAB: Dumping memory
  • iPhone debugging

6. Other Mobile Topics

  • Mobile Cryptography
    • Password based key derivation
  • LAB: Password complexity
  • Jailbreak detection
  • State of Mobile malware
  • Mobile malware defense

7. Mobile Run-time Analysis

  • Why runtime analysis?
  • Debugging as an attack vector
  • Rooting and Jailbreak of devices
  • Accessing Android memory at runtime
  • DDMS and MAT
  • LAB: Dumping memory
  • iPhone debugging
  • 8. Multi-platform Development

    • Why multiplatform?
    • How wrapper APIs work
    • HTML5 codebase concerns
      • PhoneGap example
    • Implications to JavaScript bridging
    • Native features through JS
    • JS to Native API in iOS/Android
    • Dynamic loading and minification
    • LAB: HTML at Rest

    9. Mobile HTML5 Web

    • HTML5 Mobile apps
    • Clickjacking
      • Framebusting
      • X-FRAME-OPTIONS
    • Tapjacking
      • Android defenses
    • SQL Injection (Local vs Mobile)
      • Parameterized SQL
    • XSS
      • Existing XSS mobile exploits
      • JS bridging concerns
      • Safe output encoding
      • Securing WebView
    • Localstorage
      • Use of local storage
      • Securing localstorage

    10. Device API Weaknesses

    • SSL
      • Android / iOS SSL best practice
      • Weak ciphers
    • XML Parsing
      • Prevalence in Andriod/iOS
      • External entity references
    • Virtual Keyboards
      • iOS Keyboard cache
      • Android 3rd party keyboards
      • PIN entry
    • Copy and Paste
      • iOS UIPasteboard
      • Android ClipboardManager
      • Trouble with WebView
    • iOS Snapshots
      • Preventing insecure snapshots
      • Good backgrounding
    • Geolocation
      • iOS / Android Geolocation management
    • Address Book API
      • Privacy
    • URL Handlers / IPC
      • iOS URL schemes
      • Skype vulnerability
      • Android Intent Filters / IPC
    • LAB: URLs Handlers to XSS

    11. Other Mobile Topics

    • Endpoint Security
      • Weak SSL
      • Securing Cookies
    • Mobile Cryptography
      • Password based key derivation
    • LAB: Password complexity
    • Jailbreak detection
    • State of Mobile malware
    • Mobile malware defense

    Download Datasheet

    Download Datasheet

    Security Compass training courses are offered using a variety of delivery methods. Download the data sheet to learn more.

    Public Classes

    Security Compass offers this course as a public class. Contact us for a schedule of all our upcoming public training classes.