Académique Documents
Professionnel Documents
Culture Documents
Verification Level
Name:
Org:
Title:
Phone:
E-mail:
Name:
Org:
Title:
Phone:
E-mail:
e Application Security Checklist
After consultation with <Customer> it was decided that only Level 1 requrirements are applicable to <AppName>.
` 0.50
Android
P F
V1: Architecture, Design and Threat Modelling 1 0
V2: Data Storage and Privacy 0 0
V3: Cryptography Verification 0 0
V4: Authentication and Session Management 0 0
V5: Network Communication 0 0
V6: Platform Interaction 0 0
V7: Code Quality and Build Settings 0 0
V8: Resiliency Against Reverse Engineering 0 0
MASVS Compliance Score ( / 5)
1
ling
MASVS Compliance Diagram - Android
Android
Android iOS
NA % P F NA %
6 100.00% 0 0 6 0.00%
5 0.00% 0 0 5 0.00%
0 0.00% 0 0 0 0.00%
5 0.00% 0 0 5 0.00%
3 0.00% 0 0 3 0.00%
0 0.00% 0 0 0 0.00%
0 0.00% 0 0 0 0.00%
12 0.00% 0 0 12 0.00%
MASVS Compliance Score ( / 5)
0
V1: Architecture, Design and Threat Modelling
MASVS Compliance Diagram - iOS
1.00 IOS
V2: Data Storage and Privacy V8: Resiliency Against Reverse Engineering
0.50
0
ce Diagram - iOS
IOS
Reverse Engineering
n
Resiliency against Reverse Engineering - Android
8.1
8.2
8.3
8.4
8.5
8.6
8.7
8.8
8.9
8.10
8.11
8.12
Legend
Symbol
Pass
Fail
N/A
Resiliency against Reverse Engineering - Android
Verify that all executable files and libraries belonging to the app are either encrypted on the file level and/or important co
data segments inside the executables are encrypted or packed. Trivial static analysis does not reveal important code or dat
Verify that if the goal of obfuscation is to protect sensitive computations, an obfuscation scheme is used that is both appro
for the particular task and robust against manual and automated de-obfuscation methods, considering currently published
research. The effectiveness of the obfuscation scheme must be verified through manual testing. Note that hardware-base
isolation features are prefered over obfuscation whenever possible.
Definition
Requirement is applicable to mobile App and implemented according to best practices.
Requirement is applicable to mobile App but not fulfilled.
Requirement is not applicable to mobile App.
R Status Testing Procedure
✓ N/A
Testing Advanced Root Detection
✓ N/A
Testing Debugging Defenses
✓ N/A Testing File Integrity Checks
✓ N/A
Testing Detection of Reverse Engineering Tools
✓ N/A Testing Simple Emulator Detection
✓ N/A
Testing Memory Integrity Checks
✓ N/A
Verifying the Variability of Tampering Responses
✓ N/A Testing Detection Mechanisms
✓ N/A Testing Simple Obfuscation
✓ N/A
Testing Device Binding
✓ N/A
Testing Advanced Anti-Emulation
✓ N/A
ID
V1
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.10
V2
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.10
2.11
2.12
V3
3.1
3.2
3.3
3.4
3.5
3.6
V4
4.1
4.2
4.3
4.4
4.5
4.6
4.7
4.8
4.9
4.10
4.11
V5
5.1
5.2
5.3
5.4
5.5
5.6
V6
6.1
6.2
6.3
6.4
6.5
6.6
6.7.
6.8
V7
7.1
7.2
7.3
7.4
7.5
7.6
7.7
7.8
7.9
Legend
Symbol
Pass
Fail
N/A
Mobile Application Security Requirements - Android
Verify that the app does not use cryptographic protocols or algorithms that are widely considered depreciated for security
Verify that the app doesn't re-use the same cryptographic key for multiple purposes.
Verify that all random values are generated using a sufficiently secure random number generator.
Authentication and Session Management
Verify that if the app provides users with access to a remote service, an acceptable form of authentication such as usernam
authentication is performed at the remote endpoint.
Verify that the remote endpoint uses randomly generated session identifiers, if classical server side session management i
authenticate client requests without sending the user's credentials.
Verify that the remote endpoint uses server side signed tokens, if stateless authentication is used, to authenticate client re
without sending the user's credentials.
Verify that the remote endpoint terminates the existing session when the user logs out.
Verify that a password policy exists and is enforced at the remote endpoint.
Verify that the remote endpoint implements a mechanism to protect against the submission of credentials an excessive nu
times.
Verify that biometric authentication, if any, is not event-bound (i.e. using an API that simply returns "true" or "false"). Inste
based on unlocking the keychain/keystore.
Verify that sessions are terminated at the remote endpoint or tokens expire after a predefined period of inactivity.
