OWASP Mobile Security Project Updates Guide App Testing and Threat Modeling

Summary

Ryan Lloyd and Jan Serdynski discuss updates to the OWASP Mobile Application Security Project, including threat-based testing profiles, mobile storage risks and guidance for consistent security testing.

Key points

• The updated testing guide breaks a long narrative into individually referenceable weaknesses, tests and demonstrations.
• Testing profiles distinguish essential security, advanced security, resilience and privacy according to an app’s threat model.
• Serdynski said sensitive data in Android external storage may be readable by other apps, while rooted devices can expose internal storage.
• The guide’s demonstrations use Radar2 for static analysis and Frida for dynamic analysis.
• A testing profile addresses weaknesses relevant to EU digital identity wallets; organizations can also create their own profiles.
• Serdynski cautioned that LLM test results can vary and said humans must review LLM-assisted contributions to the project.