Best Practices for Mobile App Security Testing
summary
Automated and manual testing finds concrete failures: about 85% vulnerable and roughly half leak private data; static scans miss many issues that dynamic analysis and tools like FRIDA and RADERE expose. Real cases include a coupon app with coupon forgery by moving logic to the device, a food app whose update deep link is altered to steal money via deep-link Venmo redirection (CVSS 9.8), and an energy app exposing lock codes through misconfigured content providers. Prioritize dynamic testing and hostname/cert validation.
AI-written summary · about
chapters (8)
- 0:00Introduction and overview
- 4:24Biometric authentication flaw
- 8:42Content provider data leak
- 12:38Host validation failure demo
- 17:52Coupon app logic tampering
- 20:39Dynamic vs static testing gap
- 27:00Best practices for secure development
- 31:11Resources and closing
related talks
37mMobile DevSecOps: 5 Tips from Building Mobile Apps Used by Millions
30mMobile DevSecOps 5 Tips from Building Mobile Apps Used by Millions
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
48mHow to Meet the New Mobile Application Security Imperative
52mMobile Application Assessments By The Numbers: A Whole-istic View
01h 13mAutomated Static And Dynamic Security Analysis of Mobile Apps
37mHow to find vulnerabilities in a mobile app
40mBest practices for shielding mobile apps from emerging threats