With the evolution of smartphones, mobile security has become as pressing as ever. The advent of mobile applications has already facilitated our lives in a significant way. Today through a mobile application, we can do almost everything- from eCommerce to shopping and online learning. If you think there are still applications a smartphone doesn't possess, believe me, it's already hitting the road to development.

Mobile application development helps both the developer and the application user. Despite the unprecedented growth of app development and mobile applications, many users still fear using them due to security issues. As a consumer, if you are using a particular mobile app, let's say, a mobile banking app, you need to emphasize the functionalities and the security offered. For developers, it is essential to thoroughly think of a security strategy before the application's development phase. Quoting Fraud watch international, Mobile Application security defends mobile device apps from cyber threats. No client will like to pay for an app that is not secure; trust me henceforth. MobSF is one such component that uses state-of-the-art infrastructure in the mobile app security domain.

Table of Contents

\

What is MobSF?
Why Should We Secure Mobile Apps?
When should you use MobSF?
What are the different features of MobSF?
What do you need to Get Started with MobSF?
1. Requirement
  1. For Static Analysis
    1. Windows
    2. Mac
    3. Linux/Mac
  2. For Dynamic Analysis
2. Installation
  1. Windows
  2. Linux/Mac
3. Updating Mobile Security Framework
  1. Windows
  2. Linux/Mac
4. Running Tests
5. Common Errors
Which are other tools?
1. Free Mobile Security testing tools and Open Source MSF
2. Paid Mobile Security testing tools
Comparing MobSF with Datatheorem and AppKnox.

\

What is MobSF?

Mobile Security Framework(MobSF) is simply an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis, and security assessment framework capable of performing static and dynamic analysis. MobSF can also perform Web API Security testing with its API Fuzzer, Information Gathering, analyze Security Headers, and identify Mobile API specific vulnerabilities like Path Traversal, IDOR. It supports mobile application binaries such as IPA, APK, and APPX in addition to zipped source codes.

\

Importance of Mobile Security

Before continuing to talk about Mobile Security Framework, it is essential to understand mobile security. Creating a mobile app is not always a big deal. The market is full of tools to help developers in their initial phase. With the advancement of technology, even non-coder can create their own web or mobile application. But maintaining the app and ensuring its security is one challenge most developers face.

Mobile security prevents vulnerabilities like:

\

Arbitrary code execution
Malware
Encryption problems
Leaking personal data over the internet
Malicious code injection

\

Moreover, a weak mobile security strategy may still cause issues with your device. Mobile security may seem time-consuming, but it's necessary to maintain a strong relationship with users. NowSecure, a mobile security company, tested 250 Popular Android apps in November last year and discovered that more than 70% of apps leaked sensitive personal data. The 2019 Identity Fraud Study by Javelin Strategy revealed that around 14.4 million users were victims of identity thefts in the US. Most hackers use mobile phone accounts to generate phishing attacks on consumers. It is upon developers to understand and counter existing mobile application security threats and stay updated with coming threats.

To counter rampant cyberattacks on smartphones, OWASP (Open Web Application Security Project), a nonprofit organization known for improving software security and community-led open-source software projects, came out with the "OWASP Mobile Top Ten" mechanism to enhance mobile security framework. These include:

\

With recent cyberattacks that directly targeted governments, most software companies have issued security warnings to their users. In a bid to secure your mobile devices against identity thefts, MobSF has come up with automated mobile security testing.

\

When and Why Should You Use MobSF?

Trying to figure out which mobile app security application you should use and when? Well, the apparent answer is Mobile Security Framework(MobSF). The security framework works best for:

\

developers engaged in multi-platforms
local environment
performing a quick security test

\

Developers use MobSF to identify security vulnerabilities during development. Other factors you may consider while choosing a mobile automation tool are:

\

License Cost if applicable
"Support and Update" policy of the mobile automation tool vendor
The cost of training employees on the tool
Hardware and Software requirements

\

What are the different features of MobSF?

MobSF has many features like:

\

Analysis:

\
1. Static Analysis: You can perform source code-based analysis without running the application. It can be used in line with application development. Static testing will be more effectively carried out regularly within a predetermined time. This is so that when a release or an update is carried out, a test can be done without necessarily having to run the app.
  