Verify that a second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforce
Verify that step-up authentication is required to enable actions that deal with sensitive data or transactions.
Verify that the app informs the user of all login activities with his or her account. Users are able view a list of devices used
account, and to block specific devices.
Network Communication
Verify that data is encrypted on the network using TLS. The secure channel is used consistently throughout the app.
Verify that the TLS settings are in line with current best practices, as far as they are supported by the mobile operating sys
Verify that the app verifies the X.509 certificate of the remote endpoint when the secure channel is established. Only certi
by a valid CA are accepted.
Verify that the app either uses its own certificate store, or pins the endpoint certificate or public key, and subsequently do
establish connections with endpoints that offer a different certificate or key, even if signed by a trusted CA.
Verify that the app doesn't rely on a single insecure communication channel (email or SMS) for critical operations, such as
and account recovery.
Verify that the app only depends on up to date connectivity- and security libraries.
Platform Interaction
Verify that the app only requires the minimum set of permissions necessary.
Verify that all inputs from external sources and the user are validated and if necessary sanitized. This includes data receive
IPC mechanisms such as intents, custom URLs, and network sources.
Verify that the app does not export sensitive functionality via custom URL schemes, unless these mechanisms are properly
Verify that the app does not export sensitive functionality through IPC facilities, unless these mechanisms are properly pro
Verify that JavaScript is disabled in WebViews unless explicitly required.
Verify that WebViews are configured to allow only the minimum set of protocol handlers required (ideally, only https). Pot
dangerous handlers, such as file, tel and app-id, are disabled.
If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within
package.
Verify that object serialization, if any, is implemented using safe serialization APIs.
Code Quality and Build Settings
Verify that the app is signed and provisioned with valid certificate.
Verify that the app has been built in release mode, with settings appropriate for a release build (e.g. non-debuggable).
Verify that debugging symbols have been removed from native binaries.
Verify that debugging code has been removed, and the app does not log verbose errors or debugging messages.
Verify that all third party components used by the mobile app, such as libraries and frameworks, are identified, and checke
vulnerabilities.
Verify that the app catches and handles possible exceptions.
Verify that error handling logic in security controls denies access by default.
Verify that in unmanaged code, memory is allocated, freed and used securely.
Free security features offered by the toolchain, such as byte-code minification, stack protection, PIE support and automati
counting, are activated.
Definition
Requirement is applicable to mobile App and implemented according to best practices.
Requirement is applicable to mobile App but not fulfilled.
Requirement is not applicable to mobile App.
Level 1 Level 2 Status
✓ ✓ Pass
✓ ✓
✓ ✓
✓ ✓
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ ✓
✓ ✓
✓ ✓
✓ N/A
✓ N/A
✓ N/A
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
Testing Procedure
-
-
-
-
-
-
-
-
-
-
ID
V1
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.10
V2
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.10
2.11
2.12
V3
3.1
3.2
3.3
3.4
3.5
3.6
V4
4.1
4.2
4.3
4.4
4.5
4.6
4.7
4.8
4.9
4.10
4.11
V5
5.1
5.2
5.3
5.4
5.5
5.6
V6
6.1
6.2
6.3
6.4
6.5
6.6
6.7
6.8
V7
7.1
7.2
7.3
7.4
7.5
7.6
7.7
7.8
7.9
Legend
Symbol
Pass
Fail
N/A
Mobile Application Security Requirements - iOS
Verify that the keyboard cache is disabled on text inputs that process sensitive data.
Verify that the clipboard is deactivated on text fields that may contain sensitive data.
Verify that no sensitive data is exposed via IPC mechanisms.
Verify that no sensitive data, such as passwords or pins, is exposed through the user interface.
Verify that no sensitive data is included in backups generated by the mobile operating system.
Verify that the app removes sensitive data from views when backgrounded.
Verify that the app does not hold sensitive data in memory longer than necessary, and memory is cleared explicitly after u
Verify that the app enforces a minimum device-access-security policy, such as requiring the user to set a device passcode.
Verify that the app educates the user about the types of personally identifiable information processed, as well as security
the user should follow in using the app.
Cryptography
Verify that the app does not rely on symmetric cryptography with hardcoded keys as a sole method of encryption.
Verify that the app uses proven implementations of cryptographic primitives.
Verify that the app uses cryptographic primitives that are appropriate for the particular use-case, configured with paramet
adhere to industry best practices.
Verify that the app does not use cryptographic protocols or algorithms that are widely considered depreciated for security
Verify that the app doesn't re-use the same cryptographic key for multiple purposes.
Verify that all random values are generated using a sufficiently secure random number generator.
Authentication and Session Management
Verify that if the app provides users with access to a remote service, an acceptable form of authentication such as usernam
authentication is performed at the remote endpoint.
Verify that the remote endpoint uses randomly generated session identifiers, if classical server side session management i
authenticate client requests without sending the user's credentials.
