Um guia para análise de segurança de aplicativos na plataforma android

Abstract

This article proposes a guide for vulnerability analysis of applications from the Android operating system for smartphones that brings a list of the found vulnerabilities as result. The guide was based from OWASP Mobile Top 10 2016, which gathers the 10 main vulnerabilities in mobile applications that had appeared in 2016. The guide splited the components to be analised in three: cryptograph uses; persistance and communications mechanisms; code, settings and platform. Each component had it’s possible vulnerabilities listed, in which had scores of severity attributed from the calculator from Common Vulnerability Scoring System(CVSS), together which it’s solutions and how to find if these vulnerabilities are present. For easy assimilation, the vulnerabilities were dividied in the low, medium, high and critical severity in the way they corresponds to each grade form CVSS. At the end is made a auditory from three Android application from distict categories that showed how the guide was effective in it’s proposed objective of finding vulnerabilities.