  \
2. Dynamic Analysis: It consists of testing the app when it's in operation. The main goal of Dynamic testing is to analyze and look for security holes in running applications. Dynamic analysis can be done in the app's development phase or when it has entered the production phase.
  
  \
Pen-testing
Malware analysis
Use REST API
Perform Mass Static Analysis
VirusTotal Scan. By default, it is disabled, and you need to add your VirusTotal API Key before enabling it.
Postgres DB instead of SQLite. You can use Postgres instead of the default SQLite.
Other Security assessment
Dynamic SSL testing
Responsive UI

\

Performing Static Analysis with MobSF

Windows

If you are using windows, you need to:

\

Installxn--Git-xda
Installxn--Python-ogag3.8-3.9
Installxn--JDK 8+-oga
Installxn--Microsoft Visual C++ Build Tools-g4a
Installxn--OpenSSL (non-light)-ksa
Download & Installxn--wkhtmltopdf-8ka as per thexn--wiki instructions-qqa
Add the folder that contains wkhtmltopdf binary to the environment variable PATH.

\

Mac

For Mac:

\

Installxn--Git-xda
Installxn--Python-ogag3.8-3.9
After installing Python 3.8+, go to /Applications/Python 3.8/ and run Update Shell Profile.command first and then Install Certificates.command
Installxn--JDK 8+-oga
Install command-line tools Xcode-select --install
Download & Installxn--wkhtmltopdf-8ka as per thexn--wiki instructions-qqa
Windows App Static analysis requires a Windows Host or Windows VM for Mac and Linux.xn--More Info-fja

\

Ubuntu/Debian based Linux

\

Install Git sudo apt-get install git
Install Python 3.8-3.9 sudo apt-get install python3.8
Install JDK 8+ Sudo apt-get install OpenJDK-8-JDK
Install the following dependencies. Open a terminal and paste the following.
sudo apt install python3-dev python3-venv python3-pip build-essential libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev zlib1g-dev wkhtmltopdf
Windows App Static analysis requires a Windows Host or Windows VM for Mac and Linux.xn--More Info-fja

\

Performing Dynamic Analysis with MobSF

Dynamic Analysis won't work if you use a MobSF docker container or set up MobSF inside a Virtual Machine.
Installxn--Genymotion-cka orxn--Genymotion Cloud VM-ksa orxn--Android Studio Emulator-7va

\

NB: For Windows, set the JAVA_HOME environment variable. iOS IPA Analysis works only on Mac, Linux and Docker containers. \n

How to Install MobSF?

The installation process is relatively easy. Make sure you have set up everything beforehand based on your platform requirements. We have tested it on Windows 10, Ubuntu (18.04, 19.04), macOS Catalina.

Windows

If you are using Windows, follow the steps below:

\

Clone this repository: git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
Navigate to the clone folder: cd Mobile-Security-Framework-MobSF
Run setup.bat

\

NB: Before running setup.bat, close any text editor or open folders of MobSF. This is in order to prevent any interruption during the installation.

Linux/Mac

\

Clone this repository: git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
Navigate to the cloned folder: cd Mobile-Security-Framework-MobSF
Run the setup file with the command: ./setup.sh

\

Running MobSF

Running it is pretty easy; you just need to execute the following command depending on your operating system.

Windows

NB: MobSF will listen to 0.0.0.0:8000 if you use the run script without arguments.

Linux/Mac

As for Linux and Mac OS run ./run.sh 127.0.0.1:8000

\

How to Update MobSF?

If you need to update MobSF, it is necessary to migrate your database or else you may encounter issues such as:

[ERROR] Saving to DB (E:\Mobile-Security-Framework-MobSF\StaticAnalyzer\views\android\db_interaction.py,

LINE 236 "static_db.save()"): table StaticAnalyzer_staticanalyzerandroid has no column named

Windows

For a Windows system, do the following:

\

cd Mobile-Security-Framework-MobSF/
git pull origin master
.\venv\Scripts\activate
pip install --no-cache-dir --use-deprecated=legacy-resolver -r requirements.txt
python manage.py makemigrations
python manage.py makemigrations StaticAnalyzer
python manage.py migrate
deactivate

\

Linux/Mac

For Linux and Mac OS, perform the following:

\

cd Mobile-Security-Framework-MobSF/
git pull origin master
. venv/bin/activate
pip install --no-cache-dir --use-deprecated=legacy-resolver -r requirements.txt
python manage.py makemigrations
python manage.py makemigrations StaticAnalyzer
python manage.py migrate
deactivate

\

Run setup.sh or setup.bat to avoid a bug. However, running the function might delete your previous scan results.

