Mobile app security assessments

I wrote recently about performing source code analysis for mobile apps. I'm seeing some crazy stuff that I didn't think I'd see in mobile apps (but I'm not really surprised) related to session manipulation, hard-coded cryptographic keys and the like which underscores the importance of the exercise.

But there's another side to mobile app security assessments - it's simply manual analysis. That is poking around with the apps and the mobile devices using good tools and proper techniques to find and demonstrate security and forensic-related flaws that aren't uncovered in traditional user, functional, and QA testing. In recent application assessments, I've found things like:

• login-related weaknesses
• information mishandling
• insecure interactions with external applications/systems
• exploits in general functionality that put PII at risk

Odds are good that you or someone you know is rolling out a new mobile app. Or perhaps you were an early adopter and need to validate that your existing apps are reasonably secure. The question is: What are you doing to ensure things are in check? 

Like I say about a lot of things related to information security...do it yourself, allow me to help, or hire someone else - just do something.

Read More

Yet another reason to get more in tune w/mobile & the cloud

Here's a good post from Elcomsoft's Vladimir Katalov that underscores the dangers of many things I've written and spoken about in recent years:

1. Cloud security - especially as it relates to mobile apps (and in the case of this piece, iCloud) 
2. Mobile control - BYOD, MDM and all those buzzwords sound nice but what exactly are you doing to ensure the business information that's being carelessly handled by your employees is kept in check? What's going to happen when it's exposed via such backdoors? 
3. Legal documents - you can have all the privacy laws, policies, and end user agreements in the world but, at the end of the day, they're basically worthless. If the imperial government wants something, especially control like I talked about here, they're going to get it.

It's time to wake up and take some action.

Read More

Self-delusion + infosec= foolishness

I thought this quote from Ronald Reagan was quite fitting for President's Day:

"If history teaches anything, it teaches that self-delusion in the face of unpleasant facts is folly."

Read More

Mobile app security testing - are you checking for all the flaws?

I plan to write a related post soon on my mobile app security assessments. In the meantime, I wanted to share a tool with you that plays a key role in mobile app security: Checkmarx CxDeveloper (or perhaps more appropriately called CxSuite).

If you're a developer, QA professional, security manager, or IT generalist, this is a good tool to have for all of those gotta-have-now apps that everyone is throwing together getting in the app stores.

I've used CxDeveloper to find flaws in iOS and Android-based apps that may not be discovered via traditional testing such as:

• Code injection
• Session fixation
• Path traversal
• Weak passwords
• Hard-coded cryptographic keys

...all things that I'm not smart enough to find on my own. Nor do I have the time.

For a few years now, I've dealt with the folks at Checkmarx and everyone from their CTO to their Director of Marketing - and a few others in between - has been super nice and responsive to my sometimes ridiculous requests.

Here's a guest blog post I've written for them:
Three compelling reasons to check your mobile app source code

And a webinar as well:
The Business Value of Partial Code Scanning

I also cover CxDeveloper in my Mobile Security chapter in the latest edition of my book Hacking For Dummies.

CxDeveloper isn't without its flaws. It's installation process and interface can be cumbersome but nothing that can't be overcome. It's certainly a worthy alternative to the big-box competitors...check it out if you want to find out the rest of the story with your mobile apps.

Read More

Reactive security, eh? How’s that workin' for ya?

Every time I browse the Chronology of Data Breaches and read the headlines coming out from Dark Reading, threatpost, and the like, I can't help but shake my head.

What is it really going to take to get people - mostly management, but some in IT - to fix the stupid, silly, low-hanging fruit that's plaguing so many networks today...? Well, here's a new piece I wrote for the nice folks at Lumension where I delve into this subject a little more.

As Thomas Jefferson said, Determine never to be idle. It is wonderful how much may be done if we are always doing. Our security problems can be fixed if we choose to fix them.

Read More

What's your communication style?

Great IT & infosec-related quote:

"Wise men talk because they have something to say; fools, because they have to say something." -Plato

Good communication is arguably the most important factor for success.

Read More

Introducing the brand new Hacking For Dummies, 4th edition

Well, it's here...the fourth edition of my book Hacking For Dummies is officially available today!



Starting summer of 2012 and ending just before Christmas, I put in over 200 hours of blood, sweat, tears, and occasional cussing into this edition...more than any previous updates to the book. That said, my savvy technical editor, Peter Davis, and the wonderful editors at Wiley, Becky Huehls, Virginia Sanders, and Amy Fandrei were the real magic behind it all.

Thanks to everyone's hard work, I truly feel like Hacking For Dummies has finally come of age.

You're not going to learn every single technical detail of every possible security test. As I've said in the past, you need to use the proven time-management principle of focusing on the urgent and the important...eliminating the nasty, silly, and dangerous low-hanging fruit in your environment.That's exactly what Hacking For Dummies, 4th edition is all about.

In addition to walking you through, step by step, the entire information security assessment process (understanding the threats, planning, testing, reporting, and plugging the holes), I also talk about getting management buy-in and costly mistakes to avoid. I share my real-world experiences on what to do and what not to do in order to get the most out of your information security testing and risk management processes.

This edition has a lot of new content including coverage of Windows 8, mobile devices, and mobile apps. I've also fleshed out my chapters on hacking passwords, wireless networks, and web applications.

Hacking For Dummies is not the be-all end-all resource for information security testing. I wouldn't want to put myself out of business! And after all, there is no definitive resource on this subject.

What I can say is if you're looking for a no frills, common sense, street smart guide on the core essentials of ethical hacking, the key vulnerabilities to test for, and some hard lessons I've learned along the way, then Hacking For Dummies, 4th edition is for you. Check it out...I think you'll like it.

Read More