Testes de segurança em aplicações Android baseados na metodologia OWASP

Abstract

The Android operating system, being open source and being able to be run on different types of devices, such as smartphones and tablets, makes it acquired and used worldwide, along with the applications that can be run on this platform. Like any other software, they can have compromising vulnerabilities, such as those listed by the OWASP Mobile Top Ten, and for this reason, it is necessary to apply a security testing methodology, mainly addressing the static and dynamic context. For this, the use of a guide of security requirements and procedures for carrying out these tests is necessary to investigate the 10 most dangerous vulnerabilities, through tools indicated by the test procedures guide, which involve static source code analysis tools, network communication analysis, and tools for analyzing the running application. The 5 public applications, which were tested on an Android emulator, contained the set of 10 vulnerabilities and, with the analysis of each vulnerability, it was possible to notice that most of them were caused by bad programming practices.