Verify that the remote endpoint uses server side signed tokens, if stateless authentication is used, to authenticate client re
without sending the user's credentials.
Verify that the remote endpoint terminates the existing session when the user logs out.
Verify that a password policy exists and is enforced at the remote endpoint.
Verify that the remote endpoint implements a mechanism to protect against the submission of credentials an excessive nu
times.
Verify that biometric authentication, if any, is not event-bound (i.e. using an API that simply returns "true" or "false"). Inste
on unlocking the keychain/keystore.
Verify that sessions are terminated at the remote endpoint or tokens expire after a predefined period of inactivity.
Verify that a second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforce
Verify that step-up authentication is required to enable actions that deal with sensitive data or transactions.
Verify that the app informs the user of all login activities with his or her account. Users are able view a list of devices used
account, and to block specific devices.
Network Communication
Verify that data is encrypted on the network using TLS. The secure channel is used consistently throughout the app.
Verify that the TLS settings are in line with current best practices, as far as they are supported by the mobile operating sys
Verify that the app verifies the X.509 certificate of the remote endpoint when the secure channel is established. Only certi
by a valid CA are accepted.
Verify that the app either uses its own certificate store, or pins the endpoint certificate or public key, and subsequently do
establish connections with endpoints that offer a different certificate or key, even if signed by a trusted CA.
Verify that the app doesn't rely on a single insecure communication channel (email or SMS) for critical operations, such as
and account recovery.
Verify that the app only depends on up to date connectivity- and security libraries.
Platform Interaction
Verify that the app only requires the minimum set of permissions necessary.
Verify that all inputs from external sources and the user are validated and if necessary sanitized. This includes data receive
IPC mechanisms such as intents, custom URLs, and network sources.
Verify that the app does not export sensitive functionality via custom URL schemes, unless these mechanisms are properly
Verify that the app does not export sensitive functionality through IPC facilities, unless these mechanisms are properly pro
Verify that JavaScript is disabled in WebViews unless explicitly required.
Verify that WebViews are configured to allow only the minimum set of protocol handlers required (ideally, only https). Pot
dangerous handlers, such as file, tel and app-id, are disabled.
If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within
package.
Verify that object serialization, if any, is implemented using safe serialization APIs.
Code Quality and Build Settings
Verify that the app is signed and provisioned with valid certificate.
Verify that the app has been built in release mode, with settings appropriate for a release build (e.g. non-debuggable).
Verify that debugging symbols have been removed from native binaries.
Verify that debugging code has been removed, and the app does not log verbose errors or debugging messages.
Verify that all third party components used by the mobile app, such as libraries and frameworks, are identified, and checke
vulnerabilities.
Verify that the app catches and handles possible exceptions.
Verify that error handling logic in security controls denies access by default.
Verify that in unmanaged code, memory is allocated, freed and used securely.
Free security features offered by the toolchain, such as byte-code minification, stack protection, PIE support and automati
counting, are activated.
Definition
Requirement is applicable to mobile App and implemented according to best practices.
Requirement is applicable to mobile App but not fulfilled.
Requirement is not applicable to mobile App.
Level 1 Level 2 Status
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ N/A
✓ ✓
✓ ✓
✓ ✓
✓ N/A
✓ N/A
✓ N/A
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
✓ ✓
Testing Procedure
-
-
-
-
-
-
-
-
-
-
Testing Whether the Keyboard Cache Is Disabled for Text Input Fields
Testing for Sensitive Data in the Clipboard
Testing Whether Sensitive Data Is Exposed via IPC Mechanisms
Testing for Sensitive Data Disclosure Through the User Interface
Testing for Sensitive Data in Backups
Testing for Sensitive Information in Auto-Generated Screenshots
Testing for Sensitive Data in Memory
Testing the Device-Access-Security Policy
8.1
8.2
8.3
8.4
8.5
8.6
8.7
8.8
8.9
8.10
8.11
8.12
Legend
Symbol
Pass
Fail
N/A
Resiliency Against Reverse Engineering - iOS
Definition
Requirement is applicable to mobile App and implemented according to best practices.
Requirement is applicable to mobile App but not fulfilled.
Requirement is not applicable to mobile App.
R Status Testing Procedure
✓ N/A
Testing Advanced Root Detection
✓ N/A
Testing Debugging Defenses
✓ N/A Testing File Integrity Checks
✓ N/A
Testing Detection of Reverse Engineering Tools
✓ N/A Testing Simple Emulator Detection
✓ N/A Testing Memory Integrity Checks
✓ N/A
Verifying the Variability of Tampering Responses
✓ N/A Testing Detection Mechanisms
✓ N/A Testing Simple Obfuscation
✓ N/A
Testing Device Binding
✓ N/A
Testing Advanced Anti-Emulation
✓ N/A