Fixing Mobile AppSec
summary
The talk explains the MASVS and MSTG standards for mobile app security on iOS and Android, specifying concrete requirements and test cases for data storage, inter-process communication, cryptography use, and network security. It describes static, dynamic, and reverse‑engineering checks including an SSL‑pinning bypass demonstrated with Frida, and presents reverse‑engineering tests that show which protections deter attackers versus which are routinely defeated; it also notes Android fragmentation and maintaining rooted/jailbroken testbeds as practical obstacles to complete coverage.
AI-written summary · about
chapters (9)
- 0:00Mobile AppSec intro
- 3:06Common mobile threats
- 7:00Security requirements
- 12:10Implementing controls
- 15:49Testing with MSTG
- 18:18Live tool demo
- 21:02Reverse engineering protection
- 23:53Practical challenges & resources
- 25:42Q&A on SSL pinning
related talks
20mMobile Application Security (MAS)
45mFast Forwarding Mobile Security With The OWASP Mobile Security Testing Guide
29mInsiders Guide to Mobile AppSec with Latest OWASP MASVS
44mHow the latest MASVS & MSTG Specs Make the Best Mobile Pen Testing Cocktails
21mSecuring Mobile Apps with OWASP MASVS & MSTG
01h 13mAutomated Static And Dynamic Security Analysis of Mobile Apps
28mOWASP Mobile Application Security (MAS)
30mTopics of Interest: Creating an IoT-connected Mobile App Compliance Program... MASVS