\

How to Run Tests on MobSF?

We used Tox for running tests. Tox is a generic virtualenv management and test command-line tool. Some use-cases of Tox involves:

\

Verifying package installation process with different Python versions and interpreters.
Running your tests in simulating environments and configuring your test tool of choice.
Acting as a frontend to continuous integration servers, significantly reducing boilerplate and merging CI and shell-based testing.

\

Install tox outside virtualenv.

pip install tox
For linting, run the following command

tox -e lint
For running lint + test use:

tox -e lint,test

\

Common Errors Encountered by Developers

These are some common errors you may encounter when running static or dynamic analysis.

For example, you get something like this:

[ERROR] Saving to DB (E:\Mobile-Security-Framework-MobSF\StaticAnalyzer\views\android\db_interaction.py,

LINE 236 "static_db.save()"): table StaticAnalyzer_staticanalyzerandroid has no column named

The error is database-related and is created during static analysis. You may have encountered this error because of a newer version of MobSF with database scheme changes. To solve this, update MobSF.

Another problem you can encounter is the APK failing to install. You will get an error message like:

ADB: failed to install C:/Users/XXXX/Mobile-Security-Framework-MobSF/uploads/xxxx/xxxx.apk: Failure [INSTALL_FAILED_NO_MATCHING_ABIS: Failed to extract native libraries, res=-113]

This APK cannot be installed. Is this APK compatible with the Android VM/Emulator?

ADB: failed to install /x/xxx/xxx.apk: Failure

[INSTALL_FAILED_MISSING_SHARED_LIBRARY: Package couldn't be installed in /data/app/com.xxx. xxx-1: Package com.xxx.xxxx requires unavailable shared library com.google.android.maps; failing!] \n

The INSTALL_FAILED_NO_MATCHING_ABIS error occurs when you install an app with native libraries targeting an unsupported architecture like ARM. Genymotion or Android Studio Emulator x86 runs x86 or x86_64 architecture of Android, and hence ARM libraries cannot work. So you need to provide the right APK targeting the right platform or use an ARM architecture-based Android Studio Emulator for Dynamic Analysis.

You could make some ARM-targeted apps work with Genymotion by using an ARM translation module. See Genymotion ARM Translation. Sometimes, you need Google Apps like the Playstore service for your app to run. In such cases, install the correct version of GApps for the Android version that you are using for dynamic analysis. See Open GApps.

For more information regarding the doc, you can visit ==https://mobsf.github.io/docs/#/==.

\

Free and Open Source Mobile Application Testing Tools

Mobile security testing tools can be classified under open source tools, Free and Paid. There are many open-source tools available for mobile automation testing. Some of the most popular open-source mobile security testing tools are:

\

QUARK

It stands for Quick Android Review Kit, a popular Android app pen-testing tool for assessing the security of an Android application.

QUARK is a free and open-source Android security auditing tool developed by LinkedIn. You can perform static code analysis of source code or an existing .apk file using the device. It generates a report with potential security vulnerabilities and ways to fix them after running a security check.

\

Drozer

Drozer is an excellent security controlling tool maintained by MWR InfoSecurity. You get incredible confidence when auditing your apps using Drozer. It also accelerates android security assessment. Besides these, Drozer enables you to:

\

Test exposure to public
Run regression test
Execute dynamic Java code since it supports both Android devices and emulators
Discover and interact with the attack surface exposed by Android apps

\

iMas

iMas is a free and open-source mobile application pen-testing tool used for testing iOS applications. It helps encrypt application data, preventing tampering while enforcing enterprise policies on iOS apps. iMas enables you to protect your iOS app from jailbreaks, secure sensitive information in memory and mitigate against binary patching.

