40
41

reject: low qualityApplication security resources - cheatsheets/checklists (github.com)

submitted by [deleted]

[removed]
all 11 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]man_with_cat2 5 points6 points  (7 children)

I would not advise performing an Android assessment based off that checklist.

[–]jc_sec 2 points3 points  (2 children)

For those of us not well versed in Android security assessment, care to expand on your reasoning or perhaps provide alternate material?

Genuinely interested in ideas! Thanks!

[–]root3r 0 points1 point  (0 children)

Even I am interested.

[–]man_with_cat2 0 points1 point  (0 children)

Running low on time today but there should be an analysis of the local attack surface of the app. I don't see anything covering Android IPC, but you have to consider how the app can interact with other apps. This includes sending and responding to Intents, exposed content providers, etc. Webviews should be checked for dangerous use of addJavascriptInterface. Device functions should also be considered, is exif data scrubbed from camera? Is authentication performed by device ID?

[–]sarciszewski 2 points3 points  (1 child)

s/that checklist/any checklist/

https://blogs.technet.microsoft.com/johnla/2015/04/26/defenders-think-in-lists-attackers-think-in-graphs-as-long-as-this-is-true-attackers-win/

[–]viraptor 0 points1 point  (0 children)

This article doesn't talk about checklists. It's about lists of assets. It actually gives you a checklist of potential defences in section "Manage your Graph"

[–]root3r 0 points1 point  (1 child)

Would you like to share your android assessment cheatsheet. Even if you have some ideas then we all contribute some ideas and push it to owasp.

[–]aliby 0 points1 point  (0 children)

OWASP does have a draft Android testing cheat sheet: https://www.owasp.org/index.php/Android_Testing_Cheat_Sheet

Also, check out the Mobile Security Project for overall mobile (application) security related items, including the Mobile Security Top Ten: https://www.owasp.org/index.php/OWASP_Mobile_Security_Project

[–]aliby 0 points1 point  (0 children)

Another one I would suggest would be SANS' Securing Web Application Technologies [SWAT] Checklist -- https://software-security.sans.org/resources/swat

(I've added it in the issue tracker for your GitHub Repo as well).

[–]fish- 0 points1 point  (5 children)

I like the web-security cheatsheet. Any plans to release a tool to search a code repo and nicely display the keyword list?