OWASP Top 10 Mobile 2024 with Hands On Demos

Identify improper credential usage in mobile apps, including insecure transmission, insecure storage, and hard-coded credentials, and mitigate by encrypting credentials in transit and at rest, using keystores, and rotating tokens.

Secure mobile apps by addressing inadequate supply chain security through securing third-party components, applying software composition analysis and security scans, patching vulnerabilities, and enforcing signed app distribution.

Learn how insecure authentication and authorization affect mobile apps. Identify indicators like anonymous API calls and role transmission, then apply server-side checks and strong policies to mitigate risks.

Explore insufficient input output validation in mobile apps. Learn to validate and sanitize inputs and outputs, prevent SQL, XSS, and command injection attacks, and apply secure coding and security assessments.

Learn how insecure communication in mobile apps exposes data to interception, eavesdropping, and tampering, and how to mitigate with TLS 1.2+, certificate pinning, and proper certificate verification.

Discover how inadequate privacy controls risk PII in mobile apps, stemming from insecure data storage, insecure communication, and weak authentication, and mitigate with least PII data, anonymization, and expiration-based deletion.

Explore how insufficient binary protections enable reverse engineering and tampering, and learn practical mitigations like code obfuscation, app signing, startup integrity checks, and secure server validation.

Identify how security misconfiguration enables unauthorized access and data breaches in mobile apps. Secure defaults and credentials, disable debugging and backup modes in production, and avoid improper storage.

Identify insecure data storage risks in mobile apps, including weak encryption, poor access control, and misconfigured cloud storage, and apply mitigations like secure storage, TLS, and input validation.

Identify insufficient cryptography in mobile apps, note weak algorithms like SHA-1 and short key lengths, then implement AES or RSA with 256/2048-bit keys and secure key management.

Set up a local lab to explore the OWASP mobile top ten with hands-on demos, using the insecure Bank v2 app on a Genymotion Google Pixel emulator.

Continue the lab setup by creating a Google Pixel Excel emulator on Android 8.1 with Genymotion, then install Python 2.7.18 on Windows and complete step three.

Set up the mobile security lab by downloading and extracting Android platform tools, configuring the environment path, verifying adb access, and cloning insecure bank v2 app for hands-on demonstrations.

Install dependencies from the android insecure bank v2 requirements file, run the server with python app.py on port 8888, and set up the Genymotion emulator with adb for testing.

Demonstrate decompiling an android apk to reveal insufficient binary protection and security misconfigurations. Identify weak configurations in decompiled source by searching for sensitive keywords like admin in strings file.

Decompile the android APK using APK tool, inspect the decompiled source for admin misconfigurations, and demonstrate how client-side admin controls create security risks.

Identify insecure authentication and authorization in an Android app by modifying admin settings amid misconfiguration, building and signing a new APK, and validating a create user vulnerability through adb installation.

Identify insecure authentication and authorization in an Android app by editing isadmin to yes, rebuilding, signing, and reinstalling a modified APK to enable admin mode and reveal create user.

Install docker desktop for Windows by downloading and installing, then sign in with Docker Hub to access UI. Resolve issues by enabling Virtual Machine Platform and upgrading to WSL2.

Run static application security testing scans on android apk and ios files using mobx sf, the open-source mobile security framework, to identify vulnerabilities.

Analyze a static application security testing scan of an Android app using MobSF to reveal Android manifest details, exported activities, debug configurations, and insecure certs, plus remediation guidance.

Demonstrate a static application security testing scan of an iOS mobile app using Mobicip, uploading an IPA, and reviewing security score 21, URL schemes, ATS settings, and binary weaknesses.