\

TestProject

TestProject is the world's first free cloud-based service. It permits users to test Android and iOS applications on all operating systems effortlessly and on web apps. TestProject uses advanced built-in recording capabilities, creates and uses add-ons, or develops coded tests using TestProject's powerful SDK. All this for free.

\

Paid Mobile Application Testing Tools

\

AppKnox

\

AppKnox performs Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Application Programming Interface (API) Testing, Manual Penetration testing, and Remediation call. This tool is not free, but there is a free trial version. You can request a demo here.

2. Datatheorem

Credit: https://www.datatheorem.com/

Datatheorem offers Mobile secure, Web Secure, Cloud Secure, and API Secure. You can try the free version here or request a demo.

Datatheorem offers Mobile AppSec, Shadow APIs, DevSecOps, Open Source Libraries/SDKs, Compliance, and Counterfeit Apps. They provide you a Gartner report available on their website. It contains information that can help individuals learn about the risks and best practices for protecting modern mobile apps and preventing them from being hacked through APIs, web, or cloud vectors.

\

MobSF vs. Datatheorem and AppKnox

Mobile Security Framework(MobSF)

MobSF is an automated all-in-one mobile application (be it Android, iOS or Windows(, malware analysis, pen-testing and security assessment framework that can perform:

\

Static analysis
Dynamic analysis. The Dynamic analyzer helps you perform a runtime security assessment.

\

It supports:

\

Mobile app binaries (APK, XAPK, IPA & APPX)
Zipped source code
It provides REST APIs for seamless integration with CI/CD or DevSecOps pipeline.

MobSF:

\

Works by uploading the binary of the application
Only has CWE, CVSS included in the Regulatory Compliance
DAST(Static Application Security Testing) is available only for Android and runs on a simulator
It is available on Local Installation, and only Docker Integration is available.

MobSF is the brainchild of Ajin Abraham, Magaofei, Matan Dobrushin, and Vincent Nadal. You can connect with the MobSF team's Slack channel here. MobSF team also offers e-learning courses for beginner and advanced practitioners. You can get your certification in their Automated Mobile Application Security Assessment with MobSF -MAS and Android Security Tools Expert -ATX.

2. AppKnox

AppKnox is a paid solution that offers:

\

Tools for Vulnerabilities assessment
- Static Application testing
- Dynamic Application testing
- API Security testing
  
  \
Penetration Testing Tools
- Manual Penetration testing
- Remediation calls

The pricing depends on individuals. It's divided into three categories:

\

Essential
Professional Ideal For Businesses With Multiple Updates
Enterprise Ideal For Banks/Enterprises

AppKnox:

\

Works by uploading the binary of the application.
Has OWASP, PCI DSS, HIPAA, GDPR and CWE, CVSS included in Regulatory Compliance
You can integrate JIRA, Github, CLI with Eclipse
Has Report and Telephonic remediation
Is available on Cloud, On-Premise
AppKnox DAST runs on real devices

Below you will find a brief description, but also feel free to check on their website for any updates.

Credit: https://www.appknox.com/

Other APPKnox resources that you can exploit includes:

\

3. DataTheorem

**DataTheorem **is another modern application security tool.

The DataTheorem Analyzer Engine continuously analyses APIs, web, mobile, and cloud applications in search of security defects.

Its products help organizations prevent AppSec data breaches. Data Theorem has offices in New York and Paris, with headquarter in Palo Alto. Datatheorem secures user data across mobile and modern applications with solutions designed to automate development models.

Solutions offered by DataTheorem include:

\

\n Additional resources:

\

Webinars
White papers, ebook and analyst reports
Case studies
Infographics
Vidos and
blogs

DataTheorem's landmark product includes:

\

Besides their solutions and products, you even have the opportunity, if you are an elite, to be part of the datatheorem team and acquire a lot of experience.

MobSF is one open-source technology I would recommend to all my peers. It offers an excellent security framework with user-friendly features and an affordable pricing structure. So, if you are looking to pick one mobile security enterprise for your smartphone's protection, MobSF would be my sure shot.

Aviyel is partnering with MobSF to deliver a one-of-a-kind mobile security infrastructure available in the electronics industry. To know more about Aviyel's recent endeavors, follow our discussions here.

A Brief Introduction and Guide to Mobile Security Framework (MobSF)